x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xa) [ 1982.869689] binder: 29635:29636 got reply transaction with bad transaction stack, transaction 5151 has target 29635:0 [ 1982.894700] binder: BINDER_SET_CONTEXT_MGR already set 19:20:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0xffffffc3}}) [ 1982.926069] binder: 29632:29637 ioctl 40046207 0 returned -16 [ 1982.965367] binder: 29635:29636 transaction failed 29201/-71, size 0-0 line 2816 19:20:32 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0xffffffff, 0x900) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000140)={0x8, 0x0, 0x3, 0x7}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000180)={0xa0b, r2, 0x10001, 0x65ab}) r3 = syz_open_pts(r0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r8 = dup3(r3, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000001c0)) [ 1982.987280] binder: 29635:29636 ioctl c0306201 20000600 returned -14 19:20:32 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xeffdffff) 19:20:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0xfffffffe}}) 19:20:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1983.102954] binder: release 29635:29636 transaction 5151 out, still active [ 1983.123319] binder: send failed reply for transaction 5151, target dead 19:20:32 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xf4010000) 19:20:32 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe) [ 1983.188239] binder: 29665:29666 got reply transaction with bad transaction stack, transaction 5155 has target 29665:0 19:20:32 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x100000000000000}}) 19:20:32 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000100)={0x0, @aes128, 0x0, "9523101a84ecae44"}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$sndpcmc(&(0x7f0000000140)='/dev/snd/pcmC#D#c\x00', 0x8, 0x101000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r5, 0x84, 0x15, &(0x7f0000000180)={0x81}, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f00000001c0)=0x3) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1983.251009] binder: 29665:29666 transaction failed 29201/-71, size 0-0 line 2816 [ 1983.280249] binder: 29665:29666 ioctl c0306201 20000600 returned -14 19:20:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x2, 0x10000) ioctl$KVM_PPC_GET_PVINFO(r3, 0x4080aea1, &(0x7f0000000100)=""/6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000062711498cffbae983d2dd6f1fd5f039004ced580fa27585ed38de9f682b28483f7aead02b9ad402730b30085e8e433f9b4b2dd06250447f19c169c7fe1afbb0a2d5265240d39f97583abfa3ee14d3ef5dc51a8e3a4cdd887db8e72b1037e145938d15964c7bb786726ec2d785e4"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x200000000000000}}) 19:20:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:33 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xfeffffff) 19:20:33 executing program 2: socket$bt_bnep(0x1f, 0x3, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r6, 0x84, 0x20, &(0x7f0000000100), &(0x7f0000000140)=0x4) 19:20:33 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x10) [ 1983.708841] binder: 29698:29699 got reply transaction with bad transaction stack, transaction 5158 has target 29698:0 [ 1983.746257] binder: 29698:29699 transaction failed 29201/-71, size 0-0 line 2816 19:20:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x300000000000000}}) [ 1983.756189] binder: BINDER_SET_CONTEXT_MGR already set [ 1983.777076] binder: 29707:29708 ioctl 40046207 0 returned -16 [ 1983.795164] binder: 29698:29699 ioctl c0306201 20000600 returned -14 19:20:33 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xff030000) 19:20:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0xffefffffff7f0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x400000000000000}}) [ 1983.906612] binder: release 29698:29699 transaction 5158 out, still active [ 1983.920963] binder: send failed reply for transaction 5158, target dead 19:20:33 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x11) [ 1983.999435] binder: 29729:29730 unknown command 0 [ 1984.018857] binder: BINDER_SET_CONTEXT_MGR already set [ 1984.031047] binder: 29729:29730 ioctl c0306201 20000140 returned -22 19:20:33 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xffff0000) 19:20:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1984.049209] binder: 29732:29733 ioctl 40046207 0 returned -16 19:20:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0xf00000000000000}}) 19:20:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1984.119933] binder: 29732:29733 got reply transaction with bad transaction stack, transaction 5163 has target 29729:0 [ 1984.154734] binder: 29732:29733 transaction failed 29201/-71, size 0-0 line 2816 [ 1984.179503] binder: 29732:29733 ioctl c0306201 20000600 returned -14 [ 1984.232740] binder: 29754:29755 unknown command 0 19:20:33 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xfffff000) [ 1984.253175] binder: 29754:29755 ioctl c0306201 20000140 returned -22 19:20:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0xffffffffff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x3f00000000000000}}) 19:20:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000200)={r2, 0x8}, 0x8) r3 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:34 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1c) 19:20:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) socket(0x13, 0x4, 0x5228) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x100000000400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000100)={0x32, 0x10001}) 19:20:34 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xfffffdef) [ 1984.426685] binder: 29768:29769 got reply transaction with bad transaction stack, transaction 5168 has target 29768:0 [ 1984.454859] binder: 29768:29769 transaction failed 29201/-71, size 0-0 line 2816 19:20:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x4000000000000000}}) [ 1984.491209] binder: 29768:29769 ioctl c0306201 20000600 returned -14 19:20:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1984.537581] binder: release 29774:29777 transaction 5170 out, still active 19:20:34 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xffffff7f) [ 1984.616505] binder: BINDER_SET_CONTEXT_MGR already set 19:20:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1984.639206] binder: 29791:29792 ioctl 40046207 0 returned -16 [ 1984.640378] binder: release 29768:29769 transaction 5168 out, still active [ 1984.653049] binder: send failed reply for transaction 5168, target dead 19:20:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0xc3ffffff00000000}}) [ 1984.683996] binder: send failed reply for transaction 5170, target dead [ 1984.716875] binder: 29804:29805 got reply transaction with bad transaction stack, transaction 5173 has target 29804:0 19:20:34 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xfffffffe) 19:20:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x3, 0x4002) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000100)={0xe3, 0x8, 0xfffffffffffffffc, 0x81, 0xd, 0x20000000000, 0x1, 0x7fffffff, 0x704, 0x62, 0x6, 0x10000}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c6300005795a7303e9ec1a3a7c4d59c0db2b6b265819b9c04d8c1ea2970bcd18bd344da8a51623b26b0650f6a79205236ffffe16697e6ddfe43c13c205ee1cb1cd613dd000000000000000000000000000000"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1984.756845] binder: 29804:29805 ioctl c0306201 20000600 returned -14 19:20:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0xfdfdffff00000000}}) 19:20:34 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x60) [ 1984.851723] binder: release 29804:29805 transaction 5173 out, still active [ 1984.867863] binder_release_work: 14 callbacks suppressed [ 1984.867894] binder: undelivered TRANSACTION_COMPLETE 19:20:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/udp6\x00') write$UHID_INPUT(r5, &(0x7f0000000140)={0x8, "9b76f8b6b0a0ebe6b3c113d26badabc586f7e6730cd99e2c93f32e8a2e95df0aa6232abe48c444c622f4f3d5994272c2a9ff9a0696271edef0f1df3aaa58ddd517a90f5f5277646645fe71ce43ef0cfb14daec48ffd18fc7d2e8a91328becf636db09d9dd44f0accaaa4dc312b10ff521c390826e7ab42cebeadfd1dd1420ea9baee5c88e7f34457ae8e0c6631212d38f86204eca7bb79a545cedce6ef3030d7bf34787fe123904b73da0b7fd804e1ea433c1f13c3de805feeaa21218c76dd2c5b0b4905a34a9f77b11d8f2832e1b271e805c91cbee5951dd84cc54de4c781cab2d69e512413e4b696572a426e059a544c633c3aa2ce336487ac051f3f33ec1a80a847741a6c648640f2f5d3da39f2dfede8ac7aa83133a77659848808273337e2ac710f8fd1bc0adc5d62a5d26aa659f4f83d8a3f3e60f8175c98b94e2990f5daceef87acf50f24792b4f0b3e2e16736189d13dadb892319b4cc2b8581a52354aa92a0251dba57f750b420fd95fcfc3797e98da07cfdd05a05c142e4f423d91bf23ee7202ea5132f854d10e38552fbcedf757eb2fdccadd92be176c3c7ae3687611d75d695e77c25cd0c9d1e29962a246a5c2cbac19933e4795db4424240d30c5b12065c970b7ecbaacd0e3cdcad7f1429d20b404ad51af38cfec9e5f01c2b278425053a0c43a3a8854f40a86946dff8dcee8bceaf11f898efc1cf03b36f9e7f8a32987a73c3cc51d038803d8ad009aafeb7a14acef63af1158e2760caea012e0394aecb3ee1a1c0510c12f73f1b4fadcb9c6f67116f9387f8340235c836a11ab680d8f4d7c1bf45eae3c854bb99144c9cd886453b0b5726ef50305b5d5fbb1e9593f81de989e46f3af1e2d6503e0d82d301d36dbef083873a39671a5b96975e6a33de19e4c96fff99432ad70c105e691592a849a20c94123d88e7c67152b4766fd57aa62934210db048c5b5c4976f843625ad72ff92549ab05e3f290b2fcd053e343961ab7e63ee323c6065524762969ced807100c3e769ab8caa226db7391e09e2508a84805ff3d45351dc08d3aba147c2ef70e1a697f08653be33bb66c2c33064ecadf7a3d92639a7bf5f41d213c2417b6ed66279b2a703e251479b6da5ca6f8f01e5f4b6614cca1801458be1f8818a95609d2490cf269cb5da5f6f4bc67d17b0aeb0a55cc908fa9c6ae29f6d8b775e7a3b05e81e0a2a163ce7bb838d411ed1142a3d0b837f66564c8dd3ea7b5e89996d4e8b31140149f77372754993ac2849e40ad0797f9e496d54969dc4b125e6d242d7c20ff45ae5c924d80d701b7dfb480e0d77aa944426d73e3ccaa7d898dd0383b0462f4c5de5d9ebce576af7ec0a26d64abb3d4789b55ee15bd515f75754eebbd4b66f8bc879bf752154993b6364d5840daf2613e37ca6bc702f856976189378a54e4722597bd55b27298a4f5b0ccecda985686ddc54fd2361e7c9e59b2d2f6d2fae373b984283edfa019024de7ee447c7f5d1d1456d64122f3de51a81cf9c7adf5ccb0fa9fe3b83fe0161a7198cb68fdf7cd0d8395475dd6e43a64f44935b937f5dd29de5b8cac9a01e522ddd15a9e6e4aec9a46fda62967a729b8d283fc6825ee933367494e47dbd58cdfb99522e48388d6cd2e462461a7ab180994177c4b95b1c301d07968d6f9a5ed475cbdc67bb47bf83cf3a35d9817993a684681ad3de434872f1cb337707899a2a52f73e610ba199d003bb88d7ccb21e85687acf0c0a4409bbb0deb3eec5fba76bbd45c188ccd5c97fcf8b61bcda5c3d74e79479077dddbfbbba3620f59e72e18239dfe5ee0e1ece82783019b4ab00ebb0e9d391226c409917cd088cb33c4c6d0796eac96158cedb2cab29da8ee4534c5902bb7b6c64c8c8b9c93ae0fa0e349ce52e288bb1ecf553dd1b038e519d6006d51d58615f9600c11378d8cfa8240129ba690274f838316701abc42f608a18f1e075f02e9108bd47287c5b73ccc3de15d0314797ced86843af94834eacf5c3393ab67d13f78ee56d1e3c0971182079ea0d57065928736a006909160222e85229bc6fed1a46a2b12fcd9de95072b14cfd10f793392efe1b5ecbf268218004db740588ec909bbf86d2bdd15db30c4a320bb23190c4a306dacd895a0a4c187563c05881942804608ed5bddaa5449694e7cc48f2d2ec8704e578540fe10d5f32692aca1b06d369ae544e1ae05e09f582f26bd3acf40a777d277de0a172676e0f0162646eebd985360f3e56e514d94fa048ec77bc67910f6a13eeecad35d1ad6a3db9f66b36cbf4573b3c862696d8d978c6fa56301a272ef92b692effddc5f30a0bdb0f458631e217e678a299ee480d5a9ba916cee4d466690e9f187de9bf85fbf1b3205200d4029e2523535992cec2aaf734e0444323a3d70bc63547807f4e8674102941ea51fc97d13cae5ec1e0cbd2f6b457997587013b417ad43d785be6ed33d88a492769bb8de74e9540874caf3d5d996faedb0ae8d43cf3b5924393cd770bc294f3a9558e0e231ada80e087abb2d43836245e0be34c101294f8007ed610289e40a10da6caca5d687a1f435814e8cc837dc14977ef1b383451c67925d6b79187d45e6bf004bb86d33ecf65613d69a66d1fba2074965b0f8efdd256c1a3abddcdc41c357f0edd19cfa912ce3b60205bbff3c64124ca1315bdb4b6405b83da6477d429c14c936f924336377c81023f771371fa0ee78ab0f30313cc646d3c60a6e4bbd23a41492f21b858435ee3cdca88e6d158ddb2c0f7e2024e56d7e45c32a1cc4238a592c9a4981f3f0e1728a35fa02e793bc6e28a2e0ed2d8627e226ae4c4e73a47b8169fce7279f72fa1452fb5031419d1d0f64223c186e3189f24327266985fecc2d299ce315b3fbf135bc4375119199b5cd1d8e80e8c13f09313600dec80a8134ea4ae947bdda08e488330131d3985e3ea2ca4e629295ad240c36ce06cc20c5a61e53775ede615af79757008b353b965231f06df79002d390b8dd6912a0efeb3d224d52530bd59a326ed568b6816b0a708bc73e4556ddf8a202d6dc94b25cb0a99bac32e6130ae02c035de76463824c82438c9baed82f4a89eea8003a1db725dc3842d99ef49f83895b40d854d2e91236339bb5d1e1e559e250c4e0b747f421814d219fc346828d53fa16d132d07fc6c6fd49bf51dc70f0cd40a32bf3aaf640f6da90a70a6b17cb6ba8b8cf68ddba62f2c2e7f9e5d9ae7e0ef2731217833761aa5d384774724d075d761cf39a746ec930066a9959466a2b03e61d238578a6af3ed4969aa24acdae5d15ee666c2342a2daa5fdff01f400b28ea3f7073fb9782bd5d95aa8c24ce79d22efff0ba89dc70e7654ab974699388593346fc8bcb485762caa12d29fa53911db0b730aad950235cbfb570f537c5b56a11fd0d8f29b8c7ce5dd386d15ccf8d12e235162a5cc8e7148288d5fb52b2f7173896ed700e1a9690c838f4409e1c426a09cc443670b18592d269ef2d28dd2c4f0a496fdb43114ac6926216d52cb73123c9952ca9bb6835933ceef53fb9e92e7920b38bc19b0121cdb8f3443e3843fe8b8dd649a9c2aca972f6f859fd73ca7de123f6ec33db49bde070655d9146b5de46c4bce1ba08598c53dd76db6679958ba85a339470f5f98f9235da1b41b4c364b9e8d1c17256d0c621e67777788cfd1f59083c33bb5dfc8be2343a1e526a166fbc6e09f47388057953a39fb97c0317d7090661626752e9b943ca0f18facfa952abb5078e5d94e4d3a43493992bb60e44242120c51d3b717371f15e59ecd2e853fdfd52101ac8afacb1faf2c9affab7a1ddd64f2572fc692348f9b9feb3e17852708ca89fa0c3c78fb9afcf187d50cb455de7e06d7e356f6567c7b79f1fea8270433c50d4c7f203c8537316566c42fc315141276e77cf8672df5e001d566057fbeebf0f39c209cfd9560672be21b12cfc9d661dd9eb85450a6d07249239376bf313a5218c29527c6d112a2bc26bbfac54034312b866294a71a125e7631fdea27abb59b756b178f265ef76c1cf3908c3c038c41b910c21cae033dae0e82e29f9b3d9d49532c197041ba810a3c87bed52075ed39f3b6ca6fe202f37280700a0e38dbe6ad59b19ae3f8cc9aa6394ad517259810d873fd5d7ffe8c0fdae4dbdd880f4158317978751659f1dc1d15e692cee013e3d6dc60bb24b5d0a47a57efe6e6489c0cdd709bf4f7d509893a32e685779c195b779246ae91b2a4a6acce902d0e1d90605289b46de68bc251d38acc6e59fec924039effe80c9c21636f9e7a32bd01f13966751cb30a69af558240b6009676f2475ac7f47ec9050918f0ac34c4e03970669ba545aad0ae7dcd6f641bb1663aafd5d050ccf4aad42ff733100ff12e0d01d987fbc63de6eedae902b171d08fd1bab7ed588f1c2aac01ee2bb00077d074f5e1f0dc563a8cb4dd72c34de5be8a7ead7c0b0c91e0b44e48c1d6e451f31bba8cc0bc54933c633420d96129e80a62c8be7f1ff4691133dd1b293c5a55970c63c4262df0996b6ae21cf487526dabaf7ea0c51c6c2e573dd57d357d023b88f9c9a6f4821e14e112baef09a01118206456d9032303e5ca908b11a97acadfe01ba15769d45c6c94fbccf6eee03f8af1115160a36ca45d6c851eabd7377258fbf399de9f45044a89e3d7bbd08f0a9d25acdbdf552cbda4e3453ff84af46d7fce86bd7fbdd154d330f6c5a00609778141793518ee6c73889ba0262bf9466063c3d96b6e75e21dd0ed302f0b605d9ad53eb4442214506e78bfa413e3bbead718764f4dbcaaab8a782b19bf0d68190ecc1347994b57be8e94aa8b33854fbce7e15c7ebbb80094cea2b8a78561eb7efc9f4cb85ceebdeb42b728e37d477e4f9227d2310e7d5af58b0cf93792d488462febe2d310ef06df3db3b6196d20ca0209350c46ec1be91849859e99f856877205c011a86eb7dfe739e884c314ad628a111c2658403d865dd49ec9c25c26b8e3c59ff606b4b230ddd1baec9288dbd1d2bb1d120053aa911ce41a73c677fac8ec1d0426db077cb47ba5bf6e3fb37c35287ef1846e49e7bcc6c7b29bb84ec8337ddaf3f66a9f19f74f180265e39a6b4dd599a4905f09966b7821e16f276278ff8413cfbcc2a38f7113e105dc8a51937bfed8cc9340a67e888a6c228328536965fba0d8aeed429516719f08413123d8fd154ed2ac4cb7ffe7fc043864590901f4b4d79847962d91885061c24c8cd67d95fc8dedcd59ba3676b9b2809d16be664930c063b6a3ebc56bb284a736a53880ff3846a7bb57c9f1dfe23678406af6e0e318e8c8bf8bf46926f5a92a3aede1b92c6bc4f8dccb342e73347b754cb8e3ed0f8c731b7eef17bf5c7bc6e5d2a6dd866213385cac59cadadf21763d24cfaf7c63234067cc91a018c6fe4b3c574943ac78cb28a6fef082fcfed29086d1282fbd1d47419e55db484c0bc0ab914327caf843fd5cbb0f97c109ed54bcadfe31da894c8c5f8bb6e1bfad0210d58d668dd23aaf71dc0ec255a042d4765e6be9b4462222869cfe796e1ffcaa462f4f68c2209e5dd37a6f5e6c6dff676a45d0ff07d129e274968f4be264a56c5a859fd98b84024754179b72b205a373a5204ff27c9837db2fd1cca2127bcf86e4317124b0fa7950214837b204609571f52ab0c1f6b2a1990d045aee54a220b06e76e00373ef469ccbfa45467b43f4fef59762d1c04ecd38290a10b038baf21ab6eba359ca00623ca2b3454d8c6d71b5e888bf1d647a65cd92fe1a30bc48d0ba1dd42d5691ef7a7f6c594daeb9ac89310f84e9d54fa0ca1e7d", 0x1000}, 0x1006) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r8 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:34 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x4000000000000) [ 1984.900671] binder: send failed reply for transaction 5173, target dead [ 1984.937723] binder: BINDER_SET_CONTEXT_MGR already set 19:20:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0063404000000000020000000000000000000000ce3d000000deffffff00000071dd1135cf9e3ae600000000000000000000daded7548ea08c55f5566bafba000000006a8e59344367121b27eb39f0de120629ffa204ccc8c42df6c8113bb949d1456dc8ad68c0811017e9655b57d130f4ab85ec1a44364e09268b00b60a2e0dab99"], 0x0, 0x0, 0x0}) r3 = accept4(r2, &(0x7f00000000c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, &(0x7f0000000040)=0x80, 0x80000) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f00000002c0)={0x6, [0x8, 0x7ff, 0x7, 0x10001, 0x8, 0x20]}, &(0x7f0000000300)=0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1984.996888] binder: 29823:29824 ioctl 40046207 0 returned -16 [ 1985.011358] binder: release 29817:29818 transaction 5176 in, still active [ 1985.019596] binder_send_failed_reply: 6 callbacks suppressed [ 1985.019606] binder: send failed reply for transaction 5176 to 29817:29818 19:20:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0xfeffffff00000000}}) [ 1985.054259] binder: undelivered TRANSACTION_COMPLETE [ 1985.060901] binder: 29823:29824 ioctl c0306201 20000600 returned -14 [ 1985.083034] binder_alloc: 29837: binder_alloc_buf size -2388596648504025392 failed, no address space [ 1985.130342] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 19:20:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fchdir(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000001667b119d36faaa100000000000000000000000000000000000000000000000000000000000000000000000000000000004873fce30af5a077f926914a2f5a570b01f1ce50ca05459205bfcb8f1c6edc1a801c6c0eb69a230b9e35915f9b3cf9e76eba2990f992954b619006b064952dd8b3542f6755960b8aa272ff65daad603fd9156336c804c92caf78ed13d1db3e6cae4c6d722f5b2db5dd9d15449254130efbc53775301173501e0000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:35 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe0) 19:20:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0xffffffff00000000}}) [ 1985.310520] binder: 29853:29854 got reply transaction with bad transaction stack, transaction 5181 has target 29853:0 [ 1985.360007] binder: BINDER_SET_CONTEXT_MGR already set 19:20:35 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x40030000000000) 19:20:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x7, 0x101800) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000940)=ANY=[@ANYBLOB="6e617400000000000000000000000000001b00000005000000a806000040050000000300000000000000000000400500001006000010060000100600001006000010060000070000008e41bfab5e07cf08ad027be0f31ba1829976b3f56369e629fe5817ed15c094b22066329ad2b176d32c453a4989426e77ba177732f060576392f401e14ce1fc73b202000000603a92557958e4a2548167bf0f0039130fd6f4e1177f000000000000000000000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8020003000000000000000000000000000000000000000000000000300262706600000000000000000000000000000000000000000000000000000101000000000000002e2f66696c653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c40800000000000038004d41535155455241444500000000000000000000000000000000000000000100000000000000ac1e0101000000004e24001000000000e0000002ac1414aa00000000ffffff006272696467655f736c6176655f3100006e6c6d6f6e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffdf017200000000000000000000000000009800d00000000000000000000000000000000000000000000000000038004d4153515545524144450000000000000000000000000000000000000000010000000900000000009397000000004e234e2000000000ac1414bb00000000ffffffff0000000073797a6b616c6c65723100000000000069666230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000880002000000000000000000000000000000280170010000000000000000000000000000000000000000000000006800697072616e67650000000000000000000000000000000000000000000001ffffffff000000000000000000000000e0000001000000000000000000000000fe880000000000000000000000000001000000000000000000000000000000011000000000000000280065636e0000000000000000000000000000000000000000000000000000003010063f000000004800444e4154000000000000000000000000000000000000000000000000000108000000fe880000000000000000000000000001fe8000000000000000000000000000bb00664e2200000000e0000001ff000000000000ff697036746e6c3000000000000000000076657468305f746f5f68737200000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006700012000000000000000000000000000009800d0000000000000000000000000000000000000000000000000003800444e415400000000000000000000000000000000000000000000000000000100000004000000ac14140a0000000005004e2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x708) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r2 = syz_open_pts(r0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = dup3(r2, r0, 0x0) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r7, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@rand_addr="0b7f258541f640f326a1bf76b5d18102", @in=@multicast2, 0x4e22, 0x9, 0x4e21, 0x800, 0x2, 0x80, 0x80, 0xfb, 0x0, r8}, {0xfafb, 0x9, 0x8, 0x6, 0x4, 0x5, 0x4, 0x5}, {0x9, 0xfffffffffffffe00, 0x5, 0x351}, 0x2, 0x0, 0x0, 0x0, 0x1, 0x3}, {{@in6=@remote, 0x4d2}, 0xa, @in6=@empty, 0x3504, 0x7, 0x3, 0xfb97, 0x6, 0x0, 0xa6}}, 0xe8) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1985.384199] binder: 29855:29857 ioctl 40046207 0 returned -16 [ 1985.411451] binder: 29853:29854 ioctl c0306201 20000600 returned -14 19:20:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x2}}) 19:20:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1985.542213] binder: release 29853:29854 transaction 5181 out, still active [ 1985.556365] binder: undelivered TRANSACTION_COMPLETE [ 1985.577192] binder_release_work: 24 callbacks suppressed [ 1985.577198] binder: undelivered TRANSACTION_ERROR: 29201 19:20:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x3}}) [ 1985.622881] binder: send failed reply for transaction 5181, target dead [ 1985.635760] binder: 29883:29884 got reply transaction with bad transaction stack, transaction 5185 has target 29883:0 19:20:35 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf0) 19:20:35 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xf0ffffffffffff) 19:20:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x4}}) [ 1985.673512] binder: send failed reply for transaction 5183 to 29855:29857 [ 1985.701323] binder: 29883:29884 ioctl c0306201 20000600 returned -14 [ 1985.829262] binder: release 29883:29884 transaction 5185 out, still active [ 1985.838976] binder: undelivered TRANSACTION_COMPLETE [ 1985.853195] binder: undelivered TRANSACTION_ERROR: 29201 [ 1985.872791] binder: send failed reply for transaction 5185, target dead 19:20:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r3, 0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000100)=0x0) timer_create(0x6, &(0x7f0000000140)={0x0, 0x1a, 0x5, @tid=r7}, &(0x7f0000000180)) 19:20:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:35 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x100000000000000) 19:20:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xf}}) 19:20:35 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1f4) [ 1986.141505] binder: undelivered TRANSACTION_COMPLETE [ 1986.147128] binder: undelivered TRANSACTION_ERROR: 29189 [ 1986.189336] binder: 29914:29917 got reply transaction with bad transaction stack, transaction 5188 has target 29914:0 [ 1986.194170] binder: BINDER_SET_CONTEXT_MGR already set [ 1986.227542] binder: 29914:29917 ioctl c0306201 20000600 returned -14 19:20:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x300}}) [ 1986.252425] binder: 29920:29921 ioctl 40046207 0 returned -16 19:20:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1986.347863] binder: undelivered TRANSACTION_COMPLETE [ 1986.353507] binder: undelivered TRANSACTION_ERROR: 29201 [ 1986.374896] binder: send failed reply for transaction 5188, target dead 19:20:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0xd, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) io_setup(0xfffffffffffffffa, &(0x7f0000000040)=0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vhost-net\x00', 0x2, 0x0) io_cancel(r4, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x6, 0x9, r1, &(0x7f0000000200)="761e62932def3734f4161d670a2727408f373a943598a92f4d69514460c5b49e9bbe33b355634390862ca608566721566f945a316ac702d99bb8890acc4409d6a0cef7064be44241b5b3ec523d3f3543e5dff28266ff045ec9d2675d2d0818fed952e8c04de107bf4df43ecbbb5a66e3c0e588b148bebe8412fba17bf4d1dfa2cd83db109324ae9e1da6303cd45a0cfdf539277f9fb95ea4d1ada645462b1def79d0375dd51c7686a44c365053ba506ade7cb065dfffdd7bd6d061d27da77baaeac6d8678532888ffd10bf823b3545efed2a7fd4142254734dcbd78364c94b362263c55fcd1b58847509eb48d56092c6456cfa", 0xf3, 0x400, 0x0, 0x2, r3}, &(0x7f0000000180)) [ 1986.392507] binder: 29935:29936 got reply transaction with bad transaction stack, transaction 5192 has target 29935:0 [ 1986.415578] binder: send failed reply for transaction 5190 to 29920:29921 [ 1986.443353] binder: undelivered TRANSACTION_COMPLETE [ 1986.452196] binder: 29935:29936 ioctl c0306201 20000600 returned -14 [ 1986.463777] binder: undelivered TRANSACTION_ERROR: 29189 19:20:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xf00}}) 19:20:36 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x300) [ 1986.488661] binder: BINDER_SET_CONTEXT_MGR already set 19:20:36 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x400000000000000) 19:20:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1986.535241] binder: 29941:29942 ioctl 40046207 0 returned -16 [ 1986.562719] binder: undelivered TRANSACTION_COMPLETE [ 1986.568042] binder: undelivered TRANSACTION_ERROR: 29201 19:20:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1986.588443] binder_alloc: 29935: binder_alloc_buf, no vma [ 1986.594172] binder: send failed reply for transaction 5192, target dead [ 1986.616354] binder_set_nice: 8 callbacks suppressed [ 1986.616372] binder: 29942 RLIMIT_NICE not set 19:20:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x3f00}}) [ 1986.663895] binder: 29956:29957 got reply transaction with bad transaction stack, transaction 5196 has target 29956:0 [ 1986.744586] binder: 29956:29957 ioctl c0306201 20000600 returned -14 19:20:36 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x4000}}) 19:20:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0x802, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f00000002c0)={'filter\x00', 0x0, 0x3, 0x54, [], 0x8, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000240)=""/84}, &(0x7f0000000340)=0x78) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) statfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/58) 19:20:36 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x500000000000000) 19:20:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:36 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x3e8) [ 1986.906766] binder: undelivered TRANSACTION_COMPLETE [ 1986.916918] binder: undelivered TRANSACTION_ERROR: 29201 [ 1986.943216] binder: send failed reply for transaction 5196, target dead [ 1987.021288] binder: 29985:29987 got reply transaction with bad transaction stack, transaction 5199 has target 29985:0 [ 1987.047510] binder_transaction: 10 callbacks suppressed [ 1987.047528] binder: 29985:29987 transaction failed 29201/-71, size 0-0 line 2816 [ 1987.078606] binder: 29985:29987 ioctl c0306201 20000600 returned -14 [ 1987.162584] binder: undelivered TRANSACTION_COMPLETE [ 1987.168144] binder: undelivered TRANSACTION_ERROR: 29201 [ 1987.189810] binder: send failed reply for transaction 5199, target dead [ 1987.277275] binder_alloc: binder_alloc_mmap_handler: 29941 20001000-20004000 already mapped failed -16 [ 1987.287676] binder_alloc: 29941: binder_alloc_buf, no vma [ 1987.293256] binder: 29941:29952 transaction failed 29189/-3, size 0-0 line 3035 [ 1987.301489] binder: 29945 RLIMIT_NICE not set [ 1987.303843] binder: undelivered TRANSACTION_ERROR: 29189 [ 1987.334783] binder: undelivered TRANSACTION_ERROR: 29189 19:20:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x1000000}}) 19:20:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:37 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x700000000000000) 19:20:37 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x500) 19:20:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0xfffffffffffffda6, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000180)={0xffffffffffffffff}, 0x111, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000200)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000140), r6, 0x0, 0x1, 0x4}}, 0x20) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r8 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1987.451726] binder: BINDER_SET_CONTEXT_MGR already set [ 1987.474663] binder: 30010:30012 ioctl 40046207 0 returned -16 [ 1987.475576] binder: 30007:30013 got transaction to context manager from process owning it [ 1987.508339] binder_alloc: 30007: binder_alloc_buf, no vma [ 1987.525101] binder: 30007:30013 transaction failed 29201/-22, size 0-0 line 2887 [ 1987.529978] binder: 30010:30012 transaction failed 29189/-3, size 0-0 line 3035 19:20:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x2000000}}) 19:20:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x2, 0x0) ioctl$RTC_WIE_ON(r3, 0x700f) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0}, &(0x7f00000003c0)=0xc) r5 = getegid() getresuid(&(0x7f0000000400)=0x0, &(0x7f0000000440), &(0x7f0000000480)) r7 = getuid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@empty}}, &(0x7f00000005c0)=0xe8) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000340)='fuse\x00', 0x20, &(0x7f0000000600)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x600}}], [{@obj_type={'obj_type', 0x3d, 'cpuset:'}}, {@uid_eq={'uid', 0x3d, r6}}, {@mask={'mask', 0x3d, '^MAY_READ'}}, {@uid_lt={'uid<', r7}}, {@smackfsdef={'smackfsdef', 0x3d, 'user'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '/dev/ptmx\x00'}}, {@euid_eq={'euid', 0x3d, r8}}, {@obj_type={'obj_type', 0x3d, '/dev/vcs\x00'}}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}]}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/fuse\x00', 0x2, 0x0) write$binfmt_script(r9, &(0x7f0000000140)={'#! ', './file0', [{0x20, '/dev/kvm\x00'}, {0x20, '/dev/ptmx\x00'}, {0x20, '/dev/kvm\x00'}, {0x20, ']}'}, {0x20, '/dev/ptmx\x00'}, {0x20, '/dev/ptmx\x00'}, {0x20, '/dev/vcs\x00'}, {0x20, '/dev/vcs\x00'}, {0x20, '/dev/kvm\x00'}], 0xa, "a20aa222b6c82d7d4337edfadd93e71f182482db67bf6ccbb4b9a4a391d9c36a061f58412f295bb393d61cea99c70343cc050401c0624371af8482ff4246a9339e866af02d3f48ae2ff897d877a35eb4ac13b43a1b7584aa3445db89988dd5dd56744c4b6da811fa371df6d67f1afd4ebc3388e70bbcbeff0ad13a5b5d5e7a10c5c3e8a25ce9c19521f93181cdd43e6e9e90c388d683c195c57736320452fe84734f4821df815e0265b2888f77b6c3f79021d55fc8e01aa5b22bae88334a40055904cca059095c86725fa94e785a68be634a9079041aacbc5d396cd33bc9e7101250ecc599d94124e9d29fa661"}, 0x14e) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f00000002c0)={0x18b1, 0x3e0}) dup3(0xffffffffffffffff, r0, 0x0) syz_kvm_setup_cpu$x86(r2, r10, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe64) [ 1987.561884] binder: 30013 RLIMIT_NICE not set [ 1987.633047] binder: 30010:30012 ioctl c0306201 20000600 returned -14 19:20:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x185803, 0x0) ioctl$BLKIOOPT(r3, 0x1279, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000fc000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x10000, 0x0) ioctl$CAPI_INSTALLED(r4, 0x80024322) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:37 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x800000000000000) 19:20:37 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x600) 19:20:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x3000000}}) 19:20:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) rmdir(&(0x7f0000000000)='./file0\x00') ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x4000000}}) [ 1987.922920] binder: BINDER_SET_CONTEXT_MGR already set [ 1987.952504] binder: 30043:30045 got reply transaction with bad transaction stack, transaction 5208 has target 30043:0 19:20:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000100)) [ 1987.993481] binder: 30048:30049 ioctl 40046207 0 returned -16 [ 1988.004576] binder: 30043:30045 transaction failed 29201/-71, size 0-0 line 2816 [ 1988.006127] binder: 30055 RLIMIT_NICE not set [ 1988.027633] binder: 30043:30045 ioctl c0306201 20000600 returned -14 19:20:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xf000000}}) 19:20:37 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x900000000000000) 19:20:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r3 = syz_open_dev$swradio(&(0x7f0000000240)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e20, 0x3, @loopback, 0x7ff}}, 0x8, 0xa9, 0x9, 0x7, 0x10}, &(0x7f0000000280)=0x98) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000000500)={r4, @in={{0x2, 0x4e21, @multicast1}}, 0x6, 0x5aa, 0xff, 0x3, 0x800}, &(0x7f00000002c0)=0x98) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$XDP_STATISTICS(r5, 0x11b, 0x7, &(0x7f0000000100), &(0x7f0000000200)=0x18) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r5, 0x10f, 0x84, &(0x7f0000000000), &(0x7f0000000040)=0x4) 19:20:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:37 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x700) [ 1988.174112] binder_thread_release: 4 callbacks suppressed [ 1988.174123] binder: release 30043:30045 transaction 5208 out, still active [ 1988.222016] binder: send failed reply for transaction 5210 to 30048:30055 19:20:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x3f000000}}) [ 1988.271846] binder_alloc: 30075: binder_alloc_buf size 576460752303423488 failed, no address space [ 1988.294452] net_ratelimit: 25 callbacks suppressed [ 1988.294461] protocol 88fb is buggy, dev hsr_slave_0 [ 1988.294502] protocol 88fb is buggy, dev hsr_slave_0 [ 1988.299501] protocol 88fb is buggy, dev hsr_slave_1 [ 1988.304531] protocol 88fb is buggy, dev hsr_slave_1 19:20:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x10000, 0x0) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) r7 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x0, 0x0) r8 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x100, 0x0) r9 = syz_open_dev$sndpcmp(&(0x7f0000000200)='/dev/snd/pcmC#D#p\x00', 0x4, 0x200) r10 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0xb2, 0x64100) ioctl$UDMABUF_CREATE_LIST(r5, 0x40087543, &(0x7f0000000280)={0x0, 0x6, [{r6, 0x0, 0x1000000, 0x1000}, {r7, 0x0, 0x100000000, 0xfffffffffffff000}, {r3, 0x0, 0xfffffffffffff000}, {r8, 0x0, 0xfffffffff001b000, 0x1000}, {r9, 0x0, 0xfffffffffffff000, 0xfffffffffffff000}, {r10, 0x0, 0x8000, 0x10000}]}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r11 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r12 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r12, r11, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1988.362209] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 1988.390656] binder: 30075:30076 transaction failed 29201/-28, size 0-576460752303423488 line 3035 19:20:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x40000000}}) 19:20:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="04634040000000000000000000000000000a00000000000000000000000000000000009e0400000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1988.504934] binder: release 30073:30074 transaction 5213 out, still active 19:20:38 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xa00000000000000) [ 1988.577817] binder: 30097:30099 got reply transaction with bad transaction stack, transaction 5215 has target 30097:0 [ 1988.593480] binder: BINDER_SET_CONTEXT_MGR already set [ 1988.610062] binder: 30102:30104 ioctl 40046207 0 returned -16 19:20:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xc3ffffff}}) 19:20:38 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x900) [ 1988.622591] binder: 30097:30099 transaction failed 29201/-71, size 0-0 line 2816 [ 1988.651730] binder: 30102:30104 unknown command 1077961476 [ 1988.672744] binder: 30097:30099 ioctl c0306201 20000600 returned -14 [ 1988.680464] binder: 30102:30104 ioctl c0306201 200001c0 returned -22 [ 1988.694494] protocol 88fb is buggy, dev hsr_slave_0 [ 1988.699613] protocol 88fb is buggy, dev hsr_slave_1 [ 1988.703894] binder: 30108 RLIMIT_NICE not set 19:20:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xfdfdffff}}) 19:20:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000300)={0x25, 0x8}) syz_open_pts(r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r6 = dup3(r0, r3, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf32(r4, &(0x7f0000000100)={{0x7f, 0x45, 0x4c, 0x46, 0x3ff, 0x7, 0x3, 0x0, 0x0, 0x0, 0x3f, 0x9, 0x125, 0x38, 0x312, 0x6f3f, 0x1, 0x20, 0x2, 0x3, 0xfda, 0x7fffffff}, [{0x4, 0x10000, 0x10001, 0x80000000, 0x7, 0x3, 0x5, 0x80}, {0x70000007, 0x20, 0x5, 0x534e, 0x655, 0x1, 0x80, 0xff}], "95efa62a3aa929662970828c05b3a671e2ca6bc171c0d76097d6f08d5aabca3ede0c0adbb52b707c4786af5e5eebc5086b8f447fa808a70c5b78330f2f84021b0dbcf2567e164e5889901add0c6c9b98494b5df795704cda0062740c29cdc0413e8101be03f06d401f4e042e8b49172d923b5c06c3f175f72c35291b308bb81e068ba41d", [[]]}, 0x1fc) dup3(r6, r5, 0x80000) [ 1988.774461] protocol 88fb is buggy, dev hsr_slave_0 [ 1988.779636] protocol 88fb is buggy, dev hsr_slave_1 [ 1988.784796] protocol 88fb is buggy, dev hsr_slave_0 [ 1988.789880] protocol 88fb is buggy, dev hsr_slave_1 19:20:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = dup2(r2, r2) ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f0000000000)={0x1, 0x5, 0x7}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1988.879318] binder: release 30097:30099 transaction 5215 out, still active [ 1988.947691] binder: 30131 RLIMIT_NICE not set [ 1988.967472] binder: BINDER_SET_CONTEXT_MGR already set [ 1988.981142] binder: 30131 RLIMIT_NICE not set 19:20:38 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x91d) 19:20:38 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xe00000000000000) [ 1989.008260] binder: 30134:30135 ioctl 40046207 0 returned -16 19:20:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xfeffffff}}) [ 1989.057005] binder: 30134:30135 got reply transaction with bad transaction stack, transaction 5219 has target 30129:0 19:20:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x10002) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r4, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1989.112729] binder: 30134:30135 transaction failed 29201/-71, size 0-0 line 2816 [ 1989.134729] binder: release 30129:30131 transaction 5218 in, still active [ 1989.141710] binder: send failed reply for transaction 5218 to 30129:30131 19:20:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="3d21aaf94d69828733f100bf516417704beb1de6385b456c4ba75bb5132957d8260d778a8a3d3db743acdad3f1466f420a077a104dd14b8bb399"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1989.162564] binder: 30134:30135 ioctl c0306201 20000600 returned -14 [ 1989.179937] binder: send failed reply for transaction 5219 to 30134:30135 19:20:38 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xfffffdfd}}) 19:20:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1989.310014] binder: 30156:30157 unknown command -106290883 [ 1989.347076] binder: 30156:30157 ioctl c0306201 20000140 returned -22 [ 1989.379034] binder: BINDER_SET_CONTEXT_MGR already set 19:20:39 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x1100000000000000) 19:20:39 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xa00) [ 1989.411504] binder: 30164:30167 ioctl 40046207 0 returned -16 19:20:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634000000000000000d17fa1ae00000000000000000000000000000000000000000000000000000000000000000061bcdd0ca75748eb650e0000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1989.461748] binder: send failed reply for transaction 5222 to 30156:30157 [ 1989.475568] binder: 30164:30167 transaction failed 29189/-22, size 0-0 line 2896 19:20:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xffffffc3}}) 19:20:39 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x1c00000000000000) [ 1989.528882] binder: 30164:30167 ioctl c0306201 20000600 returned -14 [ 1989.544102] binder: 30177:30180 unknown command 4219648 [ 1989.561498] binder: 30177:30180 ioctl c0306201 200001c0 returned -22 [ 1989.574230] binder: 30180 RLIMIT_NICE not set 19:20:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xfffffffe}}) 19:20:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x80000000000, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x8000, 0xde564333f92b1a6c) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000000200)={"f0c91bdecde095f0e2a644297663c2a78464259e0524d56fdd4bb66aee37347b4a5024abcca91fe08acc08ff1acfc024a907b280319ccd78a490c208c92ed641865deb3addc146e07b4b6061018ec08960561314b5d43e78da1f286cfc1efba6a4ac59180c13364a2f8df10b240c4999ac03d6314ddca4444f7c04cdce70b24dd84bb7bae7d60e00c772865e43c0a9d4538411e216dbd3d938d1623ac9b4b9bd08d4799ebb043bac10abc1ad6b6da8cf0f5417f9657b1f30fece3dd6a7e05b33be2fd2fdb41c07c36e464a776a57c471baf0979eb0f97494416611f7cce99400ff9afaf082ef7a143932cf0624cf85b71adabfcbe87563670d5d43ae2a9c935246bcd9bc15bd3406120acd02bcdf97e8362f4b2dd47d4bd9ed9abc7d73c117ea3633feadf2b56bd006b7792f3c5309008aa26942c91fe824c5111c4a7b925308dfb718ecd489459acbca30b76eea293f2bf0d962f183736764103a068c3c38e9ef89c696a1ba87e4eabce9942e6dded3063b824aa567bf01890e99fbe6da37ba15f48a868facc8694cbb0c494d77795a5933c4ebca175b111cd52f78b5c2d7f82ddc142bbf23486e71811cc0315e2405980937edabe5d1fcee4e2cc36b6e5e16102ea21b27f0c5375d900a9adc6ad2d12beb64fc19e4a7c0e275d1ee94bb152c0d7710d0249a8d2686bd64d39011df27992862c9f1a4b98ba7c58ffd34281bc275de29be4ac73ff5746ab2f4e74b54803b4f5beb217fedcd058e9fdb23c4d2338ce85381f3fe67b91828cfbdbdbb4d7a07ef6ee42ea1410a0826073a269eb16af5c9cd50b87bd29d87a87ff37d92a911542f889e589f8203ce749170bc5bee190947cea6438774550da93ab1694ee3bc4d1528ccba762a6530a026d8cc62e929232be74ef3c54749ce920eb4cba7ffe0c2c775bc225d256dfa0ec3d57723b800b7446da2ad10f8d65c7c373007764b374e41f1c900fe9b228e9aee19de2d04c9b1f2214301e2300189e05a51cfb5070a1ae660f0f7cc3514b3615ed90b8fb7aa1de3a54cd228e56f3368d314af3e9069b01f5a27acf773c5f8e9f72d8749cee8fc12c61ecd2c51ca366972fa6addf82a168cd88e3a69f83ec4b1415ad5437f13af0e4d0f0829435c1450060932e7358c232386037b6792a91f2a1f9ca752bb4c1502e0f0d3a9b57a3dd72d2c09ac55cb44b595b6c51ce2e0facb57aa8f10e4efce2eec9d5b8da6950e9c774e4f534425495574a3248f6062f0ca27ad72813819ef4cc31a812546301da9d0632bd56373cb8d6db06ddce90d5beadc89461eafde98dab44a4567f8f1372ac632c0a063e4f090a75f2621775de79682c36c3f603bc115d7928488e385df782e1c87bc000b04343cc7abc1e4ba1022db412b066f1dffa46cef9dc03581cfbfaaab5085e911dee2ce6f632d39014562e189d78636bd"}) r2 = syz_open_pts(r0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x20020000002, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x404201) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r2, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:39 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe00) [ 1989.694062] binder: BINDER_SET_CONTEXT_MGR already set [ 1989.753576] binder: 30196:30197 ioctl 40046207 0 returned -16 [ 1989.789976] binder: 30180 RLIMIT_NICE not set 19:20:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x100000000000000}}) [ 1989.796364] binder: 30196:30204 got reply transaction with bad transaction stack, transaction 5225 has target 30177:0 19:20:39 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x2000000000000000) [ 1989.850757] binder: 30196:30204 transaction failed 29201/-71, size 0-0 line 2816 19:20:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000700)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) r5 = getgid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000980)={0x0, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000940)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) stat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = getegid() ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000cc0)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000d00)={{{@in6=@mcast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast1}}, &(0x7f0000000e00)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000e40)={0x0, 0x0, 0x0}, &(0x7f0000000e80)=0xc) r12 = getpgrp(0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000ec0)={{{@in6=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @empty}}}, &(0x7f0000000fc0)=0xe8) getresgid(&(0x7f0000001000), &(0x7f0000001040)=0x0, &(0x7f0000001080)) r15 = gettid() getresuid(&(0x7f00000010c0)=0x0, &(0x7f0000001100), &(0x7f0000001140)) r17 = getegid() r18 = getpid() getresuid(&(0x7f0000001440), &(0x7f0000001480), &(0x7f00000014c0)=0x0) r20 = getegid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001500)=0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001540)={{{@in=@empty, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@loopback}}, &(0x7f0000001640)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000001680)={0x0, 0x0, 0x0}, &(0x7f00000016c0)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001700)={0x0}, &(0x7f0000001740)=0xc) getresuid(&(0x7f0000001780), &(0x7f00000017c0)=0x0, &(0x7f0000001800)) r26 = getgid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000003fc0)={0x0}, &(0x7f0000004000)=0xc) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000004040)={0x0, 0x0}, &(0x7f0000004080)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000040c0)={0x0, 0x0, 0x0}, &(0x7f0000004100)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004440)={0x0}, &(0x7f0000004480)=0xc) getresuid(&(0x7f00000044c0)=0x0, &(0x7f0000004500), &(0x7f0000004540)) lstat(&(0x7f0000004580)='./file0\x00', &(0x7f00000045c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000004640)={0x0}, &(0x7f0000004680)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000046c0)={{{@in6, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f00000047c0)=0xe8) fstat(r1, &(0x7f0000004800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000048c0)={0x0, 0xffffffffffffffff, 0x0, 0x3, &(0x7f0000004880)='&%\x00'}, 0x30) stat(&(0x7f0000004900)='./file0\x00', &(0x7f0000004940)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000049c0)='./file0\x00', &(0x7f0000004a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r2, &(0x7f0000004b80)=[{&(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000680)=[{&(0x7f0000000200)="9c86d62939cdcfaad3cc5731dd0bb5e85551f76b105571e89c8fdc55078b6e9f7e72bdb59945e8a4b6fe7b83fda3fd83628a70b14bb348a86a481cfafaeca0d8491de9ea9436661514e9cdd866be35f59ac2dd66aeb1c4dd822c81ec", 0x5c}, {&(0x7f0000000380)="db5920d4b1b6bdda8918703c563c1fc6709249ba4a8de580a7e866d77df67bfcb2c48fd3079a4fb5e98f270ef8a37484291ac33046e92ffe12a0a583e8061fc882298bbbd85c3af7e58c85b3d06451d2ff541e15f94266d6e01369f36636af9725a9dd0ff4791c5eadb674a64781613457fe1290c27068ad7769673fd1705f65d418675918c35a0bd5", 0x89}, {&(0x7f0000000280)="ad5ed4bdfac7bfb75e4a8de10347753ee82c179e71bd1af62618f5cb93c8b78822972baf0be9a0f5e75261ff1ee3570d5f1bb2d91292c9d2f1a01403e0d4c3b29a0c888ec7c34fe06124d2ab4f0139509f4eecfd5428d0376b85a8033d1da0d0ab9c679afc2e9e419465cbbc6894", 0x6e}, {&(0x7f0000000100)="4219f12327a605177f13d849ce8f5e", 0xf}, {&(0x7f0000000500)="598f9f88a52054a59c2fb0d9eb83ead1013e37348f9afd41312c3a1c53a9b7b4dcf7f85f769747292683144a6fb7d763221e7921484c9bc9f53d9dd8e3a593ff6d3205b0beacd81c8b5bfdfdd19eed4b892d44c16abd54f87a00a7ec8c00dec13ad4626020bbcf4d0ea41df87eaec291ae05a289c62ad062205a396e28b0cc2f3571f45448d332bd1d4df380c3dd94ac17c1d32d50e3a81b5232b67a2a3ae3e2014020bb0362f409568870d45fdf6a82918f689e2303b2db2e021b", 0xbb}, {&(0x7f00000005c0)="932177223f74992a074ba0549bf53b281314736f9c97862e047188e786c08e206a94874070a5a66898e19550435158936f83c3378305c87a6134758f34ecf43f1af80247741f12166df1fc74d8aae56637375bd8015c3d3e653c4a522d2c5ce827e75563c8a7e5da4e45e99c7456174d95588d2614e2490bcdae3e3a6de222d6750d59bde15687f7fd5fa7776a1ec5c5c51cdbc653", 0x95}], 0x6, &(0x7f0000000800)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}], 0x20, 0x40}, {&(0x7f0000000840)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000900)=[{&(0x7f00000008c0)}], 0x1, &(0x7f0000000a80)=[@cred={0x20, 0x1, 0x2, r6, r7, r8}], 0x20}, {&(0x7f0000000ac0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000c80)=[{&(0x7f0000000b40)="936c605298695b9491f4f9f5908a998c5d851220077909a39afdd00f3a2f54f6d0bce574cf5cc5a8ba370906445b67ccbf5e63755e08cb74f0bf1f8fadd778ed1bdc605258e7424c0ff1f40a95104710b22a70d1d0388a45f1eec5fe1e28e1be", 0x60}, {&(0x7f0000000bc0)="8c4c8c7dcbabd5243b7d3400126b835283", 0x11}, {&(0x7f0000000c00)="01b3b43055bcc55576aed68a16d3fdcff165f067308064e66e070ad5a97507c8ca8e801fab7a4ff8fab61b05e2567eb8bc3edebff2f35006990a39d401da7eb927203857d2", 0x45}], 0x3, &(0x7f0000001180)=[@cred={0x20, 0x1, 0x2, r9, r10, r11}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r1, r0, r0, r1]}, @rights={0x20, 0x1, 0x1, [r1, r1, r0, r0]}, @rights={0x18, 0x1, 0x1, [r1]}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @rights={0x28, 0x1, 0x1, [r1, r0, r0, r1, r1, r0]}], 0xf0, 0x48000}, {&(0x7f0000001280)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000001400)=[{&(0x7f0000001300)="0662359ab6af0fc2d39af8120c1a9e363f5c64ac23db69aa4d19a2c65995d871377867d8c18dd0d7e34b1a4bbff20e0c5ef2aea49f76fddcf8074a811fec2f02c6dbf7acd78d3760f265580f82dba1e3263422bb9a36e0e850", 0x59}, {&(0x7f0000001380)="309607bd79c57ee64fa7e69a5d236b762d0a1257d6df03468b71091dcb20c776315fa8270609041a917131c6b8663e51d9fbb103f22fd40cef3b4249502b25e521bbac259a9722b4a073f9f506002bc4fef79ee8252db86e4fea177d006b4ebb485ec0daf57388679a11767be8bd4c33bad865159ff1", 0x76}], 0x2, &(0x7f0000001840)=[@rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @rights={0x18, 0x1, 0x1, [r1]}, @cred={0x20, 0x1, 0x2, r18, r19, r20}, @rights={0x20, 0x1, 0x1, [r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r21, r22, r23}, @cred={0x20, 0x1, 0x2, r24, r25, r26}, @rights={0x30, 0x1, 0x1, [r0, r1, r0, r1, r0, r1, r0]}], 0xe8, 0x80}, {&(0x7f0000001940)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003f00)=[{&(0x7f00000019c0)="8d4e86760762b156bbada1643ad42aadbb314abceece81433bc556bc2574f768451f7003be0660672dfa7914f27496cf3ffcee2946b28353128b274ccc9abcbc0a963a90c2e422241289457b1d5205a49f49dce57c6c05808f6d22de260f4b1200e0c1242e8a62a2806e5691cd0d7ee89eab48ef18bc2a9722f61637156e5df4d70016d8cd34e1aebc72099d449e8cc6dd7eea0b0c560fefa54132a6d60c53c864c22dbbdb23c9fbb914dd8476bbd5aa5fd4105cf44211df72505522998c315a7b5ea255c4bcf705e4264b6cdac073b3dbd63f730e896ca21fdeb1637bfaa7ab113cacf8", 0xe4}, {&(0x7f0000001ac0)="7139ce4ea0b89ca4bf0b64eb336a17b3916a5ec926f311389ef7bebee580fd5fb0cf9e58c2e26a91bdff2c84c5d36c0fd5312457ee7ddd9a834294a3813556a642d10c9d3a083fbfb75a532ccef56dabffde2ad6721b3df6b6bc6efeb4053e5e5be049eb1ab124aa3f98ab7960c4e59fbc5af371969e8ec8353ba70756aafa535428750880029185791d1338970431d0ee14898b22b29583af4747d34ff81cd6bc0954bccf9e54c036f088030807a140d1eaffbb59c86a83ad828aa385a32f", 0xbf}, {&(0x7f0000001b80)="9f3738a601d051c002ab53e9939118e6d192ddefc5761e0820af05d07daaabf0e9cb3edfe6bfec33e1744147452ec393f6a76a554e7447dec3bf4618f2f0c253fb27c5e23de3a4fa59282a45cb92b01dc8b74ee95c696d6fa62fc45a64b896277255f544c550af08056ee8fa1d624e5c4f69000a4cbe6971d501c40b752d23c5cbeb66b1f5872c50c82d34485a95f8f17abad670ac414cc35d532c377d2d97b00852233df3c0021b9b8dc679ff5eedf0cf925d996209388d1e2281c3753b5a69fc57ac6ac83b84678564f5242c3e8f197f322df5f9facb998d16f79e6499fde88d9e7e964864c3ab357119017c6fe94731a089695b11cacd2a18c6ed2ac6525a2f7bd9abcd0f23f75f6f20f2a8af991d847d5e47f214d0328126d9dd4b3611873c6260ea6ead15c9510fc7c2fb15cca20721e1ac3cda96ec49b9417529f3eb359d93eb08e11551c5c8cfcc9c27e1960485a1fed1350647672815034d0ec74bc5fb4c2d0abe07c9417f0324076b432be77c94ee817620cc0eab5a32a4f1224674a8bc44c07eff9a40b148104d77174c01762f676058a09969fcc0167508cccfc63f1a7272146c4db0ae90bd44ea0e97f5792e45347592b7c1d9800dc4d8af2e8b499274c72b20086412e4f5eed24a6d7fc1ebd489054c7e190a07994ccb6f0f9bb7b93b6db4b0551ec55c0b6549637828be00babc8dfe2032aaea765860d75033334c52ad149aa975468bdcab8ce72145cbc6196774034acbffb6191b45fcd80f250580efcd6b31e36b182a0bae394a9b135f15f56e1df45d9ca008e398b71e205fd6bf356d73ca1ef052c1e3b5fadeeaf0f75c568c8f98db694e72fca6d743353bbe4700a287c649137bfe97de27ad1d58d83cf381dd0fe9f185d3a2b1173414b2bb73d5406253ad82eca277d2b5b63c1b12129335c5de5efff760033e3a6b47283c11a544fd9af3922606e207b8e9977d8e04cfdc82dbf4e073ea22fc81360a4a6e730b85249bbd30c17a2a26270c7ef54a9dc0869492dd66d7ef6b1bf610396a279cc911329c46463f50f4e2c3608a558d2ae7ae0174b272f2938992e114807ae23dae7c8f19bbbf716375b74dc81fc591e6b4b74c28c797c84e52e7e7511d9d7731e2a3f96ad030f5da4659d416574153fa79ea9805bff962b68ea5ac21d83a92f55e5931c92aceb6a2845381ff50c1e8401a463740f536b640eba908540e65caa32a65b087f84b89401bab40f4c8b29906391473b94770ed5949cdf0aeea7fb8c3aaa096a661f9b847ceb77eb93c359368b0afd64e9d67c462cb6bbdea54d0071bf4a8878ba72dcc9488e4d43ff1e9260d47ab8b65c308967414a9527ee4e4ab98c3d6a5c45bf7057a56652769b29e39efea2b5133461862656c4d6d9cb43a390b1bc020d443267724678268f78668d288f569aa9b99065cb458c0b189a0a5c8003e53fbb2234330367e972ad68dafbf17b2403351f23bcc363c24e5d912b2395811d5bfb13bac8db7219d546612097101362e211274d7c941a5b56970cd117cc0af2a3fb7cb1b05c700f21dd4e0d8f44e835d7a647414440e025ca3b4329d139555b4efad87801362cdd2ca4d1fd47e31172db07b86ae64a48517844f19ce3389d3a5465625609af80783178cc24995ad32c895f34302019ce086d69e1813f5c9d5237af53ef029a717c54aa7db4b2c5da7844163f4f59fc83a5f28097aaf3026b0ce71d5793f062d533c566fd6bd209e19a0e68fb5e1cba82b6d9a3b1c6e120e2f4c7fffb532bada372104a9b7c74dcc40e19e7ed43b867a63a2eeb020c27977cdf3049e2ec00d3ebb11aa49062ea998dcc02eef93962e523300ce3421fc23cb9cd7dbf181b4b6f75c633063cf5c50fadea5679d17129cf9d317ad8dd13aa63b1268cb6758b327be236815f3c55a3b646fb09ff22abdaf8f5ae1069d4ec315a2cb12773623e678bac65024c37ac383c84da2ddb7454fce6549b423e8ea970561d5119780ab7b89abfd592edc916dc8ac746cab06508816299db4a5f0c6543ef3076492bfc2f9a485ef6285266000530f0f0d646f2bf53014511f19580da5ee56c3570b3aae7d35ba747a53f1bc14b56a3b2388b945669850fa43eb40ef8f81ca3eb04648886e299a5fa926d671b0d6c3be069b1d667a948546f50b587abfe24175c76c46aca1cf0e5f37e1df9947d0c0235859c8a6c43421e80e8f8f2db2c76d6f81848ae7981084b85a6a81d35aeb0df7ed0a2109e4192244c9ffe59e08676bbbff7aaac38e37037b3b0e33f5a4c39ca5bd04646eb567807ed5f1b5998e5b7ab76b62c2355bf42e2784b7944d0edac8e3ff646971ef1cb4dfab2a3675b41c949d0c531863d307ef029e1b36f25c993c90f6230b5775bd2e6067c9fbee0e2d78d7b42476225650171cbb8886c8bba3c25081c806d40708a7e19317b8c37396a8c4ffbbebef3e57fde71c6d392c8cd7068473d392e91321bad2f8ca6dbfef9e8910827aad19e05ea0d312d0ad89853cb492d3a48a4a890a092035483fe96679ace738fbda0d8f21ac4b909de7a3a71d8ac5b72b603b4c6a0a6e88405c8fc96e808f952ed207adf1875e3e7e664d4d50e10d55113a6bb3403cf2539686efe6691b5a76ecc054c3be51444873b7adebd5a74d5a7e4fe64a099aa66aeb2ff56f1c908faa5b32257bf42391291ef8e44326373be65bf55864ad272ff5b9d89070d976a0bff0e51e28e77817100ef993c5aefb3a04aa6b2b00ccda06af2bed719898aba45b5e7bbf7e33e097765a8f5629729d2876a64e33d1e5aaf82359d749de5e6ed5c7b7ebec4dc1cef80656917b463be34aa1b7003bbea3a1b20b0558d132edac171bf37f0e72be1f1400d55bda889c12f5bb88cb353009fc5478029602c878431825936684ee0efa6ba55ca83f3d7689b94ba827cf3ea473cc65e9aa8c92fde0e1d1f1d9de7007de85c179fd714434a9a4174e73389ffdeccb497e6ef5cf188f91549e99a8944da0e619290736c6a92722f593533ae949054650a0ed76902d4b6fb9a02af0b65968d187498476c62f3fe9e97201f6599ddc3121b94caaabb096b9c071428e69e9668199768c337c7dd064aae1f9c9374b2b4217f5ad02fa316afbb5ae6efa6203481615e2219134353e69a8c0cd3027feb2b5882cf41db1a42a088a39dca928000c2fb0b7a6e623a6416d393129db0801a07a223dcc4598dbd8f09eba1bd342aea63fce42f7b56a6e7da33b274af4cba01f86ddfcc36a080174c71931aa22854726b7ddffcb52a68ac9c5e12b686e8c95f08d825d1f1cd6e63a8874369865273c8c90399f163663998253b563dbed002ad9d74f2f39ec0fcd442c1ec468539740d0fe9bf608f33283ab6235dee822b39e6ed52e58136eaf7290601dcfa1e35c959496e3374494931af2039a1adb775ac0c7f012e4d84ee446bed517bb79aee8e0fb1aaf87069afb8cbdebcafadcf5cfa5dbb9171f65739c97d747516b35bd88888f74b6cea398d8a17ec5790495b903fcaab20145d890aec4c4e8c4dbe549244a90dbd481103744e9df1163809140574f2f02e8894716c09947015e1e4f51c28119b1891cd091f49316dc9b09e51b9f1db5556bbcb3904e1613d902b6e7c928ab3795e16d52eddca529eb6d68657c07303f4911b548a9b0145f907ccc18b5305b8df7e414d96657b931dc4075715709c8ef98959270482310b19d4634724dab1f3fdaacab09c28922c300b4eafa985d9395490132f9d16c769bd0f69c62d631ad091431d79850e5382cdc09449fe088cf61f97f8ec3d79273fcc4f574f94c7e3945896a0f551d838eebd6238af419acd4ab45991e7dd5b28a1e128964a271436f8bf4e31f562b1cc4bacddba4a51f068dcfdf15a44433c523113865a4f44b126cce31fb86bb9ec0edadae5bc6d13ee6007cb194212bbbe7daa29f82a60efa2abdd1c97875bcc39490fef2e257e7879ceec430a6361ecac35e8fcb8b0903471fe733ca388c4ee7c58c7fbb99cfe70ec8da61c0c1d58b049107adb4244a118e7c145fef00b79b6b50f28298c2a6a821b6d0d5b034b059724230aacf975b48b405b008bdda8d48dbb7a1b3ecc491293dedcaa61dd6701511c3fde9dc325e0c80df834b7348cd849f5b353b7cfc5e0bef6c223b8c7251f46e361fc1a012a1aac61c14609b9895c4277014c7b128d061f976581095b8a4fc64ebc8ba0a9b8bde8b5a7dd3473ca211af595eed53f07286550fb145ba4df68e059ead24d79c7c8802b49b24b3165a39d84db827ac53411c4f0bda5ce015d4d5a0e57fc2c569d575ba1fe21b2c399bbb2648a5c66d9a5f9cdea00577e9e9dde8595b6cd84f5d18146f0f2b627bfe4acef66c422409cf21c20744c9993410101dfcac8a7544977f180b5959b63641d10cd0ed71181134b58b69ddac16477948ce5b0597f3e0b711f76aa3cf825ecc05424d06580d45d97c76e8d1ba0573798e1d96f2ca7ab6a2ab5b51e9255f888a295df2b6ede8574598db14b01fcd5c28917735b4bbc6b84914133b4af9191fa04cb84b2867fc011684f8b48f0bacf52e09dee83722b20de69a1d0d19b632bd40c1678587aec86ff495243b1fefc6d57935737d26f52ee3f05348b80319c67692e546733eca8a2d1c3c5c10d21695a441da31cc4c497d1c214c8d9a885163c7ef6bf2582fd155e64f5eee218ecb27b54ab6716eb166b750d13dd0df4d2cfa5a093f09051d1539b3f403371bfddf0b781f437d941a7e7a89aec46cd57312fb95bbcbafddea5a38d00a68bdff0cd50a4b576d8df4aa90119bb743b0b526af768fbc350c62ec0489d6389e99945867002895ead005ac9523994edcc496cf04853d00c775e323728614868aba232b4ae6215d152deff964a10ca2562657290f0fcd14c3fcc7273654885ef135ca0c20aa4ecffabefa7cd237935c5e38fd6497c9878276e5958aeb0e779f0fd70bd7bfd3092e56d32b82718bfbce001603bf6b620fa2fed4ceb261722a41fb42b4da3ea638c886547d93006b9ccfc702792532b22e3a0601a1e113fba5ec824504f299e61c6cebd0dd20eadbf1722ee9499e621264575b66cacd9ebaa8c25893e09193e747509745a7b341edd6307c05ebb6219222d2591bcb4d412bcdcbca1478b0d0f2116a906c955dac1fa2a67f22dde2280243e61394d59971feabfb532151bb9e985f6da58f67cec453e7ee4d0da9c0bbe3fe7364e13c47d19ef3ba11e3085f6939954e1dc3226d98b61d939e95137ce18128f36ae51b601275d6c22ebf040440578816e21f025f1b170b9a565cd89a8e7f76531148c45289171010d34709b86a0b4215a00cd76004a1b123fa60c03037485d328b488a186ac9d093a914c6228cc88aa01933888a781abb3e55378daef35d468480d27ce590018120c77b9285d127e03718ee38c49321e13f09905fba245727ded371578be959cf869669093865378c99cad98cc0fb81abfb0b1096fa57097a2d970b83723d6f09128d8dd8024bc6d4fc03256715ca5d4c1a59649cc91497e27c5ce99b66b2936f0195a0b1a80add4cfa5882453c50c2cfe9cc336f7db5f8a19e76aaac7d087848ea25680b88cb330241f0f8fcbbc25a4cb827e7561a5afff461fefbae7da669c086519ea2e9872cd995805e90ab72ae2d1972e3e6b37acf14bd22450b06e9f14faa33eab5409ab714612316f55a762366edd469170d3da80c0a8b833049e619273bdd1e8c0b1658a573607b42efb9776b27ba013dd6315adc4e9de15bbfde0178ad742043ae59422d41437a4f", 0x1000}, {&(0x7f0000002b80)="5ee059c5e02a4e59aa571dae7824d20ac0f01714671f8d2e857db1fef3c917e527cf9d9a", 0x24}, {&(0x7f0000002bc0)="75da8a6e998cee3225c3a73ec0ebd4a090d20081159e83ddd93ed11506b20ab47a00dafda5067b106f4acf605d5636b03004ce4c390a8641a3059debde3f13bb6e34a861224fe3f6f984277cacc50264fd4939e41e5dee6adea8c4f0111f2d1bee065c5dbc463ee6902616cc9f97270d6c6985cd93585a9d490f3fa82f81caebcb13ed2a56f801a91ea9813bc49f854cd93cb94d8a14d05ad1df9c", 0x9b}, {&(0x7f0000002c80)="7123982a7943605ec6f969dd77d1ddc98047d2f629ceadf1c8ff04adc6d1f19a6e8c3e4c10587bdc54658f399ae7bf057d2dba70be6da04176d6ea9bce0a4dbad12ecf953e8908cdd8652d343127637d4a35916e4a64f40e7dc6842dba51d7459f67eb6011c53c165e92e779d0e464bdb63c2615f4bef7230508ee6419decc6fde32e61452d3fdfa2f855ffa064ca88c843295b219c93669999cf2af535fbf187b8dd70ed73fa4c5f3df10", 0xab}, {&(0x7f0000002d40)="f416a44b4708fe", 0x7}, {&(0x7f0000002d80)="4b65a1f4903812a61d0cde2ae14468919a5e74f13652c8136bf3f0ea0981c5d1109b32aa7f7b6869abbef0e8c56e69f90bee0c4aa4df5ad78ca738c56b70709249c4790775b5aa41547ded78b363f9071c48a2bb0505c36577a526da1b723f1b21214522055f28f824803b34f4257c2b9732c08afe6573db229a66d4cc6ee9274e0392a9ac7ece73804d4178930479a72b672694cfb9bf8e54884330b9557e6243fccb1a099b3e71bbf2429cf9cd943ef597edbf0bd8dee35cf80c5ec18c072bd0d5fe0e33d1223aef101974b3d519b60206819bd939217ac8215f2857cc224b1753", 0xe2}, {&(0x7f0000002e80)="cc2dd2dadddcedcfc7425a3ca45de3c668c7dea6aa1355c0d6336ddcd807e0c8363169b21926d276970edc15712848325023e746addedfabf6e3ec6e749d45063c04d2c8e5f3cae8af8740e180e5010adcd19f19", 0x54}, {&(0x7f0000002f00)="34ff79ef3baef4aa35821f6e93fadbe1268ebf53884248a183227bada652c7265cd2c1e872faf167ac1625f08065ab8237d7b87d02b1475ceea4f64f0690e9c101887dd7c8e142ff332de63dc6edae53fe2266ebd06dac14e4701d53bf5a89fbc51d184901fc47c34cab6531b2edb2bc7319b4455badda43ebe765bfb88ee96c6aa7be5d3ef944b491fd734c709b441cb73c685c90600e98f5f3d79f68a981d8e253178f8deca150a627f3f2a997b69eb15f9afbb144881566b74a78086c4b2651c4d6bf21c0d217349ead6645910a241bfced9100c451d8c42cf3e7a6d82f1a906ebb13e503d64126fec0021a2dc231b3a9f01271cd6ea492aec988045e970d941e1921ddd3303961c9f54d2df1ea9afed8c46ccf4bd990b22a99c3bada03da6314710bb82a36d9d996c998b9857ca86bc4635b46e6ec27b9752a90e3704fb504fda8c919355bc6d7570da20df679af306b8188c5d52be7df8d0573e5ffb319c36eb5b0af4a7422c98eb272d1add33c5ebe243491a3b84cc90f11dcd6d9c7ce2eb335d566a1cfdfa313df893ff4c2de91e7d2568ffe83421904d895e7d66f118ba063b7602309bb16c36658edaa2114dc5bfb42f7b481710966b5487becc86ff430c2ddf77d5e91b1a528066b4a0845f4e502cc560e80def01281095f52f0ccb02328bd66fed285a9e766e2f8bf4de3f0a925bd19669faf7a487988237a561afed5f50866550dc270c081a365e14b67d5d67955c63ab6f6a128a79bf74046aa703146a145d62ca1c6e3934cdde0ad797171f1867ce172692afd7e10469864289f4eb0d1cfe32bf364bd47f276d73b37648c3e8a49fe3665a3a9f6277ed0b5aeafa95bbc37b97f6169fefb996dc1e0d9a883c23ef2f8ebf845443b58c498d42f0e1fa6962f820b6462eeff9141815cffa5e6303786adfdbd849a62e51a29b5c4660fbf9b37d1feb77000429e8395296e34f28c34240d38ed2b341725b276a5e631f4a4fc3e3e77cd1c6f9768352ea83c89a8751d8bd2c149781664e09454b673edb34341c59ac311db645ff2a4a46fa708197fb91d7497c8788187cf8b79972f370738b2a9bbb645d76e3b221fda18077998d1a64cee6a737abb38890fb1079c2bab969a169852eb954f8fed2d026461a75dc2466597aff1cdbaca39240cfb3de72c85d68952239968ea00983d08c918d19061229f3e87bea12d464c510ee4d0567dad1b5d7a38982f99f72319696bb38674162b08114a318b03c2b673709b43ee198e7b6829d1c58f0eddf5dd40413ff4727bed7d1ba9c4d98c7fe302913660fd4db0496ce174d415923c70dc93d9e630e797847063b8de447673289d36afeddde9a23b7e992f017cdda6e8d285b304a4562936a0f68a40dc2d4b6d41fdfcd6efbf7ddbbe5bb1645c58a0a3d45633475ac00ad24049dddd16b3fa46c814b5fa486cd0e0dd272fae8cded97479ac8e748b324930662a2cc0ac8db6b60fe84a0d383c76c924aa801b19a2c1a4d417f6fc822e78eda9977743fe1759ef3f1dce1584d01b2844381c58d8349cc2f972f0ebe60cea9e3c29029ee1e27223139422c7edc698c877ac01f87e23d0ab2d9c75b9a6d0d373551470d9c1d734ef645f14dce5cd155b0234b310141e4f9f9621ea0db5dfa00b5dda92fbc20d1e238e4269e08ea5434bd0a90e0e82217ff5ba3ec99bec3bd8fa48a347187e0bb9bb419141888f8ba4cf3eefc422dd400fe1e97e105770a02795336a927446b8366a81a6b5c2244bec58b9ab5bed2edcbf8def9dfda1bd20f70489bc1935febf3ebacc8a1a9956195b42a43e014edd59527ddbf283e9edd5a1f5ed15145be2a3048cea1f93c069302e886edef8492f43f5ece4b724d4b5ad5a019be5f4f9327d8255f88a8be3afc66f3e886ca852a75d09fd93aec5d72f0489399ddc0095da5f04283b91a127f31fbf935af36ed90c1c0592fe2c9b9c60bf6de4b6e1207bb4b6ace05d3539a0653c6bea0ca700062950c461f1c8c1bc3aa7137bf2b12581cbde5874ac915ed2393ab62a5d8074fbe5c2a65c2c585a3b70efc7e38a5867b03bc86ed0049f0e20199a563674803c76b1752fd224ac44c8fda5b7ade1892150269ff6835284c1fe71ff1b8fbe052f228323ad14abc2e6aa34a0386974636f357aaec0c21f26fefaef6d6964e5fe912ec73b2f1a4ea6704b80ee9ecba55d1d45c55182f0b38adf60d28f101f8e1d169039888cd7119d2337169266cf7ef91fd5777bb136e9e18e14933389185d4d4a5152d22157ac2cd2e5a3ba98af876649bf05a2a3d11248a90e4300e46660cd8a8d74b4d37dd5ca062d593d4f26be87b41a66c3d3147a4839d3d8d688928f37fd391e755b80f85332bccfde2a158183eafe1d8240047fc0de468c55d058b30f0afeb567a152e69c7d44df24d9f353601f55dd58e6b9f04e20480209b73f908c50e5d40c749c6d7959b5f1ed0eab4ae45afd4de664933238882a951200b9e1949a366f763f8da43d9176de110a796a5000f22fa1473c5614a3744f78eb09128371f256faa37b01e9c1eb35c767b2072d160f3981f670ab902effd625beddbb6a80fa86d5336b6ec4e25000fa24448a21925d486ff20d7ec760488303eb207adae74eb13709a0d4e6824b348a3712d576824910908deee1c7c528fffffc3dee89b4271957207fc4953196e3e5f5d27b75286c307840bd9d688a6f5d88c5be05b7d0e45e5bafb8cb9f1cee8132d72477833130b7a1cb540b8337e1823e1cb28129d6925b2680d3b245980e4b158e6d34b4a5e45dba90dde488c471649fb833e6c2392b72e2eae4e68ceb80086fed6e20b108059c80ecd1d2a61abff25cd71b534beb844e1248565cf4f5c2d1a98ef36a07156514c8eaeb1f030fcbb0953c68f9de4ce6b5d6fe7394b14f1464175b75627a34acbac5cba81a1009db858cfddb3344a3c88468541b1df0582ba58ed29f66dcbaa6997c5886f02fc2544f1c89e349b9431581f6839dd0647194e8bc6d6083ea0f61fc71f928c7d3e172b99eee1d1166a44a843faadc94521246179dcaa19a0cce7a799c47d409a3f60426f40584ef920561f4bc50525bc1a0a001c35744b7248c475f0f92989959b4b0210a4b3471c2d48302d8f87880dd69db9b1beea418cbe9db34fff8921c5c53dc0e307cef3bbe411999303865a7eab51daeb4c576ba9bdca0ef46f6652d1f60c35691017da61eea267af701e5250463e99d1c71589e3e4908068e16c7173a3b8118a20142037505cbcdb61ad1889c48efef89888fc81834293e9b90eec2b4fa511d1c56ec02b36008b92e61382174c5fbc8943848c08e41f1aee9fc8654a51aee3ea647b4330012291dd809fdc382a6a1655995f4344aab73b7c932dab274d9c00cd3c580e3f5dc665ca0ecfb1189be173a2150f64a2776decc7bb0566cc252e96bd57b850c1b06544fad07b698ecf3f6fe4a388fa581f04ed1e6cace19bb0923a4ede4d21e9e723d7e68b0677f1ca5e83b591d20abf40be51390c6da3f450668da9858dd2dcdf30333557ebc284df237c10302f764632a7192d9eed5cd315912a67372ca2d8b7f3bfc9efec2054a0ee1f62eb57900d74ea1c7464b0d695de6e528b9cef38274d0a52f8661c90daf488696a71036f6a85a63855d93fe5a4c0dac8ea7bd6f510244a70b2980767aad3402c10b8b779d0ab8fd89a6ff34df3c34b757a0af8b93ab128f03f640587b4968ec98cd99b2bc496527f108c42900d34e5736a2c28fd280306049b53cc68c01883ed8684927fa17a2972b2748070b1b6444a338fd833beef0fa472096cd46c5eef7773e75e162c6c19fd1a833f8e55a404213882e8248e896714555849a338a50f1df114d67bc2d006eaf7890783a618f5f8729762f874f3f9025be6c5a2d528b1d06a539f3e9fb476d9f7b2988601e52182cc687f28a6ac51f2ee22c4a966dd25bd6fdb729efbad2de4b8f37981bb9fa30ec4163263cd55a5179c0becbead2388201175de7bf6c5005a427197d25618b57b713964bf437c2f394bdc33be90f6abc60531e770a2ea233ed028eae96da708a94c3893195873032f48a8b25384326d1d4c9f84ec9ddb4181e1abe5793b6ca818e990f9d28c21433dd0cd94cc648c23ee1bf318aa807a96ffcdaa4fe7a8753a65b2e544cda5a205bc58d606a7cd0162dd8db81be117ce09ee443a7ea7361b42d9dbff2a9e275f0df78dba6f67b8cfca69ca87c62ccf45b4e3a782f360e0c4b5dc5a591315d99935c0e9c73a201f878c980d720c056fd2e0b0bd514d91c7f3bf7f3812b460fef50971aa731c1745315516365552d737ab99706f9b145069f917749bbcfd5c861f85147fcf6b7b4c1a235890a620e1a47ba6ee13f9afe11f03b131a59f48ab4b36f845a22e441cb17984d5ab90afbaf1fa954cd8293906d4222102fd21e4c0289699fd2ecc493f8a4bc67b9493c8a09e429f8794097f5821e284e8ba2bd7ac29a82e39f80e3cb07db3c61289ecf054582259a90710b3399d4f550e69e2e838decaeb5987d511fabaf8a14b2e6a5f1569358a901c5c140a6b0886ecd87671469230ce395249b2234dc4d4cfa3772aff2489ce2e73c04a6cac9e333485e384fe2fd55a503773fbc38974b23c50fcd8c49ff30bf8457a47fbe663d1b017d5b5bae46f8752ba1a35a9e0b76b33569638d0dd18f22404ea0171cb59628d991e79e160aecfeec8a93e4d05691718896228c03c9d0a7cad87430184320295fff39ea5e59d7df2c4e99c8509c0e42b9544ddd86fc200fff83aa45601e30c413e2ac9565743ed837f9cd29fe3f9ef90ee6fc0d06d568b52e0984e04df3d4a9a91c70785f6335a3b8370c82c8bba12965e9897ce6139f260bb8fe082d9233f374bee9c43d0875b95853acf443039055a4051638b12f209cb7272be7fa1c3a1ed83c183b7987c54c348ceaf983cd815d37c5d530f21e3c2afe547c2ed8fe5ddce609d59a71077b7aefc089caef8c07c4f27ae9e0578b6d5180a776ba438c3ea651195ba8e7695af64ce5c12050d49315f7823b6dd88ee5ddb8d38c17bc5338147228124602feb007fee6441ba4185b33d156f3b493725827761cc1a2f11bb356171ac77f269626df443d7a7629900da10080bf90e78c65e2b54028b6478c9302c4e49a5ccdd7933bb731451f98756f942a690f1f0f1e0c45d1e93ed3c990b6e7b4debcc56ffe27afb124c038a1ef295db30b2b8bc01ad217e353361d7303cebb835a743e2f5697fa49f0fac920c5df8dad7fba98e4e65c433cece419376514bf28c25119c21bcff2887cbb248bb684f36714c6211fa37f3f8dcc826d18ab1b0d00f44098ca7401dbabe120830a1560857bb60f1a1c97a20bebfaf4239fe4dcee6321fd76cd054106ced1c62269cda1f18cf70bb13b3f125bbc0d2568d0d842619d5e97a591e5727a0154f5c0f30a9f334ce4d7058e9fe09744038d0ee4874ca49209a6d6b2e8175c9fb5d8fa3a3c3f7965e4a6107f5755aa36e8bc38dc67ac0e1e5cdc6ed7e0019184589bc6c2be3fc96b2772a82e5dfad389574961d42f9d49251107262afc1df8cf65cd0f2a5b013f7dd76abf8e3fa6f1872655d87cc218895cedf689e598f9fe667d1b86ba8146880fd138fb3a4f66977ef3355ae7518af3705a141f0d23bf943c0a15e359d55f22a624d058ee2ad0fdfc0c5c08185f602d10d78d2585544638779a4e4a28b9d581f6897127ac6a9b0d94a9ea4d163d08d444647a4c239251fb5f98ef37272f3a81f3795aaea6eea1f92dfab8c03fa3eb79", 0x1000}], 0xa, &(0x7f0000004140)=[@cred={0x20, 0x1, 0x2, r27, r28, r29}], 0x20, 0x4000050}, {&(0x7f0000004180)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000004400)=[{&(0x7f0000004200)="1f3a9804156f1c8678e29193c08d8e7ad94da290f8080d0d707ca4915ac9b4fdbcbdba641170581afbd2b2f17e6d75a6de65f8bace72ed7a30626fa019c69a98832394159108bf2bdeb1185945579156b41eea2f029c7f69896319091c7ede164a7b", 0x62}, {&(0x7f0000004280)="3462124d840a6daa2e05d2ce8b1dc9c313cecf57e5b45c8079243d1a68917d7bdedf7310bd130063e93f5716da8221bc45fdf841bc14393b624e40576c298cadb8c14ef77559db6ac8a07d4464e5fd8e720a13f6cbb654fefd5f337fd58ee744b1279d3bee624345921cca75e12a75e91e4377c397538ef3c65128b8401a126a142054515f366f680b59ffc5a9bb", 0x8e}, {&(0x7f0000004340)="8de2", 0x2}, {&(0x7f0000004380)="3c4b3c9be1b01505ca4cf16d6178daaf601bf2b803a3260969ca37d9e927696f889e72c9cd8c3409afb560d8e650d2190229005a996f37bf0e59d26362b92e1e97c984fc158675a9fb47dd5775c6d5f47947f07883b0dfc24aee8b42fc6a5817fd", 0x61}], 0x4, &(0x7f0000004a80)=[@rights={0x38, 0x1, 0x1, [r0, r0, r1, r0, r0, r0, r1, r0, r1, r1]}, @cred={0x20, 0x1, 0x2, r30, r31, r32}, @rights={0x20, 0x1, 0x1, [r1, r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r33, r34, r35}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r36, r37, r38}], 0xe8, 0x800}], 0x6, 0x44) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r39, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1989.896274] binder: release 30177:30180 transaction 5225 in, still active [ 1989.914116] binder: 30196:30204 ioctl c0306201 20000600 returned -14 [ 1989.923408] binder: send failed reply for transaction 5225 to 30196:30204 [ 1989.986597] binder: 30219 RLIMIT_NICE not set [ 1990.024763] binder_release_work: 7 callbacks suppressed [ 1990.024769] binder: undelivered TRANSACTION_COMPLETE 19:20:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:39 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1100) 19:20:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000053000000000099a6a5228b767cd5a09714ba24abca5ad31cb0b75e962a1ccbf98c92b3c327"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) r3 = syz_open_dev$midi(&(0x7f0000000200)='/dev/midi#\x00', 0x4, 0x3) ioctl$KDSKBLED(r3, 0x4b65, 0x7fff) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x200000000000000}}) [ 1990.127156] binder: release 30218:30219 transaction 5228 in, still active [ 1990.137635] binder: send failed reply for transaction 5228 to 30218:30219 [ 1990.148179] binder: undelivered TRANSACTION_COMPLETE 19:20:39 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x300000000000000}}) [ 1990.205255] binder: BINDER_SET_CONTEXT_MGR already set 19:20:39 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x3f00000000000000) 19:20:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1990.248905] binder: 30237:30238 ioctl 40046207 0 returned -16 [ 1990.276944] binder_alloc: 30232: binder_alloc_buf, no vma [ 1990.288021] binder: release 30232:30233 transaction 5230 in, still active [ 1990.295566] binder: send failed reply for transaction 5230 to 30232:30233 [ 1990.313150] binder: 30237:30238 ioctl c0306201 20000600 returned -14 [ 1990.320349] binder: undelivered TRANSACTION_COMPLETE 19:20:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x400000000000000}}) 19:20:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0c63000061e996c0c79eec30591938d17b01a4a6ec00b9b2415246bc8a8d5b259b1bba105e"], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1990.423892] binder: release 30253:30254 transaction 5233 in, still active [ 1990.434756] binder: send failed reply for transaction 5233 to 30253:30254 19:20:40 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1c00) [ 1990.499951] binder: undelivered TRANSACTION_COMPLETE [ 1990.529998] binder: BINDER_SET_CONTEXT_MGR already set 19:20:40 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x4000000000000000) 19:20:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xf00000000000000}}) [ 1990.565547] binder: 30264:30267 ioctl 40046207 0 returned -16 19:20:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000000)=""/101, 0x65}], 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000200)={0x0}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x800, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000280)={r3, 0x80000, r4}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1990.609657] binder: 30264:30267 got reply transaction with bad transaction stack, transaction 5236 has target 30268:0 [ 1990.640664] binder: release 30268:30269 transaction 5235 in, still active [ 1990.658615] binder: send failed reply for transaction 5235 to 30268:30269 [ 1990.701753] binder: 30264:30267 ioctl c0306201 20000600 returned -14 [ 1990.703631] binder: send failed reply for transaction 5236 to 30264:30267 19:20:40 executing program 2: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000580)='/proc/capi/capi20ncci\x00', 0x40000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)={0xe, 0x9, 0x1, 0x5, 0x3, r0, 0x7ff}, 0x2c) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)) r2 = syz_open_dev$usb(&(0x7f00000003c0)='/dev/bus/usb/00#/00#\x00', 0x40, 0x800) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snapshot\x00', 0x40, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000004c0)=[@text16={0x10, &(0x7f0000000440)="6766c7442400650000006766c74424028d3800006766c744240600000000670f0114240f01cf66b9800000c00f326635000800000f300f01c966b9800000c00f326635001000000f302e67660f21ab0fc7af0500baa00066b80300000066ef266166b9800000c00f326635002000000f30", 0x71}], 0x1, 0xa, &(0x7f0000000500), 0x0) r4 = syz_open_pts(r1, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) creat(&(0x7f0000000500)='./file0\x00', 0x4c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getresgid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)=0x0) getresgid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280)=0x0) stat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x3, &(0x7f0000000380)=[r8, r9, r10]) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$KVM_GET_ONE_REG(r4, 0x4010aeab, &(0x7f0000000100)={0x7, 0x3f}) r11 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) write$P9_RREMOVE(r3, &(0x7f0000000540)={0x7, 0x7b, 0x2}, 0x7) r12 = dup3(r4, r1, 0x0) syz_kvm_setup_cpu$x86(r12, r11, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x3f00000000000000}}) [ 1990.753997] binder: undelivered TRANSACTION_COMPLETE [ 1990.763000] binder: 30286:30287 ioctl c00c642d 20000280 returned -22 [ 1990.787447] binder_release_work: 17 callbacks suppressed [ 1990.787454] binder: undelivered TRANSACTION_ERROR: 29189 19:20:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x80002, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r3, 0xc0086420, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:40 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1d09) [ 1990.881191] binder: undelivered TRANSACTION_COMPLETE [ 1990.886557] binder: undelivered TRANSACTION_ERROR: 29201 [ 1990.914888] binder: undelivered TRANSACTION_ERROR: 29189 19:20:40 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xd218000000000000) [ 1990.947484] binder: release 30286:30287 transaction 5239 in, still active 19:20:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x4000000000000000}}) [ 1990.990316] binder: send failed reply for transaction 5239 to 30286:30287 [ 1991.005983] binder: BINDER_SET_CONTEXT_MGR already set 19:20:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3bf6, 0x400001) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f0000000200)={0x10, 0x800, {0x55, 0x4, 0x83, {0x0, 0x1}, {0x5, 0x7fff}, @const={0x0, {0x7, 0x1000, 0x84, 0x32685351}}}, {0x57, 0x51, 0x200, {0x3f, 0x8f3f}, {0x1, 0xc9}, @cond=[{0x4, 0x7fffffff, 0x5, 0x8, 0x10001, 0x3}, {0xb461, 0xe000000000000, 0x20, 0xffffffffffff0001, 0x4, 0x4bf}]}}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\fg\x00\x00'], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) fsetxattr$security_smack_transmute(r2, &(0x7f0000000100)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000280)='TRUE', 0x4, 0x2) [ 1991.062528] binder: undelivered TRANSACTION_COMPLETE [ 1991.062566] binder_alloc: 30302: binder_alloc_buf, no vma [ 1991.067939] binder: undelivered TRANSACTION_ERROR: 29189 [ 1991.079595] binder: 30303:30307 ioctl 40046207 0 returned -16 [ 1991.109514] binder: 30303:30320 got reply transaction with no transaction stack [ 1991.129519] binder: send failed reply for transaction 5241 to 30302:30305 [ 1991.135535] binder: 30321:30322 unknown command 26380 [ 1991.144295] binder: 30321:30322 ioctl c0306201 20000140 returned -22 19:20:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xc3ffffff00000000}}) 19:20:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1991.167295] binder: undelivered TRANSACTION_COMPLETE [ 1991.169674] binder: 30303:30320 ioctl c0306201 20000600 returned -14 [ 1991.190124] binder: undelivered TRANSACTION_ERROR: 29189 19:20:40 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x2000) 19:20:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4, 0x20011, r0, 0x3) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm_plock\x00', 0x20040, 0x0) ioctl$SIOCGIFMTU(r2, 0x8921, &(0x7f0000000280)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000000)=0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000040)=r5) r6 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x101) ioctl$VIDIOC_SUBDEV_G_CROP(r6, 0xc038563b, &(0x7f0000000200)={0x1, 0x0, {0x8001, 0x9, 0x1}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) accept$alg(0xffffffffffffff9c, 0x0, 0x0) dup2(r1, 0xffffffffffffffff) [ 1991.273202] binder: send failed reply for transaction 5245 to 30321:30322 [ 1991.306397] binder: undelivered TRANSACTION_COMPLETE 19:20:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:41 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xe803000000000000) [ 1991.329578] binder: undelivered TRANSACTION_ERROR: 29189 [ 1991.361962] binder: undelivered TRANSACTION_ERROR: 29189 [ 1991.367600] binder: undelivered TRANSACTION_ERROR: 29201 19:20:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xfdfdffff00000000}}) 19:20:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0xa, 0x800, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @local}, &(0x7f0000000100)=0xc) sendmsg$xdp(r1, &(0x7f00000003c0)={&(0x7f0000000180)={0x2c, 0x6, r2, 0x11}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000200)="5e5cedf17cb245036ee4e5403f8e3d3f94f5824185a5d06c7d74982f1118f6a4a7d53e4c17fe81b219d169c6539ee0b5fdcbc555d12995693f35016169a09a9bfe4bd9cd2bd9a0b682678097f0c0354819bbe4e7804821bdc2d75ebe260056f96e0b4bbea350eb393dc024f209473d4afb582b2b1688b68db72b694d9e17a03bb82a91420c46b891c9271b88e540cf63d8c7bbcff79a54c08d28a3a7d3f028d6165c5c06e899ef86159f2334a0b5256a9706ad5a7322ec4cfb8164bc8d6160788a423182a74655443a4fe33239b1190c8ffaa2b68a73329e2bcfd9b2", 0xdc}], 0x1, 0x0, 0x0, 0x48880}, 0x4008010) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) read$FUSE(r3, &(0x7f0000000500), 0x1000) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1991.432594] binder: BINDER_SET_CONTEXT_MGR already set [ 1991.470647] binder: 30350:30351 ioctl 40046207 0 returned -16 [ 1991.495909] binder: 30350:30361 ioctl c0306201 20000600 returned -14 19:20:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xfeffffff00000000}}) 19:20:41 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x3f00) 19:20:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000180)={0x7fff, 0x3, 0xff8000, 0x58e, 0x1, 0x695, 0x41ec, 0x2, 0x10001, 0x100000001, 0x4, 0x10001}) r6 = dup3(r1, r0, 0x0) ioctl$RTC_PIE_OFF(r6, 0x7006) ioctl$KVM_GET_PIT2(r6, 0x8070ae9f, &(0x7f0000000100)) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:41 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xeffdffff00000000) [ 1991.672868] binder: undelivered TRANSACTION_ERROR: 29189 [ 1991.801690] binder: 30374:30378 got reply transaction with bad transaction stack, transaction 5249 has target 30374:0 19:20:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0xffffffff00000000}}) [ 1991.842583] binder: 30374:30378 ioctl c0306201 20000600 returned -14 [ 1991.850673] binder_alloc: 30374: binder_alloc_buf size -9223372036854775808 failed, no address space [ 1991.912817] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) 19:20:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1991.959428] binder: undelivered TRANSACTION_COMPLETE [ 1991.964713] binder: undelivered TRANSACTION_ERROR: 29201 [ 1991.988962] binder_alloc: 30374: binder_alloc_buf, no vma 19:20:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x2}}) [ 1992.014809] binder_send_failed_reply: 3 callbacks suppressed [ 1992.014816] binder: send failed reply for transaction 5249, target dead 19:20:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x202) r5 = dup3(r1, r0, 0x20000000080004) flistxattr(r1, &(0x7f0000000100)=""/253, 0xfd) setsockopt$bt_BT_RCVMTU(r5, 0x112, 0xd, &(0x7f0000000200)=0xffff, 0x2) syz_kvm_setup_cpu$x86(r5, r4, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x101000, 0x0) setsockopt$inet_dccp_buf(r3, 0x21, 0xc2, &(0x7f0000000200)="056d87bf5864d07d68337d19019437315aebf16ced4b2ea5bb63be4f848edf8e2adb33e0779b74c112242ebf421415e3b3ac47b50590c6ab95f5c375cfd6e8d6112cc6250dee22e6262e8ed25a6f60534aa2f805e1d6aefb400f297a9be1897e4377b293179e8db0c4867f444218ebdf4554eb65fdb7acef545dc4b73f94e6495fb908efeb05869f0c7b79117bbfcec1f9188eab44feb44aa2d33ad7934d129042f5ca249905ee6fd0bcd37596de7ae097de631a8a4e36ae4b2926302cf6e61ac5dc670139681b81fb1a06cad518b86e85eb959ead2ad121a014db6a21613bba7713e9ee49", 0xe5) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1992.058573] binder: 30403:30404 got reply transaction with bad transaction stack, transaction 5254 has target 30403:0 19:20:41 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xf401000000000000) [ 1992.128405] binder_transaction: 8 callbacks suppressed [ 1992.128422] binder: 30403:30404 transaction failed 29201/-71, size 0-0 line 2816 19:20:41 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x4000) 19:20:41 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x3}}) [ 1992.179116] binder: BINDER_SET_CONTEXT_MGR already set [ 1992.184945] binder: 30403:30404 ioctl c0306201 20000600 returned -14 [ 1992.231058] binder: 30415:30416 ioctl 40046207 0 returned -16 [ 1992.279812] binder_alloc: 30403: binder_alloc_buf size 4611686018427387904 failed, no address space 19:20:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1992.322556] binder: send failed reply for transaction 5254, target dead [ 1992.332267] binder_set_nice: 11 callbacks suppressed [ 1992.332274] binder: 30416 RLIMIT_NICE not set [ 1992.343804] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) 19:20:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x4}}) 19:20:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl(r3, 0x0, &(0x7f0000000100)="228676553bc57cf3958ab3dee73f3d595e4d9beca0590ab6b079818a0ebce291d0cf7d3afbe6a612102252f383b1cea955656c22fd4c7a52fc211f264d09db1cf53c8226db772a0c5da2e19f980804e7c2c08728d613377a6a8a73492a06c026e89e3630a0ec6a58103c204a8fcbc83185e6b6407a84c40df49c17a084a6a86e610c192ef4d953047e9e1a3669e89246147dbf0c74ed5150230eb0687d69d1c1c00f92fcbda8d2262a7bd265b8c56715ceea3ccfaca29c0ae934734712eaf7098c31c777aa85a6016239e37c98d8941f0e605ae111582ff43295122f18f7918cadfd754bca33decfa64a3d75216900d0d9da46e382ef249fdc404463e79e4e31c13f833f4eac57488fc8ad9bb4178607f13f151b50289dd2a559ec113a88e24f27e54ff99e2553872626e0bc21a8bac8e83b962f013a25f4629479d5f032fa45ec2c6ef82993cfef4a3c51ad5f6f413cc06538acdd85f972ba0896753fead8381c2a63318505495b877ccd5d972ea1326356c4bb828d8ec101954bf39b330ed752fa23c3c5e8efc6edf2cf115e584038ccda6ff646deb025d78160bb99c462da447ccceedb2e5b9cba0e08c46de12121a0cccb88653978b509db2d7601a9d1dd1634866578ca68341368410c06b8e13cbdf18c1e3d0049d8efd86be02744768bd7f98c5b2111808f53b130e9f82bcb8cf8a36a239e8077366a1f80d350442d38bf89af429862f1272daff2a00d2efd5067a554e6184688efd5bfdc0aae772250e356be854a229dade59de3998ae01eeb453c81fb81dd569d6b88d04869bce0e2ee590989c0304357490cd278576ce0e411ffd2c2a2f5d0660f40918ba38c4263c337ba73715a788ffc6ee67db57d433685b717038b8fbbfad50806db1979bf7202e090bfa129a09fe45388cfa469dc643cbf1c2110403aebe70c191c1b397436744e014a6d71ea0ec8b821f9c49dab259acca4a30112a9c5262d5833ca2d0709bfd7fc6b75cf9189f12a26bc41cadb57c3cc7501e93dd75cd02a09c5b3ae264249d62080f89004c776090fd4c9ba8a8a08970501487361a39d031aad53caed8c9c8aa027cb70a6a2b13c853999b85afb22fb595ce5346cda5ca0f6048b04388a822e1cfe6bbf48ea28b93c75e3429630b13d37d0dd7917cf42f8cdfb911b6ccbe8ba874c2f60acfce7a8fef2b26a8cb9bc353c8c78e5d01f978e6fba17a69da224953f216efa3e602fbddb45a3299433a3d8520b9c0f2c1ee9e87f210698cc6b1cd5b0b628de17e120b5c52783d442a8ae981091fac61d03345d2878019fafc891aab746b4df30842839ba788c5c76359bacfbdfd067e3a5165e2e61e39cd6c750fdfd29a94a6e3041f38bef626c606b5f84937ff90491931e3d1ec1ef4fa12e51e7903be9d903c44ea03c671ef4e6f31db9cd665fa8b6dc49d7c4a8992c94cf07d585e12fa30f1cb2a6c8878e74ec8e58671305614425b07ddeb387e26b95702fa961d1264d6980439dadfcbc6c41f67c0e4d59feb49737c3949963b959ce6e293e9858e25d086b8072e2c5275ca8656f53dd25cca796171c687c4f36dfa24b436b77d5ee690dfece892e7ce914f60547787c5767f7ea14200bc78abcc57a778a615e9d2d39bd12bbcc820a01248312a89dd132937f7b826af1fe2fe464b63101b821d1c23e1e670f06d680e5e284c1c8646d5a3c844540c4bac45e05cec0396c56206d3949f6df13fddce4df27d35b7f670188b96445443947cfa46922df634cf04434a89aa375e7a70cc22bcbb4deed6e08a07b23c5ebd167bc57a1922a5a411f043bd74ab67f956bd0884545512e9bab7886f3d96835490ad993b5967dab6655d389d5f3ce17dba49bf451bdc2593ca4aa4b0ffeaa3aaa4c6361aae3af8acc9c8f45ea037c0e40d269631d44e4d7052f3fe1cb4301a66f9b20359015e844ef0f7ba99673494754a1a1160790dac5479dc75c095a446a9ec58eba81229f79346376e716afe212cd5c81aacd52f52bb5c1313c164509ff0b88c713266ef06ccd30ea0092407b632b68e3b099701e72663e449ab7925db6f67fc1ed268384a8560785dc547ae475fda0ff678899026312bf61bc7c6667dfc8931ee37cac92ef312f1d2a67d04665f9fe6f5379abca8dfb5c823ffbc69dd7d30f200e61db944589a5b4bd80aca7ee248ce048b417c8c6073dfed5a2baefcdddc3ccb3251b0ca12c98d521d16209aa29d5fa3b001601dd30f9d4cd8d6786ec54f9668a44f3ec1441cddf932412c3f8dae6b4815591d6cd449a03eeeea1dfc5e6057a028fb213ebad8b106f84db5fb44c3722afaa7ca340ac0315dceebb23c626072883819c01096ea86feeaa73da88074cc24b26c2181c8781bd759caee7a5a767c03b039cc01f694e1a139a1fb08972ee4eef6fced35fbfab55b6a7285797cca8b71a8f3cbc62dddd133204c4902c4024fcaa021d89cb20d25fecd43e8e0581c42bbb2c02118cc5715c8ff5397923ac4a9e1f0700be3a8d0361b1a9e353b057f82d53b72fddcc451d2e447d1a2daddea99005f1e69c5da9f6fff041c6ec6ca8e8eae6177451341c27aa381e999a03cabaa8abdaf8778c092d218f8616a642f1f879635edf794dce742e7c6730dd6d9461bc9156f8d1d9824a6e5bb7eafd9560963e551480eb18ec48d5da38a4207430b68dc047e1e0af9625120448ed10a9be26cad74527280995808cead0bcd2ff6bc1fb7a4144f53eae19f37eec54ad85d56bad6d2fd64de5b817c7a77919bd277810cade80e773c64fa82fe6579bc61f259224df045713c36e3b54ec2af06fab396dbebeaa690203ffa53a1d8d482e2ff1cedf7dcca196bd2f96ba759cb6515b61026ff80e222ec74ef7ad72d4fe3984ac745dc48ef86c8b6a7704f4f124477e183aa8c7c4d6a1430b8ab7e5d7dad0242c9f96b789758ef3652ed3546a263be90ca750727f19d864f47ee3269e86796397e89d24576de8a9bb26578860cd7ca041614bf30f296d74aa50b329430408b07db46f1e6ceb3d5b7e3607ee075ed8212141dff26ddc46f355eb1e77952872fe38fd6ab2dc54820d476b47e36752973a7eb862caed47055803694d195256a927f8d14c406e2d58360b8eac1890af4c876c89ed03fe05a4927fbb05b54958dea32cf2125a9094d220515f18b4c1b74f13564741ce5ba897c0c6841843a74db796b362f13f5bac7371ab6e93e49067d1367cb31a0540e5bd1e3fec0c5724835cf8c3213e7294cf429715680b47928588ab73fb63cd9361572c36c02eac1c49bc1326d054370480387f211ebcbbaa68061048294a99d41241aec6c41ba793f82cbcae38637d7591a69ed5500dd96018aa25ae3508a52416a775ad1dd8006cb37dd3986fb50322ecf5b292d894304471b2e65a0dba61040948e7517d2649b5f3ca810a0c27f667be11631aff233c11302c3cb8e0a944ab54e08c3a69facefa0e958932f81cc0aa6694d3cd31e6b44a2fc33e88b462a3384007da8079e964028e44ad1eaadf0183ea1e90db54963e5a69cd0f59bab35a3b70436946636460a2d2610e39211f87f584b22d40526ee8007a4c2257afdd338451ea228a9fed80383deda7a12a2149dc8eca763507948570e1abd4098dffbe5a08959140454f63e358a4ae3e97da6824a725c6678bac589d8cf4f580e58effa1068437255b3c4904d898f8de27a7173a6bd07045803ab75ee5548dbf1d30719fa358f49583c2e2d8999c56990cfa969d91a212edb111ca25b332960e413779d9c430003c49be6c0b1495de86f1c443d692fcad1525d29170f0ddd7285a7fa710402305e1fe26c2c28a94c325550501b194fe9cb392f15b9b76afd6eb7eeb2be917db3f23805b2ab952e041f2f8d2cf8e769b85118868f1c2dab066eefd9d4cdecadd747bf9cc2c67cc68050dc36d90aebe7d8bd58e47cbb2390ce0c79bec0dcefbddb5978d6cc03ea9a145f3a3ef4b61dc87f6b037b77e2f85c459308e2d1f4e802049323bbdddde4f84d8c61be88f532d29e7f158fa101a336bfbf57f653610bc67eb4a80cf54a65422a8587225eaac147730a6b940ccb1d60f14acf82de7fcf88a105c51d85e3bbade17affd90c541e13b6e5da0ca556761450f51fcd98df8f5bdd9d31b5e2e13e1c6596663783bfa1144511ff90568d41224de08d08a99551740c27130cc658a9cad8b0f8cd7f438b6def955eed786da6caf42f92dfa2a175909abba8b935d0e184a4846a0820e17dfca6d18b8b09f9b6b393a4ead59d6d8d65eed0338d11de48d5bba7216f4040bef2df7739f35dd5c930920e5b60818e48e4ab8f4d05c42da48c33fd8e35c967463cfaae67d42b6f002e729fa5647288b68b70870999bb90c7433e3040f90b1096d11fb9ec87a1747ab5fdd927a75240096966f4b55b99ce27c41a51c14075bbbc2e9a73eb968cfcef377795735a5a93b963601cf9439790a9e7db13fcd420a76c66fc017f1d7483fe68ee7a5afbcebced7727cb3ac04aeae0c0f83a72c65fe341dbc25648074fbba08d7473ef5631a427f4969ad5b430a416d0a0306afe7c50526878543abe82a4adf296da940fe779891ab737c18d0b02077c3484ff3c497bbb96cf75dcb55b81140af59897d1a5bd248df07b7d624bcb3304abf2c13f02f69d5847412d6c9410ec2648415f1bd04442ef50ef59a61f868f1572e75ebb7baace32bfd4be52bf7b9891faebdc40e46ad4fa2f22a41a7fc09d043da22cc26d59f26eec990d88b5d94bdda22e0a15c6e7be6e18df46bf5e1e4afb06ca1ff0a24e27e216bfd93216cd6ee5c08410821d55698788034aa7aa77970386b1d46800685c38de739861269ffcff8ae406ced918b9610a1fcd4cfb598c3be55038e3e0f18f7bf63d5aebd1ee1190705030c6276ba9b0907a534d41a50dcb02fb963df0f2fb9aff022ed27f4e05081b7fc3497e3be8f36e4d71c0a23e528f6d86a3a063f58d4ff0814476e3811658715452881bd8d79923f13bbfa699ad79915bc02b9156d1799fe00bd3ef9ced80f5290b6ad4647a997f6a4df3b54ddbc4e7411ede6f6bb22274bfdcd213c651733515c7015ce13b68fe589de43390f03d1654f3fd2262577bdbaabdbe04367430b92877ba3ffacfd13f20162f66febf0784c38d5a5675ea8de552c2a495274edd09623a918efb32d37153c59d5fbb49a2e34eb9d9f953825425efe77616aaa609a32c2646f0c6f3dccfd81d43f1fdd32b2fcbdd01df6fe9c92ae6a76ec1661f7a151cf78b23fa5af670bb98f4aa09b22bf24190a671d38a44347c00e03a30dc75607645f0c1aa665bb7e845c6732935e01c0853e3e0daa2d504ed5af65490a73109c872725d416cb51b3b518f51c4420e92e41aa26b5db499ef7bf87b7b471721fd80b201cfb94b680465a43c77f66d9dc1502777cb26ccf2fdba18d0a86330629f8b50f657f876696a464cd7d41b3286082442108d0887faeecb1df97547abe5d5ae3699ba56e057e7591d0979474b20337a678ab0cd4307126c8cba305324f748d3ef6daea9654b6d4ef8e22b143cc1c4681da63c5d2de2b82fb67508e84d348ebf9fae44ce5db186da0a6736a3aee3bbcffe83a0e325d065dd50c32d3dcb754939d193f98dddf2a86195f57d0c611644351da9d94bec71b659edafb218ff72b002d3be0bdb6b12577f13bb57c144633734ee56692de334df40497c566018c0c412d72cfcaa4bacf4c22a565fd0dc8c9132ac6363ecbd52f27617337d7354c25ec3aa420e151e550442b93a2079021a1d93beb2f4bb443a7a3") r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1992.398329] binder: 30435:30436 got reply transaction with bad transaction stack, transaction 5258 has target 30435:0 [ 1992.426101] binder: 30415:30427 transaction failed 29201/-28, size 4611686018427387904-0 line 3035 19:20:42 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xfeffffff00000000) [ 1992.492163] binder: 30435:30436 transaction failed 29201/-71, size 0-0 line 2816 [ 1992.510645] binder: 30435:30436 ioctl c0306201 20000600 returned -14 19:20:42 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x6000) 19:20:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xf}}) 19:20:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1992.612312] binder: send failed reply for transaction 5258, target dead 19:20:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x300}}) [ 1992.706006] binder: 30458:30462 got reply transaction with bad transaction stack, transaction 5261 has target 30458:0 [ 1992.743152] binder: 30458:30462 transaction failed 29201/-71, size 0-0 line 2816 [ 1992.795361] binder: 30458:30462 ioctl c0306201 20000600 returned -14 [ 1992.891543] binder: send failed reply for transaction 5261, target dead 19:20:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xfffffffffffff801, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000200)={0x0, 0x4b, "8db7882ef40568a3c8f6e67849a71e285d49f53a2d932012cd1cb70d57f2b124a314fd0b88db19082582fae09e996b31fdb73fb0a0e288e28cfb631734a0107ca6ef34109b97391c5a6955"}, &(0x7f0000000040)=0x53) setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r2, 0x80000000}, 0x8) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) utimensat(r1, &(0x7f00000000c0)='./file0\x00', &(0x7f00000003c0)={{r5, r6/1000+30000}, {r7, r8/1000+10000}}, 0x0) dup2(r0, r4) 19:20:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$md(0xffffffffffffff9c, &(0x7f0000000180)='/dev/md0\x00', 0xa0001, 0x0) ioctl$BLKROTATIONAL(r4, 0x127e, &(0x7f00000001c0)) ioctl$KDSETKEYCODE(r1, 0x4b4d, &(0x7f0000000140)={0xd28, 0x7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000100)={0x6, 0x72, 0x8001, 0x0, 0xd, 0x3, 0x20c, 0x4, 0x27, 0x7fff, 0x7, 0x2}) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:42 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xff03000000000000) 19:20:42 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x80fe) 19:20:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xf00}}) 19:20:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1992.952327] binder_alloc: binder_alloc_mmap_handler: 30415 20001000-20004000 already mapped failed -16 [ 1992.963239] binder_alloc: 30415: binder_alloc_buf, no vma [ 1992.969455] binder: 30415:30424 transaction failed 29189/-3, size 4611686018427387904-0 line 3035 [ 1992.978779] binder: 30424 RLIMIT_NICE not set 19:20:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x3f00}}) [ 1993.050443] binder: 30483:30485 got reply transaction with bad transaction stack, transaction 5266 has target 30483:0 [ 1993.072982] binder: 30486:30488 transaction failed 29189/-22, size 0-0 line 2896 [ 1993.104242] binder: 30483:30485 transaction failed 29201/-71, size 0-0 line 2816 19:20:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) shmget$private(0x0, 0x2000, 0x400, &(0x7f0000003000/0x2000)=nil) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1993.152686] binder: 30483:30485 ioctl c0306201 20000600 returned -14 19:20:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x4000}}) [ 1993.260321] binder: BINDER_SET_CONTEXT_MGR already set 19:20:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1993.283812] binder: 30503:30504 ioctl 40046207 0 returned -16 [ 1993.290594] binder_thread_release: 5 callbacks suppressed [ 1993.290605] binder: release 30483:30485 transaction 5266 out, still active [ 1993.304082] binder: send failed reply for transaction 5266, target dead 19:20:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) syz_open_pts(r0, 0x0) ioctl(r0, 0x42, &(0x7f0000000140)="c6f5af1a998cdc06dced33e1e8b6ac13d3faf5703ff7a1c25986942c11522f37b0cfe62906384806d6b170c22c009bb3cc06d1a9151787a7056892f189b65cf5bb63bfc667bb588f6589a53b25c4e1ee4aaf90698051d27cbbdfe8127e49605fb9a44cece03a799713bf3d4e5ec2fa4f303f4998070b6a062cc1e547c8a40f8a5287eb787995e0a574fca36203811e527eb12af9629abf6731f72b4e7594f8941b1ff0b01c01c671900f42182794e1155d8db17d273be3b0bc177d") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$VIDIOC_ENUMAUDOUT(r2, 0xc0345642, &(0x7f0000000100)={0x2, "6843819e41bc3456b062b1ccbe96a787ed69c950c2f5dd57be74d5b0bbbd2c17", 0x3, 0x1}) r6 = dup(r0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r6, 0x84, 0x6c, &(0x7f0000000380)=ANY=[@ANYRES32=0x0, @ANYBLOB="25000000f59d7bd75f790bab0c1e4c08ac4bf6035a78ec9fdae40afe64c7c3c501b5581213d688f296e752"], &(0x7f00000002c0)=0x2d) getsockopt$inet_sctp_SCTP_CONTEXT(r6, 0x84, 0x11, &(0x7f0000000300)={r7, 0x4}, &(0x7f0000000340)=0x8) getsockopt$inet6_mtu(r6, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000000240)=0x4) r8 = dup3(r3, r3, 0xffffffffffffffff) syz_kvm_setup_cpu$x86(r8, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:43 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xffff000000000000) [ 1993.336344] binder: 30503:30504 transaction failed 29189/-22, size 0-0 line 2896 19:20:43 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe000) [ 1993.381907] binder: 30507 RLIMIT_NICE not set [ 1993.387014] binder: 30511:30512 got reply transaction with bad transaction stack, transaction 5271 has target 30511:0 19:20:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x1000000}}) 19:20:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x43, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1993.475789] binder: 30511:30512 transaction failed 29201/-71, size 0-0 line 2816 [ 1993.493143] binder: 30511:30512 ioctl c0306201 20000600 returned -14 [ 1993.553114] binder: BINDER_SET_CONTEXT_MGR already set [ 1993.572138] binder: 30522:30528 ioctl 40046207 0 returned -16 19:20:43 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xffffff7f00000000) 19:20:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1993.601135] binder: 30528 RLIMIT_NICE not set [ 1993.611173] binder: release 30511:30512 transaction 5271 out, still active [ 1993.618644] binder: send failed reply for transaction 5271, target dead 19:20:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x2000000}}) [ 1993.656851] binder: send failed reply for transaction 5273 to 30522:30528 [ 1993.678447] binder: 30537:30539 got reply transaction with bad transaction stack, transaction 5275 has target 30537:0 19:20:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x18000, 0x0) write$P9_RUNLINKAT(r6, &(0x7f0000000140)={0x7, 0x4d, 0x1}, 0x7) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:43 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe803) [ 1993.742522] binder: 30537:30539 transaction failed 29201/-71, size 0-0 line 2816 [ 1993.776339] binder: 30537:30539 ioctl c0306201 20000600 returned -14 19:20:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:43 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xffffffff00000000) 19:20:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x3000000}}) [ 1993.897850] binder: release 30537:30539 transaction 5275 out, still active [ 1993.912426] binder: send failed reply for transaction 5275, target dead [ 1993.979416] binder: 30560:30561 got reply transaction with bad transaction stack, transaction 5278 has target 30560:0 [ 1993.994792] binder: 30560:30561 ioctl c0306201 20000600 returned -14 19:20:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x4000000}}) 19:20:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x4000) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1994.096806] binder: release 30560:30561 transaction 5278 out, still active [ 1994.123700] binder: send failed reply for transaction 5278, target dead [ 1994.193481] binder: 30578:30580 got reply transaction with bad transaction stack, transaction 5281 has target 30578:0 [ 1994.241346] binder: 30578:30580 ioctl c0306201 20000600 returned -14 19:20:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0xa, 0x800, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @local}, &(0x7f0000000100)=0xc) sendmsg$xdp(r1, &(0x7f00000003c0)={&(0x7f0000000180)={0x2c, 0x6, r2, 0x11}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000200)="5e5cedf17cb245036ee4e5403f8e3d3f94f5824185a5d06c7d74982f1118f6a4a7d53e4c17fe81b219d169c6539ee0b5fdcbc555d12995693f35016169a09a9bfe4bd9cd2bd9a0b682678097f0c0354819bbe4e7804821bdc2d75ebe260056f96e0b4bbea350eb393dc024f209473d4afb582b2b1688b68db72b694d9e17a03bb82a91420c46b891c9271b88e540cf63d8c7bbcff79a54c08d28a3a7d3f028d6165c5c06e899ef86159f2334a0b5256a9706ad5a7322ec4cfb8164bc8d6160788a423182a74655443a4fe33239b1190c8ffaa2b68a73329e2bcfd9b2", 0xdc}], 0x1, 0x0, 0x0, 0x48880}, 0x4008010) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) read$FUSE(r3, &(0x7f0000000500), 0x1000) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 1994.293849] binder: release 30578:30580 transaction 5281 out, still active [ 1994.302458] binder: send failed reply for transaction 5281, target dead 19:20:44 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xfffffffffffff000) 19:20:44 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf000) 19:20:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xf000000}}) 19:20:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x800, 0x0) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f0000000140)={0xa9, 0x7fffffff, 0x0, 0x2}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r2 = syz_open_pts(r0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDSETMODE(r0, 0x4b3a, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = dup3(r2, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1994.399031] binder: 30591:30593 ioctl c0306201 20000600 returned -14 19:20:44 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00000000c0)={@initdev, 0x0}, &(0x7f0000000100)=0x14) r3 = geteuid() setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000240)={{{@in=@empty, @in6=@remote, 0x4e22, 0x8000, 0x4e23, 0x400, 0xa, 0x80, 0xa0, 0x2f, r2, r3}, {0x2, 0x7, 0x4e1, 0xf5, 0x0, 0x1, 0x1aac6a01, 0x3}, {0x7, 0x400, 0x7, 0x1ff}, 0x7, 0x6e6bc0, 0x0, 0x1, 0x1, 0x3}, {{@in6=@remote, 0x4d6, 0x3e}, 0xa, @in6=@dev={0xfe, 0x80, [], 0xc}, 0x3500, 0x0, 0x3, 0x4, 0x3, 0x81, 0x400}}, 0xe8) 19:20:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x3f000000}}) [ 1994.458078] binder_alloc: 30591: binder_alloc_buf size -9223372036854775808 failed, no address space [ 1994.474836] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) 19:20:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1994.534439] net_ratelimit: 25 callbacks suppressed [ 1994.534447] protocol 88fb is buggy, dev hsr_slave_0 [ 1994.534452] protocol 88fb is buggy, dev hsr_slave_0 [ 1994.534499] protocol 88fb is buggy, dev hsr_slave_1 [ 1994.539478] protocol 88fb is buggy, dev hsr_slave_1 [ 1994.558134] binder: release 30591:30593 transaction 5284 out, still active [ 1994.593438] binder: send failed reply for transaction 5284, target dead 19:20:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x40000000}}) 19:20:44 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf401) [ 1994.665068] binder: 30623:30624 ioctl c0306201 20000600 returned -14 19:20:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0xa, 0x800, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @local}, &(0x7f0000000100)=0xc) sendmsg$xdp(r1, &(0x7f00000003c0)={&(0x7f0000000180)={0x2c, 0x6, r2, 0x11}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000200)="5e5cedf17cb245036ee4e5403f8e3d3f94f5824185a5d06c7d74982f1118f6a4a7d53e4c17fe81b219d169c6539ee0b5fdcbc555d12995693f35016169a09a9bfe4bd9cd2bd9a0b682678097f0c0354819bbe4e7804821bdc2d75ebe260056f96e0b4bbea350eb393dc024f209473d4afb582b2b1688b68db72b694d9e17a03bb82a91420c46b891c9271b88e540cf63d8c7bbcff79a54c08d28a3a7d3f028d6165c5c06e899ef86159f2334a0b5256a9706ad5a7322ec4cfb8164bc8d6160788a423182a74655443a4fe33239b1190c8ffaa2b68a73329e2bcfd9b2", 0xdc}], 0x1, 0x0, 0x0, 0x48880}, 0x4008010) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) read$FUSE(r3, &(0x7f0000000500), 0x1000) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:44 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$VIDIOC_G_AUDOUT(r1, 0x80345631, &(0x7f0000000040)) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r2 = dup2(r0, r0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) 19:20:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r6, &(0x7f0000000100)="338cdd5a8ac0af31b33d6c26cfdca31cc6f9d96b83dec6d25718dce85e7baf6a64ef2503e2e86de54ae69e187fe0e0d43d7a33b9815f57f49861895ff73c936a4def42711acffb71f2688afa70f83337dd74aa8e3bcd2d0b7b699a68e1dc2521f1b5b8822971a123eae24eb39ec55fce35cf838e1ca18249abcfb31907157445e7cc3a62cc417f6d499c37d6054d5e70d14076bc1993e11f93c7a8f0c2e53969496d0ddbc0fea39b6a1062f943ce3b03c449289e36911430c4d25d8a226f2177a534339a5e3436577f95cf0c1cd4448750948f6ce7718445468f86cc799a50d58227974c70063882a6446a7ea7ab543f0de5", &(0x7f0000000200)=""/55}, 0x18) 19:20:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x9400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1994.813775] binder: send failed reply for transaction 5288 to 30623:30624 19:20:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xc3ffffff}}) [ 1994.907760] binder: 30640:30646 ioctl c0306201 20000600 returned -14 [ 1994.919342] binder_alloc: 30640: binder_alloc_buf size -9223372036854775808 failed, no address space [ 1994.934489] protocol 88fb is buggy, dev hsr_slave_0 [ 1994.939616] protocol 88fb is buggy, dev hsr_slave_1 19:20:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x207100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1994.991690] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 12280 (num: 1 largest: 12280) [ 1995.014464] protocol 88fb is buggy, dev hsr_slave_0 [ 1995.019574] protocol 88fb is buggy, dev hsr_slave_1 [ 1995.024756] protocol 88fb is buggy, dev hsr_slave_0 [ 1995.027383] binder: release 30640:30646 transaction 5291 out, still active [ 1995.029826] protocol 88fb is buggy, dev hsr_slave_1 19:20:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xfdfdffff}}) [ 1995.058105] binder_release_work: 11 callbacks suppressed [ 1995.058111] binder: undelivered TRANSACTION_COMPLETE 19:20:44 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xfe80) [ 1995.121650] binder: BINDER_SET_CONTEXT_MGR already set [ 1995.144992] binder: 30660:30661 ioctl 40046207 0 returned -16 19:20:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0xa, 0x800, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @local}, &(0x7f0000000100)=0xc) sendmsg$xdp(r1, &(0x7f00000003c0)={&(0x7f0000000180)={0x2c, 0x6, r2, 0x11}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000200)="5e5cedf17cb245036ee4e5403f8e3d3f94f5824185a5d06c7d74982f1118f6a4a7d53e4c17fe81b219d169c6539ee0b5fdcbc555d12995693f35016169a09a9bfe4bd9cd2bd9a0b682678097f0c0354819bbe4e7804821bdc2d75ebe260056f96e0b4bbea350eb393dc024f209473d4afb582b2b1688b68db72b694d9e17a03bb82a91420c46b891c9271b88e540cf63d8c7bbcff79a54c08d28a3a7d3f028d6165c5c06e899ef86159f2334a0b5256a9706ad5a7322ec4cfb8164bc8d6160788a423182a74655443a4fe33239b1190c8ffaa2b68a73329e2bcfd9b2", 0xdc}], 0x1, 0x0, 0x0, 0x48880}, 0x4008010) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) read$FUSE(r3, &(0x7f0000000500), 0x1000) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000100)=0x7e00000, 0x4) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x80, 0x0) ioctl$VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f00000001c0)={0x5, 0xf, 0x4, 0x400000, {0x0, 0x7530}, {0x7, 0xa, 0x10000, 0x7, 0x0, 0x8, "29240ec3"}, 0x8000, 0x3, @fd, 0x4}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x468bf127, 0x0) 19:20:44 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) getresuid(&(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000180)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'syz_tun\x00', 0x0}) bind$packet(r2, &(0x7f0000003a00)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000000)=0x8, 0x4) write$FUSE_WRITE(r2, &(0x7f00000000c0)={0x89, 0x0, 0x0, {0xffffffffffffffff}}, 0x18) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 1995.183324] binder: 30660:30661 ioctl c0306201 20000600 returned -14 19:20:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xfeffffff}}) 19:20:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xe00000000000000) 19:20:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xfffffdfd}}) [ 1995.432994] binder: 30691:30692 ioctl c0306201 20000600 returned -14 19:20:45 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1dd1f) 19:20:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x50a000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r4 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x2, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x8) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:45 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0xfffffffffffffffc, @mcast2}, 0x1c) [ 1995.562889] binder: release 30691:30692 transaction 5297 out, still active [ 1995.577303] binder: undelivered TRANSACTION_COMPLETE 19:20:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xffffffc3}}) 19:20:45 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xfffff000) [ 1995.670509] binder_transaction: 4 callbacks suppressed [ 1995.670521] binder: 30710:30711 got reply transaction with bad transaction stack, transaction 5300 has target 30710:0 [ 1995.735013] binder: 30710:30711 ioctl c0306201 20000600 returned -14 19:20:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xfffffffe}}) 19:20:45 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) dup2(0xffffffffffffffff, 0xffffffffffffffff) 19:20:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x709000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:45 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x34000) [ 1995.904817] binder: release 30710:30711 transaction 5300 out, still active [ 1995.947872] binder: BINDER_SET_CONTEXT_MGR already set 19:20:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x0, 0x2) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r3, 0x0, 0x70bd27, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x48800}, 0x200000c0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r8 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1995.969432] binder: undelivered TRANSACTION_COMPLETE [ 1995.994643] binder_release_work: 24 callbacks suppressed [ 1995.994650] binder: undelivered TRANSACTION_ERROR: 29201 [ 1996.001132] binder: 30739:30740 ioctl 40046207 0 returned -16 [ 1996.006185] binder: BINDER_SET_CONTEXT_MGR already set 19:20:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x100000000000000}}) [ 1996.063884] binder: 30735:30737 ioctl 40046207 0 returned -16 [ 1996.068631] binder: 30739:30746 ioctl c0306201 20000600 returned -14 [ 1996.107627] binder: 30735:30750 unknown command 0 19:20:45 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000340)='/dev/hwrng\x00', 0x20080, 0x0) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000380)=""/7) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x0, 0x9ec8451ba45e485f) connect$unix(r2, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) r3 = msgget(0x1, 0x18) msgctl$MSG_STAT(r3, 0xb, &(0x7f0000000240)=""/237) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x200, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r4, 0x29, 0x2d, &(0x7f0000000040)={0x7, {{0xa, 0x4e20, 0x8cac, @mcast1, 0x1}}}, 0x88) [ 1996.135375] binder: 30735:30750 ioctl c0306201 20000140 returned -22 19:20:45 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x200000000000000}}) 19:20:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x712000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1996.187027] binder: undelivered TRANSACTION_ERROR: 29189 19:20:45 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x40000) [ 1996.240474] binder: undelivered TRANSACTION_ERROR: 29189 19:20:45 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = msgget$private(0x0, 0x100) msgctl$MSG_STAT(r1, 0xb, &(0x7f0000000080)=""/121) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video1\x00', 0x2, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r2 = msgget(0x1, 0x20) msgctl$MSG_STAT(r2, 0xb, &(0x7f0000000000)=""/93) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x100000000000000}}) 19:20:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x100, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) clock_gettime(0x2, &(0x7f00000001c0)) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000080)=""/6) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x30, 0x100) ioctl$CAPI_SET_FLAGS(r5, 0x80044324, &(0x7f0000000180)=0x1) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x300000000000000}}) [ 1996.363033] binder: 30771:30772 got reply transaction with bad transaction stack, transaction 5305 has target 30771:0 [ 1996.432609] binder: 30771:30772 ioctl c0306201 20000600 returned -14 19:20:46 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x2}}) 19:20:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = creat(&(0x7f0000000200)='./file0\x00', 0x4) setsockopt$inet_int(r1, 0x0, 0xc, &(0x7f0000000240)=0x6, 0x4) r2 = syz_open_pts(r0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$VIDIOC_S_SELECTION(r1, 0xc040565f, &(0x7f0000000280)={0x0, 0x0, 0x4, {0x0, 0x6, 0x2b, 0xfff}}) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x4, 0x4, 0x7fffffff}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000180)={r5, 0xc305, 0x10}, &(0x7f00000001c0)=0xc) write$P9_RATTACH(r1, &(0x7f00000003c0)={0x14, 0x69, 0x2, {0x2, 0x2, 0x4}}, 0x14) fcntl$getownex(r1, 0x10, &(0x7f00000002c0)={0x0, 0x0}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000300)=0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000380)={0x5, 0xffff, 0x9f, 0x9, 0x8, 0x40, 0x2, 0x3, 0x400, 0x1}) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000340)={0x5b7, 0x5, 0x400, 0xc000000000000, 0x8, 0x401, 0x2, 0x6904, 0x4, 0xac, 0xff}, 0xb) kcmp(r6, r7, 0x4, r4, r0) r8 = dup3(r2, r0, 0x80000) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x400000000000000}}) 19:20:46 executing program 1: r0 = socket$inet6(0xa, 0x80001, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x740000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1996.587603] binder: release 30771:30772 transaction 5305 out, still active [ 1996.604050] binder: undelivered TRANSACTION_COMPLETE [ 1996.632095] binder: undelivered TRANSACTION_ERROR: 29201 [ 1996.659907] binder: 30799:30803 got reply transaction with bad transaction stack, transaction 5308 has target 30799:0 19:20:46 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x100000) 19:20:46 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0xa) [ 1996.699769] binder: 30799:30803 ioctl c0306201 20000600 returned -14 19:20:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000100)=0x8000) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xf00000000000000}}) 19:20:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x807902, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1996.855018] binder: undelivered TRANSACTION_COMPLETE [ 1996.860350] binder: undelivered TRANSACTION_ERROR: 29201 19:20:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x3f00000000000000}}) [ 1996.920634] binder: 30831:30833 got reply transaction with bad transaction stack, transaction 5311 has target 30831:0 [ 1996.957689] binder: 30831:30833 ioctl c0306201 20000600 returned -14 19:20:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x907000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1997.021875] binder: undelivered TRANSACTION_COMPLETE [ 1997.037350] binder: undelivered TRANSACTION_ERROR: 29201 19:20:46 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x400300) [ 1997.071681] binder_send_failed_reply: 5 callbacks suppressed [ 1997.071688] binder: send failed reply for transaction 5311, target dead 19:20:46 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x400000000000045, 0x22, 0x0) r0 = getpid() r1 = getpgid(r0) r2 = syz_open_procfs(r1, &(0x7f00000000c0)='stat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') preadv(r2, &(0x7f0000000480), 0x1000000000000241, 0x0) 19:20:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r1 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r2 = request_key(&(0x7f0000000100)='encrypted\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f0000000180)='\x00', r1) keyctl$read(0xb, r2, &(0x7f00000001c0)=""/142, 0x8e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r3 = syz_open_pts(r0, 0xffffffffffffffff) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r8 = dup3(r3, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1997.113889] binder: 30842:30843 got reply transaction with bad transaction stack, transaction 5314 has target 30842:0 [ 1997.207554] binder_transaction: 16 callbacks suppressed [ 1997.207573] binder: 30842:30843 transaction failed 29201/-71, size 0-0 line 2816 [ 1997.234695] binder: 30842:30843 ioctl c0306201 20000600 returned -14 [ 1997.310723] binder: undelivered TRANSACTION_COMPLETE [ 1997.316476] binder: undelivered TRANSACTION_ERROR: 29201 [ 1997.323363] binder: send failed reply for transaction 5314, target dead 19:20:47 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x0, &(0x7f0000000600)=@raw=[@alu={0x7, 0x3, 0xf, 0x9, 0x7, 0x0, 0x4}, @ldst={0x1, 0x1, 0x0, 0x3, 0xf, 0x158, 0x1}], &(0x7f0000000140)='syzkaller\x00', 0x5, 0xc3, &(0x7f0000000040)=""/195, 0x40f00, 0x0, [], 0x0, 0xfffffffffffffffc}, 0x48) 19:20:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x4000000000000000}}) 19:20:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x940000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x100400200) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x80, 0x0) r6 = open(&(0x7f0000000140)='./file0\x00', 0x181, 0x1) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f00000001c0)=0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000200)=0x0) rt_tgsigqueueinfo(r7, r8, 0x26, &(0x7f0000000240)={0x13, 0x6, 0x2247dc03}) fanotify_mark(r5, 0x2, 0x8000010, r6, &(0x7f0000000180)='./file0\x00') dup3(r1, r0, 0x0) 19:20:47 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) fcntl$setpipe(r0, 0x407, 0x2) 19:20:47 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf0ffff) [ 1997.516342] binder: 30874:30875 got reply transaction with bad transaction stack, transaction 5317 has target 30874:0 19:20:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='cpuset\x00') preadv(r2, &(0x7f0000000480), 0x10000000000001ed, 0x0) 19:20:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xc3ffffff00000000}}) [ 1997.571188] binder: 30874:30875 transaction failed 29201/-71, size 0-0 line 2816 [ 1997.622174] binder: 30874:30875 ioctl c0306201 20000600 returned -14 19:20:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x80000001) r5 = dup3(r1, r0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400, 0x0) syz_kvm_setup_cpu$x86(r5, r4, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa05000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:47 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) keyctl$join(0x1, &(0x7f0000000000)={'syz', 0x2}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xfdfdffff00000000}}) [ 1997.768430] binder: undelivered TRANSACTION_COMPLETE [ 1997.774532] binder: undelivered TRANSACTION_ERROR: 29201 [ 1997.806792] binder: send failed reply for transaction 5317, target dead 19:20:47 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000180)={0x4, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r3, 0x4018aee3, 0x0) 19:20:47 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1000000) [ 1997.882686] binder: 30903:30905 got reply transaction with bad transaction stack, transaction 5320 has target 30903:0 [ 1997.954053] binder: 30903:30905 transaction failed 29201/-71, size 0-0 line 2816 19:20:47 executing program 1: r0 = socket$inet6(0xa, 0x2, 0xfffffffffffffff7) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 1998.001499] binder: 30903:30905 ioctl c0306201 20000600 returned -14 19:20:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xfeffffff00000000}}) 19:20:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_ENABLE_CAP(r3, 0x4068aea3, &(0x7f0000000180)={0x74, 0x0, [0x9, 0x4, 0x5, 0x800]}) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x20000, 0x0) ioctl$BLKBSZGET(r5, 0x80081270, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa07b02, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1998.119511] binder: undelivered TRANSACTION_COMPLETE [ 1998.125150] binder: undelivered TRANSACTION_ERROR: 29201 19:20:47 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) recvfrom$inet6(r0, &(0x7f0000000000)=""/29, 0x1d, 0x0, &(0x7f0000000040)={0xa, 0x4e22, 0x1f, @mcast1, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:47 executing program 3: r0 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000003a80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000000000)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$sock_int(r0, 0x1, 0x20000000000008, &(0x7f0000000240), 0x4) mq_notify(0xffffffffffffffff, &(0x7f0000000040)={0x20000000, 0x4000000000003, 0x2, @thr={0x0, 0x0}}) r2 = creat(0x0, 0x0) dup2(r1, r0) getpeername$inet6(0xffffffffffffffff, 0x0, &(0x7f0000003980)) ioctl$TCGETS(r2, 0x5401, &(0x7f0000000080)) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 1998.169391] binder: send failed reply for transaction 5320, target dead 19:20:47 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x2000000) [ 1998.248555] binder: 30936:30938 got reply transaction with bad transaction stack, transaction 5323 has target 30936:0 19:20:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0xffffffff00000000}}) 19:20:48 executing program 3: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, 0x0, 0x0) getpeername$netlink(r1, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000005d00)={&(0x7f0000000880)=@newlink={0x5c, 0x10, 0xd07, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @ip6gre={{0xc, 0x1, 'ip6gre\x00'}, {0x18, 0x2, [@IFLA_GRE_LOCAL={0x14, 0x7, @mcast1}]}}}, @IFLA_BROADCAST={0xc, 0x3, @local}, @IFLA_MASTER={0x8, 0xa, 0x33e0}]}, 0xb7}}, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x100) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={0x0, 0xcb}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000200)={r3, 0x19, "40003929219916d8133a261620a4cfaafbb9f67242dfa33e3b"}, &(0x7f0000000240)=0x21) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000080)={{0x7fffffff, 0xffffffffffffffff, 0x1, 0x4}, 'syz0\x00', 0x3d}) [ 1998.293660] binder: 30936:30938 transaction failed 29201/-71, size 0-0 line 2816 [ 1998.325735] binder: 30936:30938 ioctl c0306201 20000600 returned -14 19:20:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x2}}) 19:20:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:48 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) clock_getres(0x5, &(0x7f0000000100)) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 1998.483014] binder_thread_release: 5 callbacks suppressed [ 1998.483025] binder: release 30936:30938 transaction 5323 out, still active [ 1998.488955] binder: undelivered TRANSACTION_COMPLETE [ 1998.524023] binder: undelivered TRANSACTION_ERROR: 29201 [ 1998.547899] binder: send failed reply for transaction 5323, target dead 19:20:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x3}}) 19:20:48 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x3000000) [ 1998.569949] binder: 30972:30975 got reply transaction with bad transaction stack, transaction 5326 has target 30972:0 [ 1998.603970] binder: 30972:30975 transaction failed 29201/-71, size 0-0 line 2816 19:20:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x4}}) [ 1998.663335] binder: 30972:30975 ioctl c0306201 20000600 returned -14 19:20:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 1998.778502] binder: release 30972:30975 transaction 5326 out, still active [ 1998.793549] binder: send failed reply for transaction 5326, target dead [ 1998.839486] binder: 30993:30994 got reply transaction with bad transaction stack, transaction 5329 has target 30993:0 [ 1998.874689] binder: 30993:30994 transaction failed 29201/-71, size 0-0 line 2816 [ 1998.889774] binder: 30993:30994 ioctl c0306201 20000600 returned -14 [ 1998.978352] binder: release 30993:30994 transaction 5329 out, still active [ 1998.989544] binder: send failed reply for transaction 5329, target dead 19:20:48 executing program 1: r0 = socket$inet6(0xa, 0xffffffffffffffc2, 0x3) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r1 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x10000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x200}}, 0x1f, 0x5}, &(0x7f0000000340)=0x90) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000380)={r2, 0x29ed}, 0x8) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e24, @multicast1}, @in6={0xa, 0x4e20, 0x1f, @remote, 0x400}, @in6={0xa, 0x4e24, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, @in={0x2, 0x4e20, @local}, @in6={0xa, 0x4e22, 0x8, @rand_addr="075b786ac6196cdb3c9261253d89bcb5", 0x9}, @in6={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @in={0x2, 0x4e24, @loopback}, @in6={0xa, 0x4e22, 0x7fffffff, @loopback, 0x1}, @in6={0xa, 0x4e24, 0xf20c, @loopback, 0x6}], 0xd8) syslog(0x9, &(0x7f00000003c0)=""/149, 0x95) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:48 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000500)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xb9\xb3\xf8h>\xcf\x89\xde\xe9\x01\xd2\xdau\xc0\x1f\x02\x00\xf5\x8d&\xd7\xa0q\xfb53\x1c\xe3\x9cZ\xee\xffP\x83\xcf\a\xddFE\\\x91MJ\xff\x1e|\xf7\xedW\xc0\xc2\x05o\\\xa9\xfc\xf0<\xbf\x82\xbd\x13SG73\x92E\xd3\xc7\x06A\xbeb\x81\xd7\xe1\xb4\xb7\t\x91\x14\xc5q\x87\"\x98\xdd\x7f! \xe2\xb6\xfa*.*,\x9cn\x004u\vya\xfa,\x15\x84\xc0\xb5\xa5\x00\xae\n\xc3\x9b\xc7jx\xd9\x15\x82fu\x9fvj>\x8c\x84\xc0\x9c\xf3\xad\x88\x82\x94\x7f\xfa\x1f\xb4\xc0Pr{\xeb\x12\xc5~\x06\xffY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89$W\x8a\xd4\x9e\xa1\x14LtH\xd6@\xaa\x88\xa6jq\xb7}s\xa9$\xff\x02\x7f\xdc\xb5P\x16\x16S\xd4\xcbW\b\x83\x85$\x82\x86\xf5\xbe\x9d\x87f\xc7\f)\xe6\xf5\x06=\xfet\xa1\xb0\xb5 y\x15\x90H!\vM\'\x1a\xc9L\x88\x9b\x06<\xa3J\tW\x9a\xf061\xf1(\xe6\xdd,\x96m\xae\xcd|o~\x0fN\xbc\xaf\x80%\f\xfa\xb0q\x84\x83\x80x\xc7\x1d\x80\x9d\x06\xdc\v\xacu\xdb\x81E%\xd1\xd1\xac\xafL\xb6\xf4\x89\x0f9s\x82\xaecf\x97\xf6\x88\tN8\xdb\\\"w\x0fS\alc\r\xf9\xbbL\x14\x91\x89\xff\xa9u\xf5 \x871\x1c[\xaa\xfc\x11\xc9\v\xdc%\xfc\x80;q\x15=\xdc9\x95\xb2\xdfI\xcd\xd7\x84\xbc[\xea@\x86\x10p\xda\xdb9^\x85\xc9<\xdf\xa0\x8e') mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ftruncate(r0, 0x81) mlock(&(0x7f0000001000/0x4000)=nil, 0x4000) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)=0x0) tkill(r2, 0x37) pkey_mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x3, 0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) 19:20:48 executing program 2: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)) r0 = syz_open_pts(0xffffffffffffffff, 0x400) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x40003, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x2, 0x2) mknodat(r3, &(0x7f0000000140)='./file0\x00', 0x210, 0x0) connect$vsock_stream(r3, &(0x7f0000000100)={0x28, 0x0, 0x2711}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r6 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$PPPIOCSMRU1(r3, 0x40047452, &(0x7f0000000180)=0x8) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:48 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x4000000) 19:20:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xf}}) 19:20:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2798000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x300}}) [ 1999.128311] binder: 31006:31008 transaction failed 29201/-71, size 0-0 line 2816 [ 1999.169889] binder: 31006:31008 ioctl c0306201 20000600 returned -14 19:20:48 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x4, 0x80001) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4010010}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0xbc, r2, 0x401, 0x70bd26, 0xffff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x200}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x105}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xfffffffffffffffa}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bcsf0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x8001}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40}, 0x4000880) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:48 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000500)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xb9\xb3\xf8h>\xcf\x89\xde\xe9\x01\xd2\xdau\xc0\x1f\x02\x00\xf5\x8d&\xd7\xa0q\xfb53\x1c\xe3\x9cZ\xee\xffP\x83\xcf\a\xddFE\\\x91MJ\xff\x1e|\xf7\xedW\xc0\xc2\x05o\\\xa9\xfc\xf0<\xbf\x82\xbd\x13SG73\x92E\xd3\xc7\x06A\xbeb\x81\xd7\xe1\xb4\xb7\t\x91\x14\xc5q\x87\"\x98\xdd\x7f! \xe2\xb6\xfa*.*,\x9cn\x004u\vya\xfa,\x15\x84\xc0\xb5\xa5\x00\xae\n\xc3\x9b\xc7jx\xd9\x15\x82fu\x9fvj>\x8c\x84\xc0\x9c\xf3\xad\x88\x82\x94\x7f\xfa\x1f\xb4\xc0Pr{\xeb\x12\xc5~\x06\xffY\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89$W\x8a\xd4\x9e\xa1\x14LtH\xd6@\xaa\x88\xa6jq\xb7}s\xa9$\xff\x02\x7f\xdc\xb5P\x16\x16S\xd4\xcbW\b\x83\x85$\x82\x86\xf5\xbe\x9d\x87f\xc7\f)\xe6\xf5\x06=\xfet\xa1\xb0\xb5 y\x15\x90H!\vM\'\x1a\xc9L\x88\x9b\x06<\xa3J\tW\x9a\xf061\xf1(\xe6\xdd,\x96m\xae\xcd|o~\x0fN\xbc\xaf\x80%\f\xfa\xb0q\x84\x83\x80x\xc7\x1d\x80\x9d\x06\xdc\v\xacu\xdb\x81E%\xd1\xd1\xac\xafL\xb6\xf4\x89\x0f9s\x82\xaecf\x97\xf6\x88\tN8\xdb\\\"w\x0fS\alc\r\xf9\xbbL\x14\x91\x89\xff\xa9u\xf5 \x871\x1c[\xaa\xfc\x11\xc9\v\xdc%\xfc\x80;q\x15=\xdc9\x95\xb2\xdfI\xcd\xd7\x84\xbc[\xea@\x86\x10p\xda\xdb9^\x85\xc9<\xdf\xa0\x8e') mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ftruncate(r0, 0x81) mlock(&(0x7f0000001000/0x4000)=nil, 0x4000) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)=0x0) tkill(r2, 0x37) pkey_mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x3, 0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) 19:20:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x27ba000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xf00}}) [ 1999.291563] binder: release 31006:31008 transaction 5332 out, still active [ 1999.329400] binder: send failed reply for transaction 5332, target dead 19:20:49 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x5000000) 19:20:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) accept$unix(r6, &(0x7f0000000100), &(0x7f0000000180)=0x6e) [ 1999.392399] binder: 31038:31040 transaction failed 29201/-71, size 0-0 line 2816 19:20:49 executing program 1: rt_sigpending(&(0x7f0000000000), 0x8) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) prctl$PR_SET_FPEXC(0xc, 0xc0083) 19:20:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x3f00}}) 19:20:49 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$radio(&(0x7f0000000180)='/dev/radio#\x00', 0x2, 0x2) ioctl$KVM_GET_LAPIC(r3, 0x8400ae8e, &(0x7f00000001c0)={"93f7c7864e6054987f7594e65ff22184d7a25dd6fb4465110436cc1b7a3229440730a59649c437c0622e61eed30789cd9e965bc26343cf53d916e50860173de2fb6ae9239ebcba71ffa6376991ca9e934290c8f763e264d53c3f24e67f33ca16e666bb524e46602ef27959c2dfe7e5f2aff366c8cdd60062c673a95d44e576b44a96eb5982b16f82451a3f4a5c250a95636922c941a5adae9e96e19dc8b3868b0a2898459830e8a358204b8001452aeed1659ca3984a78fb4bbe871b35b87a473f49aa3953fc78c0658e350a570f68c6e1c0e9bb71392b6ee586e7a786e9120aa763dc5271068a74d0b66aa51ca340b7e487d88799bf6af91f697618bc791c626a15aac28069ed05fcdc06c1e95b291643dae79201a950f4189c0076f75556fae661f5d51fcd5bea4596253d2606051e14de5aae69e12397c196fd25294ad2a360947372bf2d21d6cf8741749a4bdd18f1746157c611981a08d97d4e700d7bbef638ed74f043e9e362a8197487e1aeff58647cdf7893029e5bd0b1c9128f2b11f886b1fb51e616019cef9543741cf8b0db61b690282cac2979b75d1fee9a616098881a8b81e4e774d62e5693387df1871e76424ce23526b30b0fc6a1cd05bbee70d6a0b2e704ffb5ead77f44bdc0a49d7e1e7e24a71f64376a6b6528afd453a61effdac6b47407d05fe1b1ebd9c285d53af332504540f618fb48a8042f21755aad136f41383b5ee2a330f2a78a5727684081c665acc3bf8a62279238ed9187eba4026359e353ac644612d1e3647fddbc84e419e83d2f895a75d8c1e15231276ad6c3a7134772c40faf49f9c2edcc6465b4da029a31dc1f5c25416f9a974d4a710fb9fab0b81baa178f9cbfdc4192925261530fe9b85555ee1a2ec394a6b126b530fdfbc5a3b05364ccbcbe85d09b5cc9a75349143f2039ef1781f8f55bb1fff41bc585544de29eacd0b020eee98c2ea3f060807e6de6ba24b3fa14d5c70394d7eed9c991934263182d65d2a588b2f76be2d79e6d89e767c6299334c32a3375ef336a7700d617a2aa51aab5c14eb969b70f40c91c6c6223a666417e7a9e5f4d90fed338cb812de34e3846c9aa4a591047c04ab6078bb137a9a12a4c2860049f66b2eabb1a61248425189832e948565769ab8dbed4920ec191ea2db957cc778a852061378beec8a45a10e07dde8493e90bf1af4b41d3b26be3782661b53b0a2ecf7a5e9d82041ee11b382b0259f5c0648d4cf74cfb590810c2b49013b732978d78b357292fb714409a85406be99aacd03a948bac65a7c64714fbcae1e7cfa23fbd5e1bc6084161f6087659f5924139c9f1687c1d4c66e5fda7854dff91fc654b24dbded571c157ca1ccccd6e9cb77503ec3c6ab9412495e0bee8df2fe435b4c4eff193d3f0549fe803b6bfd7a8e022e35051e9faa02d82401b62aec9a45baf1902"}) exit(0x0) syz_open_dev$video4linux(&(0x7f0000000140)='/dev/v4l-subdev#\x00', 0x4, 0x20000) r4 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x0, 0x2) ioctl$VIDIOC_ENUMINPUT(r3, 0xc050561a, &(0x7f00000005c0)={0x2, "1a00a7e1ef5dffe896af0547811d61fd9d0c8b672180206e09e804a21d85310f", 0x2, 0x9, 0x3, 0x80000, 0x0, 0x4}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)={0x8, 0x0, [{0xb76, 0x0, 0x3}, {0xaae, 0x0, 0xd0f}, {0xbbd, 0x0, 0x4}, {0x848, 0x0, 0xffffffffffffe699}, {0x8ba, 0x0, 0x9}, {0xbff, 0x0, 0x10001}, {0xb38, 0x0, 0x5}, {0x9fd, 0x0, 0x7f}]}) r5 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$notify(r0, 0x402, 0xa) dup3(r5, r2, 0x0) [ 1999.474917] binder: 31038:31040 ioctl c0306201 20000600 returned -14 19:20:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:49 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0xfffffdc3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x208080, 0x0) r3 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240)="62c1a93931bb778af3e9", 0xa, 0xfffffffffffffffa) r4 = add_key(&(0x7f0000000280)='big_key\x00', &(0x7f00000002c0)={'syz', 0x3}, &(0x7f0000000300)="ce8685735191b5b5e3993d5df3d588fc31e57bdb71ad99473f0e9b27530cb533a2bfd56b404462f116b8f267e24b97b01e33aaae3319e66b632e061041afe1d6697c35b4db363861932df0acc9255a0c5b266ecaeac1dd75b4ac4641e757954e84e33d109757848ddd3ff0c194747394582e30039a7f96ef25a65204ce0857497d72a643504f1dc0aac7dae203825235e3bb15c67cf6484c3fea4e4419f6d1f75f85dd78d2b11d57fc5bd8b2076b04a11a7fa207b2cc25b679fcc11e", 0xbc, 0xfffffffffffffffa) r5 = add_key(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={'syz', 0x1}, &(0x7f0000000440)="9606597a40f66b", 0x7, 0xfffffffffffffff8) keyctl$dh_compute(0x17, &(0x7f0000000480)={r3, r4, r5}, &(0x7f00000004c0)=""/4096, 0x1000, &(0x7f0000001540)={&(0x7f00000014c0)={'rmd160\x00'}, &(0x7f0000001500)="e838326b91fbd8435762864911bd78a43fff11f5483e21a8ed8514da240c9662be2cac22266d7708508c5ec4bb21", 0x2e}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000080)="0f3066430f38813f48b85e750000000000000f23c80f21f8350400f0000f23f8b9b70200000f324610ec6536440f01d166baf80cb883433487ef66bafc0cb000ee3e360f232866b864008ee83e2636dca600400000", 0x55}], 0x1, 0x14, &(0x7f0000000140)=[@cr4={0x1, 0x20008}, @cstype3={0x5, 0x6}], 0x2) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000001640)) keyctl$update(0x2, r3, &(0x7f0000001580)="d65b56a76a7c3292c94e56697095eccab97b3f9d56724842b750dee9c1cc7c1c310af39d20f7923e850cc72611231210a23d387b9c25a1419bee6a48cdfba43b5164baebacb72b4d5254c3167e297fbe0bbfc1ac3c2968fa4da8a62126ae8b4acfa73890d0346a2cc46538440979bf11be2413467595bed8c615fb5e8a7543fa31eae9032c4168abb3e73c3d00284a3123e0ec4e07218216fe7ce3a8", 0x9c) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x4000}}) [ 1999.666387] binder: release 31038:31040 transaction 5335 out, still active [ 1999.690337] binder: send failed reply for transaction 5335, target dead 19:20:49 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e21, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:49 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x6000000) [ 1999.768833] binder: 31072:31074 transaction failed 29201/-71, size 0-0 line 2816 [ 1999.793156] binder: 31072:31074 ioctl c0306201 20000600 returned -14 19:20:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x1, 0x0) write$P9_RSTATFS(r3, &(0x7f0000000280)={0x43, 0x9, 0x2, {0x7e2c, 0x2, 0x6, 0xa2f, 0x8, 0x9, 0x1, 0x248}}, 0x43) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r3, 0x84, 0x1c, &(0x7f0000000300), &(0x7f0000000340)=0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x42, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="010a00b6c9f4dabb00", @ANYRES32=0x0], &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r7, 0x84, 0x11, &(0x7f0000000200)={r8, 0x4}, 0x8) r9 = dup3(r1, r0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) sysfs$1(0x1, &(0x7f0000000100)='/dev/ptmx\x00') syz_kvm_setup_cpu$x86(r9, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x1000000}}) 19:20:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2000.007335] binder: send failed reply for transaction 5338 to 31072:31074 19:20:49 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x100000000, {{0xa, 0x4e24, 0x100000000, @ipv4={[], [], @broadcast}, 0x2}}}, 0x88) 19:20:49 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4001000000000003, 0xe7) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f00000002c0)={0x8, {0x2, 0x0, @broadcast}, {0x2, 0x0, @remote}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x3}) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f00000004c0)=ANY=[@ANYPTR64=&(0x7f0000000500)=ANY=[@ANYRES16=r1, @ANYBLOB="862955bc7effe3e150b3c447bcc775f7fc2bdd75539bf83ea2f7a19f4c2b8e6b942e98d23fa8c4874b4dac37ce8ebb85dde4201255ee18cb54b267a3438778d699645650073617c9018c6660627d186ffefc48a348ac15dd520ba76730d5b5ae196ba7c32f86ee0225bd439ed262cba3189eeb335e16d38904344670d74457aaaedef1c742015b3948cd9f85dbc83230cb4b302c43c916d1b429b8ade5bf868be8a1c522a030cdb8f78180f02c96f1550d63fe7b0b685f0bb4854a1e98c8cfb15d8e09347b4b652b74756c0af8043a574bf65476c1f11c9b4978d5fb869b", @ANYPTR=&(0x7f0000000340)=ANY=[@ANYRESOCT=r0, @ANYRES64=r0, @ANYRESOCT=r1], @ANYRESHEX=r1, @ANYRES32, @ANYRES16=r1, @ANYRES64=r1, @ANYRESHEX=r1, @ANYRESDEC=r1], @ANYRESOCT, @ANYRES16=r0, @ANYRES32, @ANYPTR64], 0x5) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x7) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e22, @broadcast}, 0x10) getsockopt$sock_buf(r1, 0x1, 0x3d, &(0x7f0000000140)=""/28, &(0x7f0000000200)=0x1c) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000040)=""/109, &(0x7f00000000c0)=0x6d) 19:20:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x2000000}}) [ 2000.128480] binder: 31101:31102 transaction failed 29201/-71, size 0-0 line 2816 [ 2000.159969] binder: 31101:31102 ioctl c0306201 20000600 returned -14 [ 2000.226764] IPVS: length: 109 != 8 19:20:49 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x7000000) 19:20:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2000.265659] IPVS: length: 109 != 8 19:20:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r2, r4, 0x80000) r5 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x200, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x80004400200) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2000.292945] binder: send failed reply for transaction 5341 to 31101:31102 [ 2000.321842] binder_release_work: 5 callbacks suppressed [ 2000.321847] binder: undelivered TRANSACTION_COMPLETE 19:20:50 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0xff, 0x2) dup2(r1, r0) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000100)=0xfffffffffffffffe) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x3000000}}) [ 2000.389971] binder: 31122:31124 ioctl c0306201 20000600 returned -14 19:20:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:50 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x1, 0x0) write$P9_RSTATFS(r3, &(0x7f0000000280)={0x43, 0x9, 0x2, {0x7e2c, 0x2, 0x6, 0xa2f, 0x8, 0x9, 0x1, 0x248}}, 0x43) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r3, 0x84, 0x1c, &(0x7f0000000300), &(0x7f0000000340)=0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x42, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000380)=ANY=[@ANYBLOB="010a00b6c9f4dabb00", @ANYRES32=0x0], &(0x7f00000001c0)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r7, 0x84, 0x11, &(0x7f0000000200)={r8, 0x4}, 0x8) r9 = dup3(r1, r0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) sysfs$1(0x1, &(0x7f0000000100)='/dev/ptmx\x00') syz_kvm_setup_cpu$x86(r9, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2000.501631] binder: release 31122:31124 transaction 5344 out, still active [ 2000.509711] binder: undelivered TRANSACTION_COMPLETE [ 2000.592752] binder: send failed reply for transaction 5344, target dead 19:20:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x4000000}}) [ 2000.654909] binder: 31144:31149 ioctl c0306201 20000600 returned -14 19:20:50 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x8000000) 19:20:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$CAPI_REGISTER(r6, 0x400c4301, &(0x7f0000000100)={0x2, 0x4, 0x9}) 19:20:50 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x4d4, 0x32}, 0x0, @in6, 0x0, 0x0, 0x2, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) [ 2000.774481] net_ratelimit: 24 callbacks suppressed [ 2000.774488] protocol 88fb is buggy, dev hsr_slave_0 [ 2000.774493] protocol 88fb is buggy, dev hsr_slave_0 [ 2000.774548] protocol 88fb is buggy, dev hsr_slave_1 [ 2000.779492] protocol 88fb is buggy, dev hsr_slave_1 19:20:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xf000000}}) [ 2000.824010] binder: release 31144:31149 transaction 5347 out, still active [ 2000.836459] binder: undelivered TRANSACTION_COMPLETE 19:20:50 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000640)={0x0, 0x0, 0x4, 0x7, 0x0, 0x3, 0x7f, 0x5, {0x0, @in6={{0xa, 0x4e22, 0x2aa, @mcast1, 0x401}}, 0x10000, 0x4, 0x6, 0x101, 0x1}}, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000700)=@sack_info={r2, 0x1, 0x29bb}, &(0x7f0000000180)=0xc) recvfrom(r1, &(0x7f0000000440)=""/57, 0x39, 0x10002, &(0x7f0000000480)=@l2={0x1f, 0x0, {0x0, 0x100000001, 0x0, 0x6, 0x7, 0xfffffffffffffffe}, 0xdd0, 0x8}, 0x80) sysinfo(&(0x7f0000000740)=""/68) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x0) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000e33fe0)='X', 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f00000007c0)=""/155) write$binfmt_misc(r3, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x34000) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.stat\x00', 0x0, 0x0) tgkill(0x0, 0x0, 0x12) ioctl$KVM_GET_XCRS(0xffffffffffffffff, 0x8188aea6, &(0x7f0000000080)={0x1, 0x10000, [{}]}) accept4(r1, 0x0, &(0x7f0000000040), 0x0) sync_file_range(0xffffffffffffffff, 0x6, 0x0, 0x3) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0xc008ae05, &(0x7f0000000540)=""/114) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000240)={{0x0, 0x2, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x400000000200, 0x0, 0x0, 0x0, 'syz1\x00', &(0x7f0000000040), 0x0, [], [0x0, 0x48000000000, 0x0, 0xffffffff]}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r4 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x0, 0x0) r5 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x20080) ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000080)={r5, 0x0, 0x100000000, 0x8000}) [ 2000.943977] binder_transaction: 6 callbacks suppressed [ 2000.943990] binder: 31168:31169 got reply transaction with bad transaction stack, transaction 5350 has target 31168:0 [ 2000.957910] binder: 31168:31169 ioctl c0306201 20000600 returned -14 19:20:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x3f000000}}) 19:20:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x10000000000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x0, 0x0) syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x3, 0x2) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000140)={0x0, 0x5, 0x3, 0x4, 0x10000, 0x3f5, 0x7, 0x3, {0x0, @in6={{0xa, 0x4e24, 0x4, @remote, 0xf24}}, 0x4, 0x10000, 0x7fffffff, 0x0, 0x3f}}, &(0x7f0000000200)=0xb0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000300)={0x7fff, 0xcc, 0x4, 0x7, 0x8, 0x953, 0x3, 0x7, r5}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TUNSETNOCSUM(r6, 0x400454c8, 0x1) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x20) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) inotify_init() openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x230000, 0x0) r8 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:50 executing program 3: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x20) bind$bt_rfcomm(r0, &(0x7f0000000100)={0x1f, {0x1, 0x1, 0x7, 0x2, 0x3ff, 0xd36}, 0x4}, 0xa) r1 = socket$nl_route(0x10, 0x3, 0x0) fcntl$setstatus(r1, 0x4, 0x2000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'lo\x00\x00[\x19Q\xa6_. @\x01@\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0xfebe, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv4_newaddr={0x28, 0x14, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x8}, @IFA_FLAGS={0x8, 0x8, 0x400}]}, 0x28}}, 0x0) [ 2001.080550] binder: send failed reply for transaction 5350 to 31168:31169 [ 2001.110687] binder: undelivered TRANSACTION_COMPLETE [ 2001.137402] binder_release_work: 10 callbacks suppressed [ 2001.137408] binder: undelivered TRANSACTION_ERROR: 29201 [ 2001.167068] binder: 31187:31189 got reply transaction with bad transaction stack, transaction 5353 has target 31187:0 [ 2001.174456] protocol 88fb is buggy, dev hsr_slave_0 [ 2001.182939] protocol 88fb is buggy, dev hsr_slave_1 19:20:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x40000000}}) 19:20:50 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x9000000) [ 2001.187656] binder: undelivered TRANSACTION_ERROR: 29189 [ 2001.254474] protocol 88fb is buggy, dev hsr_slave_0 [ 2001.259591] protocol 88fb is buggy, dev hsr_slave_1 [ 2001.264802] protocol 88fb is buggy, dev hsr_slave_0 [ 2001.269873] protocol 88fb is buggy, dev hsr_slave_1 [ 2001.294834] binder: 31187:31189 ioctl c0306201 20000600 returned -14 19:20:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff}}) 19:20:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:51 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x1000000000c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000140)=0x100000008001) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/216, 0xd8}], 0x300) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040), &(0x7f0000000080)=0x4) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f000000d000), &(0x7f0000001000)=0xfea6) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000001000)) [ 2001.454845] binder: send failed reply for transaction 5353 to 31187:31189 19:20:51 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x100, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000040)={0x1, 0x2, [@empty, @random="389f7d1a2dce"]}) [ 2001.528093] binder: undelivered TRANSACTION_COMPLETE 19:20:51 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xa000000) 19:20:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}}) [ 2001.563133] binder: undelivered TRANSACTION_ERROR: 29201 [ 2001.575577] binder: 31215:31216 got reply transaction with bad transaction stack, transaction 5356 has target 31215:0 [ 2001.595857] binder: undelivered TRANSACTION_ERROR: 29189 19:20:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KDGETKEYCODE(r1, 0x4b4c, &(0x7f0000000100)={0x101, 0x1ff}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2001.681151] binder: 31215:31216 ioctl c0306201 20000600 returned -14 19:20:51 executing program 3: r0 = open(&(0x7f0000000040)='./file0\x00', 0x400040, 0x3) ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x3, &(0x7f0000000100)="0adc1f023c123f3188a070") r2 = socket(0x20000000000000a, 0xb, 0x0) getsockopt$sock_buf(r2, 0x1, 0x2a, &(0x7f0000b56f40)=""/192, &(0x7f0000004ffc)=0xc0) 19:20:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}) [ 2001.829402] binder: send failed reply for transaction 5356 to 31215:31216 [ 2001.873281] binder: undelivered TRANSACTION_COMPLETE [ 2001.882009] binder: 31243:31244 got reply transaction with bad transaction stack, transaction 5359 has target 31243:0 19:20:51 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) r1 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x100000003, 0x8000) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000580)='TIPCv2\x00') ioctl$PERF_EVENT_IOC_DISABLE(r2, 0x2401, 0x25) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2100200a}, 0xc, &(0x7f0000000500)={&(0x7f0000000380)={0x148, r3, 0x110, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_MEDIA={0xc0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4cc}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8cb0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffffffffffe0}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_MEDIA_PROP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x14}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK={0x10, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0x4}]}, 0x148}}, 0x80) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000340)={0x0, 0x80000001}, &(0x7f00000005c0)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000600)={r4, 0x175, 0x4}, 0x8) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000240)={0x53, 0xfffffffffffffffb, 0x56, 0x5, @scatter={0x1, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/15, 0xf}]}, &(0x7f00000000c0)="de14e3ea6b0eb6bad7e27222220eabc661d3c169a4329faac615e53dbdc8ca2ce3ba2f0535c938061ff3bf408218099c842d338aa2869b331603d13c12e0098891b1685748d437169f770679ea1f8c52b472d91270d6", &(0x7f0000000180)=""/54, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00000001c0)}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r5 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000004, r5) ioctl$KVM_ASSIGN_PCI_DEVICE(r2, 0x8040ae69, &(0x7f0000000640)={0x40, 0x100000001, 0x7bd409d1, 0x0, 0x3}) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:51 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe000000) [ 2001.914884] binder: undelivered TRANSACTION_ERROR: 29201 [ 2001.918078] binder: 31243:31244 ioctl c0306201 20000600 returned -14 [ 2001.947794] binder: undelivered TRANSACTION_ERROR: 29189 19:20:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}}) 19:20:51 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x22041, 0x0) ioctl$RTC_AIE_ON(r1, 0x7001) r2 = syz_open_procfs(r0, &(0x7f0000000000)='oom_score_adj\x00') lseek(r2, 0x1e, 0x1) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000080)={'nr0\x00', {0x2, 0x4e21, @loopback}}) 19:20:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x1f}) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:51 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0xdefa84267934d662, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000240)={0x10004, 0x1, 0x4, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) setxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='security.capability\x00', &(0x7f0000000180)=@v2={0x2000000, [{0x400, 0x5}, {0x5, 0x100}]}, 0x14, 0x1) getpeername(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f00000000c0)=0xd) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000440)={{{@in6=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f0000000540)=0xe8) getgroups(0x3, &(0x7f0000000580)=[0xee01, 0xffffffffffffffff, 0xee01]) getresuid(&(0x7f00000005c0), &(0x7f0000000600), &(0x7f0000000640)=0x0) r5 = geteuid() mount$fuseblk(&(0x7f0000000380)='/dev/loop0\x00', &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)='fuseblk\x00', 0x4, &(0x7f0000000680)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x5}}, {@max_read={'max_read', 0x3d, 0x6}}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}], [{@appraise='appraise'}, {@measure='measure'}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@smackfstransmute={'smackfstransmute'}}, {@fsmagic={'fsmagic', 0x3d, 0x2}}, {@euid_eq={'euid', 0x3d, r4}}, {@euid_lt={'euid<', r5}}, {@smackfsfloor={'smackfsfloor', 0x3d, '/proc/self/net/pfkey\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x37, 0x77, 0x7d, 0x39, 0x62, 0x34, 0x37], 0x2d, [0x31, 0x3f, 0x62, 0x61], 0x2d, [0x32, 0x64, 0x33, 0x7f], 0x2d, [0x77, 0x35, 0x62, 0x38], 0x2d, [0x0, 0x36, 0x62, 0x67, 0x77, 0x61, 0x30, 0x64]}}}]}}) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000000280)=""/221) 19:20:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xffffffc3}}) [ 2002.099510] binder: release 31243:31244 transaction 5359 out, still active [ 2002.124763] binder: undelivered TRANSACTION_COMPLETE 19:20:51 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000440)=0x2e7c, 0x4) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000040)={0x7, 0x57}, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x0, 0x0) r3 = getpgid(0x0) r4 = geteuid() sendmsg$netlink(r2, &(0x7f00000001c0)={&(0x7f00000000c0)=@kern={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)=[{&(0x7f0000000280)={0x184, 0x18, 0x400, 0x70bd28, 0x25dfdbfc, "", [@nested={0x18, 0x5c, [@typed={0x14, 0x5, @str='bdev{vmnet1eth0\x00'}]}, @typed={0x14, 0x40, @ipv6=@empty}, @nested={0xac, 0x91, [@generic="1168dc6e9cfb4ab98ba0ca28e34d99928a4a295c016fa22ddbc053783a1d658cb705b557579e2545", @generic="26d73393ce104450cbb8e553a0369f6b5252ed0ef8a2b9ffea1358455ab4fc0c7968f8cdaad0a6c7ef1e9e25db2f9039f4c58241ebc7166a464814b2e291d263f4d5787ea0076917ba38ef9f9c591a489dba6a5548e1d2e41f4ec921b07c3d3cdde65620b318c9f9e6012a81ba1ef42b5c25afd1f4e9f86ebf2af02231"]}, @generic="fe6a2a18a0101296466ae3904086ae61943a766c445d81df83d1707c079514d2f09d33707da04f1d608f51fbca68410cf39089f13421a7b04f28fe44e00b59c8478e20b85b0ae452539622f9240a15679f8d811dec16b850e5afd7a43739d5e8dab38be56d68a443dbdaa40219e4303e21af958f6deea3ce0185a43f8b7b61e5f2834d6ddab73ed48222951a8b95f00228d95b7b0dc5e13aefd16b"]}, 0x184}, {&(0x7f0000000100)={0x78, 0x2d, 0x404, 0x70bd2c, 0x25dfdbfd, "", [@nested={0x1c, 0x47, [@typed={0x8, 0x54, @ipv4=@rand_addr=0x1000}, @generic="b760252f095e", @typed={0x8, 0x68, @fd=r1}]}, @typed={0x20, 0x68, @binary="61bc5d670b0b4cff48d71d4ddbaf1548dd400585e5639128d8a458e1"}, @typed={0x8, 0x4c, @pid=r3}, @nested={0x8, 0x5b, [@typed={0x4, 0x66}]}, @nested={0x14, 0x71, [@typed={0x8, 0x70, @uid=r4}, @typed={0x8, 0x89, @u32=0x80}]}, @typed={0x8, 0x52, @str='$\x00'}]}, 0x78}], 0x2, 0x0, 0x0, 0x200008c4}, 0x80) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) sendto$inet(r1, &(0x7f0000000240)=';', 0x1, 0x420ffe3, 0x0, 0x0) fstatfs(r0, &(0x7f0000000480)=""/214) [ 2002.156721] binder: undelivered TRANSACTION_ERROR: 29201 [ 2002.198687] binder_send_failed_reply: 1 callbacks suppressed [ 2002.198693] binder: send failed reply for transaction 5359, target dead 19:20:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}) 19:20:51 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x2, 0x2) r2 = fcntl$getown(r0, 0x9) lstat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$sndpcmc(&(0x7f00000009c0)='/dev/snd/pcmC#D#c\x00', 0x3f, 0x60001) sendmsg$unix(r1, &(0x7f0000000980)={&(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000780)=[{&(0x7f0000000600)="9a52b1d6ab5b97d72b434ebdb872d98c81a353738da56b6c82d9fe60b818a6baf59b46c39059d75b690b93e2b2a81e6b6780da964d9a4f", 0x37}, {&(0x7f0000000640)="912d4339ac837837d9a8ee53b297d115c9f2c0724bdb118ca8eb7356a16c7b8a693eab6da8526182118416944f5abe363db941331816de67e0131ca1975786de4611b2ed4d588c47a49029ac7601f4d3d41c7a5569925a6b54a7aad0dce317b70b275c9d6cdc08ad4239d1dc2ebd95b8f2fb09ea8c8977cac5baac446de7d142b927a6e3f937425654c682e932618163cde9d1cbe7d521f21abf613b6d7aa95885bf0534faa40d0579ba4f09b37ae9705cf25c3651f7b83e39b4f1305eee0f8228e124c422caae37d4ef653ee85b16b28b638e12ab2194a4f2e1f8693b1bc04f985f91b03e68a451ac8441c5074324", 0xef}, {&(0x7f0000000740)="90ebfec16aaae3b4d7da7f7562f6c3dbbe422a32822895ae236a8e57f3c99b62da54760eb1c99421623e3d0826f00d01796260e5ac", 0x35}, {&(0x7f00000014c0)="2ee4158a33f316c2507b360df5bfbd91a12ea57370b6d0a534b4f8903ff46084286281c62439b7c4d2e8d7d8e0e26d9d7731a8da4164a1ac8d33e85909e30366892ddd83b08cb8d47fab395ba40b76a96d48d68a4410e301bc73ad17e7cce9fb61c93c475549bb02c739109dd8fe5a04e3cc2c56fd261d1b9ce6d61fe06b831f9553983635ca4b56b1d8e3b0089c9697a5b8ad24727013720772e84e4acc3d4266b7e7962dc2700d3c500dff652ac6a84022771510e35f74d85d8642d0002d47c6002a3a40577e5f732fc8a904bd30940af11b2f40be4422fa0e81cb7bcc47c9bb95b54e42076ad5b1357cf06b3373444a1f22f9abefb55cb4fe8b116163a0407cf916694b74adc57453efe289007ec1aa995097633153cedbf7352ba93b834eea79890e7f0498824d531f5f101a8aad1e784630b6b667fafe7e6c4f10ba8a5cf029c979ef0a56611fd80ffae5b2ce77bc2a9a580d19ca634228fe9bddb6908d3dbda394c181c92435d58a8c7fc8e0059df820c2269b5a6df015929ce57c8f83b159cd2129d24297710678308b35122ef07137afee41f1a8f41db5ec5e4ad56773d37542dc646c1c5d93fc5f181087e986d39fb8d9e7e917f136884f55baf049927384f878ddcd313fc033a834eabf8e83337bd392c51684946ed3d5af7d777f9dbe6b059f9cb1a0594c063a09b48139f91983c4d16ae98e9ad4ff2b274023d982337a39ab3753436e5f1f20b5534499a9b715d6b8e4d43f75b2bc94333684c087b2dd74ea2766e3bad9b8a0d58cf05b2869eeec0543df56c47886a188a6c8ad18acd03afa5219424f748d1e18a4dbed9a2e31ef6afc0cd0c47fbebb051ab7fd5cd2b4cd4b23dc1adf7836f45a9b4731bce331144b9127fed92d65ca80df4c09681ebf45fcdd602c56c7ed737e521a06b559330e85cb7fcfcb595f82148f9b9b5bcdf5e73ca61671542d7859f8d5f343b04a5dba52c06628900aabe32c020be8b3c21bf40294eab05001d3604eafbfd415bfc9821f96f96a1815e01413b70a54e11b6ab09ede1bc75c781edc7245151c374be2dd75b30fb813419a500746f7e8f1e0b0b186417826dfa7d36555eee864fbfa488a1d0bab2ba1f5a2f020e29b0b9ad3f2552d3744476e3e5cc05163ca8eb1a2e21d332f4a61f13ca5336d1d56acf0ddb730f46f18918c4169f1d5fcea13cc3aa57b29afaecd40da86ee81b9e458e6b0987d6318c28024b46147bb84dc6196ac6a18fe9ff2b71115a4df30deea32aa45f2b018e3137551f88d76e40a8c6b81af4f76fb63d85fabc216fe2d08ae0b2f7ed32319dc2c9ea8da544534e20758c6f5260201060a589953c8560f8862310154de1f3b1be49bfd1a962aab0d08a8e1d48541905c02dac5e39db9dddd33702de3e0f355622e6a7091466c4926e6fac618ca58f290860fe511647d2648ad88f0ad8dbf42e2d06c4c0fa1b3608e307dbb909989987058695c67f7292045387ad780f2c168eb3deaecd49ed6dbe0711e3f15a7841a44bbd8b642130b3ec9e2684d1ca782bae4d0a3aef776aee8ee5750c574a2899bddfeb2668b6c9032f9d56d46477451b27cf21d2d60fb3c41c5528e10fc87506237573732e048957e40446314742155406582ad91c9b57a6c2139129b9931f7f4f83ad8edd79a151cacb8a41851e949c814a627d438e02fa209f6493a616e3d2025adf11d67955a5febe0632a7ac27226dd21e9d1d04723f256ba1e14336829b06319bdc963e5160af81670c7a119811ef08959a2b3561b0bf7e4e8c961f266bed432f9c4d0135afce5c141c8bb0007fe0802db3c5e6b5c521a8b5dd34d67df7fa90a6077f7f3cdb56b77e43fd6859b1e8220a96b30c845d8df1a4d3aa002125861555500cde8b28ee5345339a9c64662360c1850d51e865053e51ab32ffa1d35c99de3e548477df5dfd64931762529ca1404dd5a3af1c27f1a5dd1678fd2915d5ea89313cf501b1eddd1ec620252b588a67fc6758fa09af848cef606f69155848ac774e937fd2297c2cd29f053ca25670c8ac61a56c9701207c085dfbdcd12f977e1e6025a2661e88761dcfad2dfd155e2a5d1a57eae51de3c4d77109493c111199532fe75af7701dc88646406e4810dc4d86bb656dac9219763981f171815e5f74f351bb8b18324ba0313679c840b43eb72dad31915483d033d8737eebe010d08609c2e05b57ae4b54c8db2b16da3fb6344087b0e229fdbbe1459b8c41815f8215de68d08eaa5230b4f47301b94587486ccc6e7473932d874e0fb6c0401b8d7e945f129b45245cefddcd6c740ee3dff0636e9f386fba80c265d92dacbffbe99237e614551631207b79534515a513a7d9a499568b1a52bfb90fc10020a876dfa437e3508899ade63dbb01c13ad794b3a542e756c5fe6e611ef13939d92dc660365bff05286e7fb69e77507cc540f808fec940f46fd9668273b1672d981224109ac19d8b2ee132c91239f61eb32e9d32794c627fcb4ef1c993aef24fe96fed87a489cc543516cf776d93b7bea0961e1298b1e236dfce8548d1a043d75d5d9a530f1dd8f41697375341d676702fa61e5df2ef2316c7628a7d19fd360c01adb1d0614210e6c60252c97f12fdcfad1463706827aff99e324f59d07f419a92281522ca67f9196fba1351799b6a8b76c0bffc0d9c582509411a45f5a5baf242f206ee60a66aee0e654b114830a9c695f661e40bacde9910d973bf12205cfd5546da99cd2f04a625163341130e435b9c850eaa3065bce0a2710eb3249f6644b0dcbaf15d73814beb4dddcc6e8384409c3bca77a0743192b44496716c7b8dd969ee66cde387fa8de9718b546f92878742b37abe788728f6852890c756019a5587c886d5eef08b05efad787df6663df78c8bc65e4040fb61c0cc27efe365e1b39b71c5a580b72207e945ed1dceef7fe0f54a62f87d6c3820ef0ba52b1819478fc95bb72ff7461f0a71cee29835a043867a49ce8e1de80d864462a46c3fb8a4ff412e62c2e55b796b84b6749b0a01b5bb52e2ec53e9e8153aaab43df395521ed97766e19082175f487050ff659abe70d6091d21bd12b12e2bc03862f7029dcc26181755f3f9ea05af27bb3ba47416936ea69ace1306998d7919c833ba8f12c503abb8027d4e9f885835c6cdee90e1fbea53a4bcab54cc12b9aba5cea02237b120f098155caf868886b8e56511facfc0a37e7d9630628cee85984c3144542092a82fc9831ee66bd7b190231ece8267c2c53d1c8c3c28c64751044e0e976f2f90172542fbfcaa4f5613d03082c66733e2b6f4838ab46ed1ab91e14fd860df260d1803296b0dba1af7571221d4c7551e380abe568e306c69b5da596388763727f02cf657d16317ea4c32ad13da020ff76745855f410b84d792592a09ff464b4dd90308fd35fb71b2ec3bc1e2177fca1bd23e7f85b4d47fa53e16aaface1952d0ca8283caed930f3397e42e22f1d219f05d794a8b87be2ba9e3a3e167150c13b5a13596cbcd888affa2fd233d29bd55e99e3bd45bb4100996c481a9501cc3844bd43edc5a831d51bfba212ef6b706d0dc0e4717627c21098e2fa9603ca4873247bd15ea5917535f6723139bdb8d4442977c3f2d3e63c374a35c8a229ed6336de8ac83a1e80de9bfaa02229ee20a6d1ae3702c42efca9c70dbd21a6866b1ff31f51d4c955b517e4c695f95037c9437f356ad5fcb7dd7e384e3017c8fa2f93ac8ff73cfc3453c6d20f76fa577c1e17edc752f7cb8bca611b4035c0d0ec503cd77e1bb02c74b04c1b2a6ef7baf0717be35bb3ede5d7be5a367a9e3db47770d3f99119b9b9a36a5ac1a8ebfafe59d8303c9966744dc42590b7b0cc9dc56c28f318abeef9ea7bd4e7d199505685a55f22f1dc9710418732fa770a03a4db16120bf1f64b305a2c5ec362768ef34e298b5a7820521ed4c0e17a5ce7fdb7a5981edc994ad02166e6d66760b1f2d4764abd118adc5b663b0a87c1dfcece03cdbdf860c5717ab27f73fabb2530cfb8250f07d672569c300285e9362a5c263bdd86d823c94dc1470b4584c6a2309629affdd78acbef2988bca3b9bc3fb2aeef7d144b0f858960edd295e8cce4f6ca491af9e717b929bc4b0dc5f715533784863e3865950ae7c8c54cfa4b950611a273c4d918b6b015a98bf96420f73a36e38c0cb7767e6e442d331f7c879afbe5f00f5fd2c3e624dd11c59e228671215d06919136e03ca3bb9c35d9cadb560e5c74f66f020d49f38f20464fde8c8c344bbfe2f7259ac3d7cf6dc8a015e6ea15a5cdbfc2fc8e0fadae1a3328b679a6beb557f8a3fb0b218785c97a5b8399126e9566409ad5b6407b9f2265ca1f62b821ffeb30eae89b7f4de4f0b4d3f7e30f71d9fea036a058cebf5f5538f83ab4fb549179e94d26db401b309a89f6aab6be5225fe392a49f64630893233be3308955e842b2d2c79464aae47c1882e4e18eeb2b2e3e8ac35e89038fd4d53c0b9d1201619be6d72085d1df544f1f66a8ea39210f45aae745fde374341e98df448a412a3c43248f92ff80bd601ea73e1ae7b04bed02f34c3d6faf6b4d81a29eafdfac0e92cfdb80a8e656f761c190ef9f2e9598097575e0daf4ece03f6b267c0a42cf697431c44e2bf3ee4c80e3f4cba002ba7b7a24379d369a17d1f8abc529f5f701c64b3e2823633cf87a0c667d4d693113b4faab055527c2b47baedf9173e801351c33a332cadc3c9ceec69990ce09f073352715571d64a0b8c5ce4f5323b06f15a19747ed9b649ab4ac50b90af6456fe1771e285c713d98053616d4e6e4ad72513a64fdda4d14925909000ab981a949a68465158a277ea8bd02709aefc93b50ff8bd81b5b1a5a596ae01b3afccc7bb74f750e5d2e37c7adfcf749174f37c53c5ceef372f37344d82a8840589f5d2790f46433aede246d1b9c4fb008aa6169a6abbb76dbfac480fe57f7f15c6ecbfd3c9dfb6b47517b1f1a51e98326727d3f0073d90051e9696734458b5cbbbff620b3a320839b6e01dfa76eef9719a38b1daf766dd9b2f4f304ae80fc24cbddcce27fa6b0255c24254f919f465b28b06f75c043298553b418c33b8cf025623d3e11ad721ae3730a22eba0cbc5e0cafe9eb6d2b3b7e11544d96710ee25bc9ac954722f00600e73440d5445859f8e03eb965ddfdbdcdc9db29c21efa08d92ae7aaf2e4ea93a80d907879878aa030b36575b87c4dbb673282438b1269d8b418be82f476c480d1bc21ec51fe74560e56eba7077bb7c889c9cf200a58bbfaff0e1b6a9e331217f4ed705a802b93b231b6384728da0e6ecb6e671a5b8c1c680bbd88b8f42f891d6d9b556ce2319f1e7ccc6987a591f4dff97521e8200f0f9b638929d1b677821831eab493f575aa889a9f58af47061eddf63b81b00f16064cefe4e57be72cdfb6360cd0f2252a409ce8dc76a8dac9e8e398000dccd1b9698f107ec084f8e0b585c9f0b349f1da01bbc5b5bee3780e106e65ca7b12616d9ed4cb9e586ae91614e3dec18b27b637ee2e6d181c4cf4b73f55bae3696a74a5ccf91f60b4144c77184c687d1f2da5ee66b5f6d242262a0536adcddc393d3b43567609c9bf4614bfb09f2dbda4588e969ec6bca94afa88e5d1def54f95d735fd4839619e064ffe059329ab0e91e2f98aac1c684e7d6542c346b967d19242a4a5bc24b3dd4f52dcc24354bf2311de04e65c4472baba1c6d0427479e234cfa1278dfa1d12b993042198944c5cc599d63ffde832cd87da5257b4571506122e8e0771d2f8d23942b28564c6217e41dc782c9da024d798afc", 0x1000}], 0x4, &(0x7f0000000940)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @rights={0x18, 0x1, 0x1, [r0]}], 0x38, 0x4}, 0x10) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r6 = geteuid() sendmsg$nl_generic(r5, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0x3b8, 0x30, 0x400, 0x70bd25, 0x25dfdbfb, {0x1e}, [@generic="3264d88b1fbb445a32d48ce439bf7bcbfce53dd4f9d0a26144d8ea76813b764a64fd2dbf89dea26bacbf87a30a2d9ec75abdb8ca2d76a291f683f0c4d0ec7ad03dda8835abafad9c6dcda661e268523737913b2d3bffae545318b0bc0dfafd48052686c78812cbaff44be3c433d1caf17742711f1e0d220cc9fccd714ceb0c32a58176e0c3aff66787908b004a45ae04b051bfae7a0c2ae0947929db0aa8bc482523149f97a7359bcae2083232beb13d5c9f217dfa1b20564974409324d3", @generic="45ddc1f681f513e3ff0a87be1f9efaf98b39fa3a64c7836941a0d9b9127852e6ce74bea9d1888b3639183389e1144d04ef13ea9050c20170bc1e4c5c6ecf2bd92d0495c38af6d1562c42f75d853495f028c5059b35998218754048399b70c9fc41ce5c9af73f48f881422df35bb5bcabda6fd7f18e8a5e716ce10f7d39881e7c949047071d3813a2a9e1556d65b00e2d213caf0f7fb4b4e5031fa0ad0b7101c9209f0d000ede54e01dc624e120738f4d63e7a0b0e89d98a991a92e9ee7588e9ba943259a8999c86e9a774becd1148076275df083854f13dd8741ecbf9dc03a52ea9409827ae44928fbc3f038e82dbf94e92c35a36555daba4358e77d", @typed={0x8, 0x8f, @ipv4=@local}, @nested={0x1c, 0x54, [@typed={0x8, 0x77, @fd=r0}, @typed={0x8, 0x45, @u32=0x20}, @typed={0x8, 0x3d, @uid=r6}]}, @generic="c5dab63d172456ab1bdc83befc6bef3a8e04d89939a4adc65fa303d325fc59b8b1af3976bf07b67d4f33495e19cb06f2bbee500568cc7a0959f7dea941bf4353f148fa7365d47773c5ce73a6ad3bbb211a097974b9fe9e0bf979b94bf316e1a44835181d24e27205ad5b6b53d9e68872e8586028d66de606f499dda270222dca934760586ad78c7a22707e53544a573034b35c3cafb34c5374719b3d1a8f4b5f5f473867a2525afe5c09a03021bde083e8235511d4f8cb8e18cf0931ce3861d8b8d0eb363032e51ab0b4486e1449259e078cb847db90821316c115d48d1df3080f1aab", @generic="3c622e515c48b94fea568e1ff73887a2", @generic="f9a85c4370bfe8c6788b5912d0c865a35e3b7f1c17102316f899687b73c4782915f8a31446e02fcdb3d87ec036e98a875625f9e708fb633f6fced771b993f077899811e1820da6cc7400c8584f9beec703c9663477f95c877b2a0ec16ac38b5d551f35a71df7da6d777849a0922ca3a0bc04b01c4943249ba5ba4db2150b380b499105d6f15cc9bb21f3d1f2d2afb5638f901dea69a370f887a3161416b1fc5214ff08b1c6b6383fb2ede45a2c48dc9b7b8fd350bd382db4ccade875cf7496ae6b8854e407c1ff24962ec6139d186b9b"]}, 0x3b8}, 0x1, 0x0, 0x0, 0x4000005}, 0x4008041) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2002.262472] binder: 31281:31285 got reply transaction with bad transaction stack, transaction 5362 has target 31281:0 [ 2002.323570] binder_transaction: 6 callbacks suppressed [ 2002.323587] binder: 31281:31285 transaction failed 29201/-71, size 0-0 line 2816 19:20:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x4000) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000300)='/proc/capi/capi20ncci\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000140)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') ioctl$VT_GETMODE(r0, 0x5601, &(0x7f00000001c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) preadv(r5, &(0x7f00000017c0), 0x1a4, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r8 = dup3(r1, r0, 0x80004) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r8, 0x40086432, &(0x7f0000000200)=0x3c23) 19:20:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}) [ 2002.370243] binder: 31281:31285 ioctl c0306201 20000600 returned -14 19:20:52 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x10000000) 19:20:52 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x8000, 0x4001) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000380)={0x7, {{0xa, 0x4e22, 0x8000, @ipv4={[], [], @multicast1}}}}, 0x88) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000000c0)=""/246) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000540)='/dev/ppp\x00', 0x0, 0x0) r3 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x80000000, 0x410040) getpeername$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, &(0x7f00000001c0)=0x1c) dup2(r0, r2) 19:20:52 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0xffffffffffffffff, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xfffffffffffffffc, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}) 19:20:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2002.560451] binder: release 31281:31285 transaction 5362 out, still active [ 2002.584721] binder: undelivered TRANSACTION_COMPLETE 19:20:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}}) [ 2002.610427] binder: undelivered TRANSACTION_ERROR: 29201 [ 2002.623155] binder: send failed reply for transaction 5362, target dead [ 2002.688862] binder: 31323:31326 got reply transaction with bad transaction stack, transaction 5365 has target 31323:0 19:20:52 executing program 3: ioctl$BLKRRPART(0xffffffffffffffff, 0x125f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000300)='/proc/capi/capi20ncci\x00', 0xa00, 0x0) epoll_wait(r0, 0x0, 0xfffffffffffffdbe, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = accept(r1, &(0x7f0000000000)=@in={0x2, 0x0, @remote}, &(0x7f0000000080)=0x80) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x74, &(0x7f0000000280)=""/87, &(0x7f0000000100)=0x57) r3 = socket$inet(0x2, 0x1, 0x3) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000180)={{{@in=@remote, @in=@broadcast}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f00000000c0)=0xe8) sync() bind$can_raw(r1, &(0x7f0000000140), 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, 0x0) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f00000003c0)='/dev/dri/card#\x00', 0x0, 0x20000) close(r1) timer_delete(0x0) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) [ 2002.741153] binder: 31323:31326 transaction failed 29201/-71, size 0-0 line 2816 [ 2002.772207] binder: 31323:31326 ioctl c0306201 20000600 returned -14 19:20:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x45}) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x40000000000000, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x60000, 0x0) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$RTC_AIE_OFF(r3, 0x7002) sync() r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r3, 0xc008640a, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r7, 0xc010640b, &(0x7f0000000140)={0x0, r8, 0x4}) 19:20:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}}) 19:20:52 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) pkey_alloc(0x0, 0x2) r1 = getpgid(0xffffffffffffffff) setpriority(0x1, r1, 0x2199) 19:20:52 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x11000000) 19:20:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2002.926243] binder: release 31323:31326 transaction 5365 out, still active [ 2002.939965] binder: undelivered TRANSACTION_COMPLETE [ 2002.970731] binder: undelivered TRANSACTION_ERROR: 29201 [ 2002.997142] binder: send failed reply for transaction 5365, target dead [ 2003.011396] IPVS: ftp: loaded support on port[0] = 21 19:20:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000}}) [ 2003.048353] binder: 31355:31358 got reply transaction with bad transaction stack, transaction 5368 has target 31355:0 [ 2003.079947] binder: 31355:31358 transaction failed 29201/-71, size 0-0 line 2816 [ 2003.110623] binder: 31355:31358 ioctl c0306201 20000600 returned -14 19:20:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x1000000000000001, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x4, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x8080, 0x0) r5 = syz_open_dev$video(&(0x7f0000000500)='/dev/video#\x00', 0x5, 0x0) ioctl$VIDIOC_G_FMT(r5, 0xc0d05604, &(0x7f00000001c0)={0x2, @vbi}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:52 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}}) [ 2003.230864] binder: undelivered TRANSACTION_COMPLETE [ 2003.236350] binder: undelivered TRANSACTION_ERROR: 29201 [ 2003.261650] binder: send failed reply for transaction 5368, target dead 19:20:53 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1c000000) 19:20:53 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000040)=0x100000, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x4e24, 0x0, 0x4e22, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x0, 0x0, 0x77a}, {0x0, 0x0, 0x800}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0x2, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2003.344090] binder: 31375:31376 got reply transaction with bad transaction stack, transaction 5371 has target 31375:0 [ 2003.449980] IPVS: ftp: loaded support on port[0] = 21 [ 2003.452516] binder: 31375:31376 transaction failed 29201/-71, size 0-0 line 2816 [ 2003.482115] binder: 31375:31376 ioctl c0306201 20000600 returned -14 [ 2003.648799] binder_thread_release: 1 callbacks suppressed [ 2003.648810] binder: release 31375:31376 transaction 5371 out, still active [ 2003.655624] binder: send failed reply for transaction 5371, target dead 19:20:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000100)={0xbc9, "44de41527f0a3342b7d148c2e0590fdc35c6ef9589a7a4f2d4e6300e35680520", 0x40000000000002, 0x5}) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) preadv(r5, &(0x7f0000000640)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f00000001c0)=""/214, 0xd6}, {&(0x7f00000002c0)=""/37, 0x25}, {&(0x7f0000000300)=""/159, 0x9f}, {&(0x7f00000003c0)=""/47, 0x2f}, {&(0x7f0000000400)=""/91, 0x5b}, {&(0x7f0000000480)=""/122, 0x7a}, {&(0x7f0000000500)=""/75, 0x4b}, {&(0x7f0000000580)=""/189, 0xbd}], 0x9, 0x0) 19:20:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}}) 19:20:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:56 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1d090000) 19:20:56 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000dec000)={0x6, 0x4, 0x338d, 0x7}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000c88000)={r0, &(0x7f0000847f95), 0x0}, 0x18) 19:20:56 executing program 1: r0 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x1f, 0x18800) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x14) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x4000000000000000, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) dup(r0) sendmmsg(0xffffffffffffffff, &(0x7f0000000240), 0x5c3, 0x0) 19:20:56 executing program 1: recvmmsg(0xffffffffffffffff, &(0x7f0000001ec0)=[{{&(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000080)=""/92, 0x5c}], 0x1, &(0x7f0000000240)=""/184, 0xb8}, 0x3ff}, {{&(0x7f0000000180)=@generic, 0x80, &(0x7f00000015c0)=[{&(0x7f0000000300)}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/30, 0x1e}, {&(0x7f0000001380)=""/29, 0x1d}, {&(0x7f00000014c0)=""/112, 0x70}, {&(0x7f0000001540)=""/96, 0x60}], 0x6, &(0x7f0000001640)=""/150, 0x96}, 0xffffffffffffffff}, {{&(0x7f0000001700)=@x25, 0x80, &(0x7f0000001ac0)=[{&(0x7f0000001780)=""/194, 0xc2}, {&(0x7f0000004740)=""/203, 0xcb}, {&(0x7f0000001980)=""/172, 0xac}, {&(0x7f0000001a40)=""/74, 0x4a}], 0x4, &(0x7f0000001b00)=""/181, 0xb5}}, {{&(0x7f0000001bc0)=@can={0x1d, 0x0}, 0x80, &(0x7f0000001d80)=[{&(0x7f0000001c40)=""/227, 0xe3}, {&(0x7f0000001d40)=""/43, 0x2b}], 0x2, &(0x7f0000004840)=""/221, 0xdd}, 0x10001}], 0x4, 0x40000001, &(0x7f0000001fc0)) read$alg(r0, &(0x7f0000002000)=""/32, 0x20) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r2, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r2, &(0x7f0000007800)=[{{0x0, 0x0, &(0x7f0000002140)=[{&(0x7f0000002040)="3290347bbba72ac59363107a489898469b40bf308cfe0cd1a63f238e219f77e6eea13a612c0ead85e01ff1f90bf2026048cf98dd2c351848804a8b843be25e035fb0e4a3a079f29e8453e50e797f7275142a42fa52254b788850b4496e6e575937ac503e13099170d7516969b053285bf3dc954bf1eb0c59537371a71c71f14e848a1671c40727f6101fbcbaa9b96802419171eedd56274e725dfb6ac95a77086e4fcfdf235501a55fa96c625b29a0a9e5ba1aa104d3eaedd0746b17a85af91eb8302f62312ae4697d3fbba2e602f81a60ba694610089729226d9e7923dbedf891aa1a3321077a24f68df7eace9dbf153bffd1b4a3fd", 0xf6}, {&(0x7f0000000300)="9c64be224a682dcc4fd52609684212a8c2ad7a2e74666493ab8ac4e4fa3a473e8035d6a3d8", 0x25}], 0x2, &(0x7f0000002180)=[{0x28, 0x119, 0x7, "1559f379da812682b1257df7b2370eb8f155fecd8e8e"}, {0x1010, 0x3a, 0x4, "13c6a37e4f721dc141d4dd2784d0094ce9ce891e6bfbe3183bb726c6f7726a62c3dd5bd24c77318be186562669a8698bc92a6cf53bcf1e2b7b125da91390188b42271bea45eeb670d548f68753958075ee330c54b2a36ab8fd0913c5efbef6001024bf9245d5808b5bcb6db10d9d78f89da2d6a55f10a488718235cf10fb60acbf417515a932dc7cac8d12e81b8e15f2baf1e639dfcc9ce9f737e3d74c85f529e1316dd264c6af55caa05166074acd009a40bb4d46785582f07ea01be0099529131f332a3ec3e81a29012e0504dbcc9b9eb6d736d91d5e919d709a2e84a40d26ea0637dc159d5c6821a883894e7f15947e29ca3634e1830b7e0c2849f2778c5cdab926da4ded33de720755e704653aab5f3e6199b0dfa6997ce8ffa2bbe8e183958266d0baabbb13a539c3f76c3796f884625541c0eeb292b7f034dc06899a6396bb2dcd3e0b68fc58b02aa5295d1c9dc724851f49f6d25a114f3a950ba77b8fef6ea68168dce6640b23558c4d3f733f6f7f7b19c9f226bf9e655cdd885e07e2a9f0ca32993ca6f0795d8e8e22846c08c93132c49a33484e40b4b509f93a4ad09c735ae97b703d8bc74d5f324aaa8160f23ba97640b3968f781fa1f7c5b0b7305bc3e065330092f787c3698eeb5475add26e1852e26ff34a4b53e6978243966f82a0aff2979386a4a2a607c351f242874ac6f3306ec0b8908a2923a77fdb77ff631be8df7134b238ae7bb9e06e8fdc4b7f242253a69dc35ae7db496890c713b4d9d4a5c62c5c6a6a7e772346e03c1eb7276d861ba4ac2d95e28aa5fcc4d5d7ac0ddd55ce1b42153544dd6d2b8e3e975254ebbafa5cccc7d8f2d7ed111728542f646aa3d59167b7132eee77bf6614f3645d798c117c4bf5211c31e94dfeb7a2361dca51c891fb7d0846f58bc685f2e9d00c16e60602b7682102d706a11e3a0faf2fe51b78b250a41e97373b099e7aaf3903a8c80c8ce5283b94da124ef141aa9184b2ceef4bc13ff15ae6d1ae943ea954d231684075d7880479bc927a8a4b0035ee4784c284bfeb9fd85e3c01269736516169da8ebe347c7edc867d5349461b23b9b89957f61e158230db8f2af24cdb113f1f692e58c7b7a2b74f9799ea04b8ef6ab34f60178fb8ec5c15e04e435c62b16bb10b7ee38bed08db18a5a7eaee6309bd5f4a9bb901154f3d6513f37cd96a55d6d7138ab09f4d94416d2660a31a9a710c7ac607e88faa3adf48bff27751d4b36ec50454b4380034fc2d9033a7479888e6c44946bd385e9a5bdf28558595b02699720b11b7438e35f87ad1924f1f55808c39e324116ab3c0d22c7c30ff3bd7d6d3b504656e84abb56dd1cd47b01a099ea7a92a31e9734a335eea665f8e6480191100cc98e17280dd57b6c3590c9b2153459c64017c1bc70262074bb5fef754c966210b1ef5cc0e2c538e67353b7067d2c4bb5255fefcbf43cc3bb8c7fdcba60e5f622eda0b8dad8ea2d1d255dbaa7c37d41f849d2febbe3e6620de82ed60b18a5e830531cf0ada044042ad6392d9cce5521aa3a31169308faee2dcf6992d75adcfb18fb95b71919f78610d92cff3d8cd71beb785bf62d7fc0ffa4e95ef7f6619962ece6da5abe9921529b14fb98a06ad88138b31b01fa37eac1f74716fc5ffbff66de0eef3eacd412400dcec2b5c41bd04ee412754cc78d21366a65fd0e672a96c46333ff0d942a698c03e9358536a3b41768a96cc2598d9a3e490335ca47f661834bba77ddf95666447376517309a9ee462c85d935f7ac6d3e27c494bf66b2e692ba366b9e53dc9d968a96af00da683ae8299bd6f9aeaa5638f9706afeba96b7b8dc8df3a2637541ede8aaa08a85d2bc12d517a9b4a7e08747380679485fe4f693d60fa74b7ef37fbf99a68ceee95a0d2e24589f1baaab2627c43d3fbc92b2e4e2ca861d88ee70c152c36253db5512e66680986d871f3c27a078bffdfab0418eddbed104c76058f4ca694399aa86fd0cde58ee5fc5d9846a8f678f5ac1c3c725f94926ebc9d287e9751c65f5fd2cebd1e410899ef083a0ba738f458c695b217951779f1c7a160ba4039c64a7a6a587e24324e1bcf9b1422ee57b2b5e52c07d90145cb3fcecd5a94073318387bf42c652b617b79dfdb79f1468d9dbdfbc7573411f07480a121947341a475cc69a176f8674c4fb5d06ca60ff65698a9a5c8e47a39b3e707421a4f587731d74820b88a5115a5beb152855a953f853e180f89c26e2b8dc533ec1b28d5bf38cc8c02b5d843eccd3edc163cba513f47ae985f22b8fcc1dd013b5600e6fe41c9b27f44639befeaa082a75d98d2b348cef434f1e4c4b09194421513850095944d5d66a95be2d93772781cfb0ab56baf2a2982994b32cd53d2175ef0d761d98856590acf79028f8c0238a4d8ed2dd6607348608cd5809e6eaefa640a81a7b26cb4cac44c9f6323d64d9c39549f9e70b58fcfb6c9e084eeadf39ff3c7b82e294ca0a76c40ecda90ed8d777b5e714b06b37ba587fe7bb423d30b4f6e63ad1d9ef2227ac8193c855b225218c84c1af4a7d9e70445b2dc4be23e9b8c408e13133ecf34eaf1fc100425f1c34ab42ddaf4f23d086433ec9f1fa286d04d3b90e8ebbfdd77eb5649aa27a6d0f4eb589267e2fcb83c8218836ee3426e8f33f7c2530693bae9b19fa605a6677f5a9b70d541a64a8ed8d0616beece177db280bdce95edf192d279fddc4e0f85dee30fdd60928e750814b4f1eba8ab4c16976cedd4eb42b1654a92f7702eec04af985c09189a89c355cc2a54d4faa750bc35631032c0f9430397988615de03e7067835d2d6fe4322baf7b4aa6f50b751fec35ee9af592eea174ac8695e39b052d43cd99c5060fed61fc49553897d5e39247ffc341987f0e2587ada045acd38d364dba53f779eb8c4d7e77b405ecb541b739c43df69add434e1a0317fb00b5a6f148cb75bdba235019682eacf1e03e9056bbc021881876efb265540e02819054b0401492c170ada314c7a34e61ea0de399644748c7a27da23a12d08ebb9f9664b8fbe4403646863fce9539257678b7fdf1a6761dd8b249a1e7b6521f01af540e3bd3b63d342282b2c76d1eb88869ebc3b13a416fbf989684dadd5a0b7a7c4ec9719547482298e3d81f813e3f11a282bade2b0d4b209ff98cb8d074b6eb76fea91f13edcc1a805744212f7cb896ad98f957b498d4958d694d770175e5e055229efc377df59f365c5dd1441cc61b591060424eb9ac973b239872c79cf64cc8b0deb3b5c23d421475e5056a1db67d9db6ba7815e40b0c01e502479a2abc7dfc2ef2b6910d6987e071e89c4b156fb6035fa0863b47f7f1409cc82a23eef2bbcf894d793e337618acd8e2277cbdd3f5bdc3cd8575370add934a9cc54c6434d23a4fc018baf0cc1a76ecfb30ba673bbc704dca4e71bfed31677a73331d3448e676bb170a3641b8eb78017d726e0990d903a98c6b30a77f4bb2ee708a361283432ae458c30fefda962db8521892fed24258b065b264c4c37d63021f86aa9b389f7c18faa087d21a9f4b04926a45e69b65d8687674371fbab5796f607158bf4a8d87a5f6e788a27eddbe64c9deb25094a07b09e3f862f64b44536162b28a7383d90a196b69d80f4b363fd758f5357cda35e74dbc9219f6d56951b8a61e8ee27f046ddc2721fb73117ae04410b1c2d4c1b179613eeeec7f985f2acf236d38c1bb5351187ce443c51d0df13dfec46379178a81a32b8568f1750e97bb0e79d52d0380c93b0a0b4fc93e74b92f980b3cf07a21977bf6f9dcf8e766f7ba3b1533d2523c62274f1309e76d9754c793eb61ba3629251711c2ca67d9d16267c3e2d67c0c22696859cc7fd378eff95603483d84746d510e7dcd1a48b77d03cff264f921ba71e8bd795196a50b19f3a2c0b4bfd011a1477a0aa116a5aadce8ecec58cc54f83ac9d6944a3a7453ed382c26cd900137b4794b673128e8621764334f9728cdcb10ef347b794fbb28d4283b70f3f0b995366bb4f79677133feb2fbc803969fc585134805cd08fe61165c095d9d58b37892cad5723ebcad008aee43dcb1237a8c516d4185d665ce21edebb88a0777a0eed0473b15acb9de05c482199a0c65169c5e04b5066e157a63399747cc068878baa914783b31fff5ac54059cb672225f96e76409a2297f73670c7e8d056762aa398559c12ad7a5b01e8be342ce1b7ca5465f5b262804006408086aa548f30a0ba61b9e626fddf038aa11c3a962b4fbc7266bead211738bde6632e5a0f00accc24de3abfa30beb1173d6729466d5edf908b6885c5e8440f2cf9122ee665f5a525d2dfbe45641d4f1a9c006cbb8b66ce0134452a8c21e6710f37e8fdfc65be2960b1023d154f6e04e13289bd647c22b9f2959014f66657f6891b27aefc226c610056230b9ab0493f04a9b8ac521072284d5b510d2a43eac9e39bdb713ae0c8d72cc593020b810c06c982672302e3b2aeb0de7f72def2b22cae9169c2f8a8ee6333bafbd2e07f270e83d1f85422a8b4f5b0690087d6ea5be9310c5b5947a7d3a06e7aae7d78f891f079f95ab970c3d9f47e606e96e08f6e13f680fe9ec22e15530e1eef7a8ddf7f9317b5f1831b8ce546da43b3af4f0323d9831ff6a3bd2a168303693fe2aa42af431954d5ae88514448f2e614061feb615d27f1b3b4a285237a83f31ebaf6e215ea8dca0f38aa25935c66e7f97644e12b1b87a89b96ccf00f3e16470a551268f38bfd860825fc22b4504507cf8e15aa68d85593d2c3ea6fc820ba0caa08b5a177c25137eab57dc2ae32b18402c075df53f184427d3b6fbfe9733cc8a2e5c39d56794f05121fa5345355b3ded3874ac31608b957c4eadb1122be4803443bc2575a2460ac44658afc3f8d29b8cd43d8ad88256f992d02b2bf01676e4333d6f914a709e9bbfa9f35f8ca4d2dc0e7f0034f5e601166e51243783a79e24ea7aaac8c494d19bb021738cf942cef6c22a580fcf5faf7514d384f22155e0084572beb80021986d825925a2f4d751aeace4985d3c222ab26d363b4f0b4ee81783fd531f791117cb2d4f583be01c9c1e24f45e3fbe379f39634b5819d2f9e0281865ce521d264c5986c45f980ebd6648132dc6785f4d1f2306ba81507ef769d28b3c9bed45c8016bcbc1930494f58ac239270f0fab0a4bb6365d11b7267d30590424824922f6d8d85af38c6d58eeba782f32f07aa0f65b138020e84635db406b61ce9d6b9c7f83b42152866feca1453d9183ba11a4de33f875b4187f75d3fe34cc468f421ed8cce2846801325e84ec3bf505e1ae4de8ba4c42c357ffecff713c0c3f372105528e27989e7f5f627eb5762c1869c5fb9f7df827dfbbf2633c7e6ea3f0225a70a79cbefa56fe10418c6c7010b2e1646693425e2316c3a2dd0bbf0c968474217c43b1c05e043278de4324fef0e1f64a00b88917a51972498120fe7b05ddd25638efb2ee419504267e409e1b631d55f09fa5683bc3c296f0f04ef40a464dd1e16c90e25c7dff4fa5950e15cb12ed3b51f328372c9715f9e54c3d24ccadd895305e43e6ecb9b0ff6aececdbbfe07862950adb616291b7c29d514a533b2d80598fa360debba5dff3139b3a2bcd54431943f911c8b0d0600982e1e8421fde1cedc19dc9e1a2a3dd903352a0fc3e60d3948471271cf4b64b540fc98241765a513fb705e2d90b7e4d269d35383d6e6480eb688180f80a76364f817b46fee9c9d83ddf68319a424e708f7feb45d80b42e18b0adcd7a12f9f1572fe26b8609fbd70543bd4f53ef20816765047bfd7cd7b96b96a077"}, {0x1010, 0x11e, 0xadf, "244394918a67b9c4027c0a56ddd91b5d854c7c1d697257c5e48d39e11c566222812ea84f9759bc851fd90eeeeab1e0397434f82b93e4af48d1599b865fca4631ae3646bff41e9f1d84b59b10c184367fd7d4a3801dad254cd14f425beca7fbb4734f826e15fd15ac7826668e3f8b8ccb283d5763730721af50cb6f9f0305f0c0a7d947263649e787caa7b36dd1c88dbd97027ffb584b6b092f9f052e31cc78b4a0f77f842a8acee840a60a95acbe0bd50f6693c56935c6875a39f2cf1fc77e80545195d0ca62c22c084806d73f9d2bdac3a100666f00553d98a9441d22399d3a9ba35879057c18312e465959f2e92148f4171c56016535fc8ebe40cb2c7becc85a4f2ae80d1ae34d5e29427d361a65a5cda7c18f51b09a80abecbb0c7b85e4942975f1ebfe6d8a1e8ce69868f863c09648635f1589c4297875e941553001761b5579153c5220c9e198c168bbebffd6cfc32887dee48c30af0535127936241231adbceef3c284912e2e888117bbf5a25138308cacdd240104ec1d8b43ad55549af1f01c4c5dcd57020c02fa425423377432714aa7c58b0dbad495843cc1d7accb2b629e8ff1071a38c52ea78b58827a2ecbc913fbae009f731bf27e0f2da7f418c1c9c492f7a2e96943307e23645e599b0c61589569f980464d062ad4b35879c9f5eeded969a52a64007fb77e66694c0f0ae7070eb902143c4894ec6d5562474fd9abfceebfd4b9b8d275064e82b494fb4802b38ee124cf523bfbc6c65a2d9e7f4af18fca865065f8015f1bd3bd28525ea72267491be1d9112787be9dabb5b2138669e5c67a8e4027f54da3acecd0794cbc579138f8b42790628f5b246799edfa1257ba11459d51322b0f8cf0525182987d29d957661a4976bb68699e6e1d182380e07f23059aa921ddfa0b76f58d8ec8cfea1baf310c16295ca888590d9b54e5aa79303ec564a8927070a546c0f756849fcee2bb3c1654ec88078993335437ee7e4e3828f8c3ac189a8181be9bb9731c55182d379918513a34b3d08128541f007554888edf51814bee0174fb9d411511cc75e93725d5ae5a0406aee94ade1eed06896c329987ea55e35329992c603857b56c716523865c13f2c44525160135e84cded27ef1a351d79b42d20563850762204a57fecadc8efda2457d3d0d5b63ee02009b6cc63312085881e1b087ccfea72ba2bfe62caf8acee53518cf28d899d39ce7409e53db0186b9a50c913ecd3ebaa2d4e70bc2e01dfc1fe61c077536e6ab0d6f15d8c5f138d65c54d061012eb46087dff509e72f121e0a1e503b786ba9e442e4276dd0faeeaeeac5637359e36a170e325714cbf513adc882e9dc6ad32804418dc2a53fce458274091f4489d6a66f1e0afa164cfac7983526c52e13ef54640c72648a05f11b5e3c2ff524a460c85172c0fb4d1aec0b56e0733d35d34a0c41736a04db3e3f0d7488ab92066bc50ce9b719851b3338fb0547626357402078f92179ff68070cf0a04470e8a9846f9d414aa4743b7772ea9fddc517865edd4ffc50ff23c1a3f5408e7c59c4e3a75a6a6dd6090e546edb705b9d44ef3713cf1bd75227907ebbe5675d44ec849b84bdd3e1d64f7621c3222e3d817f6b67bedd4c88ac319e6e5c28d81e5c3abad930c7958dcd74b831b99f03605e1bf27b17b4423ac96ca670982757076cadcb3d0bf1b7663cd41d2021f78a513d45e9cb0d47de7d6fc8449cb21c273ebd54733c2dec6ba62e1be529c0884400ebdea78d62a2f926509e2d00b0f61ba593419cbabba2b8244f282296971b1a7706c58903c0f84573caa3fec0b2c37e7bc686b9fe2c29ceab10562541f2922c967c123fc55ba2b38b37ef427ddedf509687c820fe10b33dce124eb099815947255314f111fda3701295d233538cf9bdd8a051c1b4c773ee1b7139364896524f44952b420fc1c64771f7433ca7dc583054afc7dd1b974c27d044c38db40517f95a2289129a9cb9a620c0a8cd67c514fac97f5485cfedc63f6dd2032f684aea267a64da78c83493b6978d68e07e65cca75be23fcb7948165b6ddd8952d21f23f63c3c847cf415a5c5534d7c7271fc237e43f64ad728984b02805156d4077cd0194625d95be8731398791543f3ab1bf85fa155bb40a9bc1602810646a81530c21526c3e47c14266587fb097695f29086c9053c6939e2e62a1054a621b7cab5c67146feaf6224d2542d1039d2fc640f3715a19f9b56c99b0112d29532058e78a67886bc4cf634ed65174a4177d9b68a9cb7835449399671c5f4e2d291204e3f984f9d4bde8794fed3b4628676157588a4c6d8ef2731aed4ceb0ff8b7c5e6fe0d85e77b6121e1d3b1046484a432c94c1f5b83dca0a32960939fbf0c534e445d9b0b4d88f97dae3ac3dc2906cf6c5d25d8a79a3d428bd20229f008ca19bbd4f59d528449fd176df4964edad956d080eb887803a29c12000b2e8879ba3c49e35942a60ffc362b29605e4d4aeb2efc5303055ee7681e0b38cb008a165edcd75ad4a1e59bdbc4737585dfe51ccedadb6403c87ca81d48f218806ddcbc3cf2796b7ea1ad7064a2634462ac4a87f1ceabe6ae7dd052e9a71ec8f113efb5b2b1ffcbced543801804728b96b95286271c232b685944b0cc75807b2d6a68a6772640d71d1a414bd48dd4df98fb739bf85d151d211be14152305ddb3becd7fc4b9abb70708b53a42ea2fed8d518859e7eecdf93c4f306ee53fd7112fd079df5997fbdcaded081a0c52bc1b3039794c91c3f987713e9789552a504ca1579b5934c9a33e5c24adcf0ece16377fe66a10f7cfdd439aa7892ad70b7ced0e2b7034327122220d25b1e1a2c43b5bbcba58094744702c644a8ef4e05349319f5c4552a7b2e1580f1a56cf5350f9a8e81f66a02ecece4cda7af1793bfd88c1806eb96c2e55407fd56333c407065184372dcb311840419992db685ece51224ecd922c45f9d6f1f23a3a01242a08f65a5fa3a9b7109f1fca17b54cf68dbcc0f0e4d06d162fa819d763799aba0ff1446d2d175da194dd07579ef79aa9512782c033249f0bdfe13d9b0798820512c58529af08ebdeb997b510c63e1d56dadd41f8898f635aef1af45c71e2c7b72a32360cfe94e8c320d071b1664aa48c6e568b528cf52e5c1f22e447c70a8e34d533b1e54a750cfedfaadf18c700eb85bf3600c50c4e96699b732d4c23720501e1ea2a9a291e72b87f759db7e303deefabadf6d165f6b649ce7b29b60515ff6783772d2ddedd1fd5be9d77b4b69a93f9a47c0e1aca871ff241ca8b1da6b0a236190d73680ae45c67029c5e4e375ce46eedc826513620b467d5dddf772dbd3b68223004b854b266daf7e99b2122902977a60bbb820a68440ea5de14cd15350e09b3d5f4194ee3213a04dc5e5a14ea431b8e9f13cc730be22170bb74bf41b9cfa1f4775bc8eaf8cd1f28c99fa783e59db0a084b2153aed03470ad89471fd1a761ed62106fa631fb7c6ccb14daae1062dd47e8339e9e2a51f503585dee2820b5e62d44ba385e2442eeee1f074b758861ea458da1164a318f5d0b78a61e6217c3b2e6fee238d1694a87e58696d6a9b54e0ea41b8fb596ba2fecb507a524ba4ec1dea4268c8260bdf42480dc8039bf59d9e5491d4c3cf847936549f62dcd4d96369a2c7bbb48e00359817c21f0e26c530da794296fb82947a198ed925be6b74e93d86322824e30c8f29fcac450943c2bcb11bbb6c61a31499040d8cd942aa3c79607cc8a0b3a4a2700873dc732bef4706af4a063b967487084f5090445b34bd48ae4b21df234afa3f3dfb61b254069aaa189df216c5295a163dc7f519bcdae18409c8b897de11b9e3a413e629a3ab264a1004db9712ebcad135e76ee589b0237bc03dc5c2f166004046b32d3ddc7cda1cb5af89570bd6aa824f0dcf1f8c7b50db8b316add04c06d8ff6af686c9a28243ed3160cb1e6ad1c79ef97984cc5df4d630b0b1c77c4faee54651e9cc12bb99549788c40ceba551c3a3b626af10fcaa583d1738843b90e45907715fe7e7ba4d5c5e928d8c880c0dc979f348bf06b3198ca31bc636c3024a10633980476dca26e52d8e93428f989d9c2d8f777d5fc0f59c1233593e9993f81336fc3ab048ef945cf7204f9d6ba7e2bc1634a3e6891d1a0e93dc8587aa4a059e36f51ecee939390a1b69b1347315a6aafa712d8402a82c4d6123acef6ce1adbc0f035b0913bdf6a0afcafd37419e879fef14af2fbf7b8e13453c3d9d0b060ceec0b3ac3cd409d9a67964fdcd88f6472e361b76fa1fd1d36a9bdaa26e51ff6cf77a178d76fc71060ed8b2bb51cf33eae70d60088fddd98439b5daa3712ac4accd43fbc49e6f7a6e57a378a8f5660a79f0da49ba37aa3adc5f3ab4dd8e4539d994b281d52dfa86851c327294e99a75d263b612fa060649c2010f35917fb5596558416f79df85a078679b572755fc69bc69fd2831256c2808e8c3c1a51fc4f05681c0be5bf7a71f1acf716b50956b91eb9b7880e2588d8675caf723abfad65bab3c4d925694c8e56017b63805e53fc391a72724876ab5a077cce28e8c3372b3ee993ab5458e284ec3e75f1cea6309ae3b3dfce7d0ff33c7758ca87c4508718bb598272cebe1deb3ebf917f5aff6f4538681d3c9c7e1f01fde548b2b82fff228aa4afdfc36ac3a897c84e47b0c1ec0e790c0d3e97919449a8946ab644c3942dad225384bc2a2ba803e254a0394249fe761b02bbaea2d2961b22a6b8fc4d80bd61e8e6c1d1d880f77eca7ba234a4e3bbfe1fe959f83cdf5af843dcf59107525a15ec1deaca9b3b8989dbf426ff0afda87110451cae4463d8a76b9185d2ea3a59b4f02cbe6e453e1057ca07187de90c526c3fa37e76d7cf4516757d6b9ef8c365ffae31cd868da12cad2c46d74a023f6e415252f96415d57d27213337c7ec8f779e3f4e0a76bf534ec85955b75c11bdc00401c28b232a54f1ddae62ab85b8406f1c1722a27a829dec8147cace809b0a05447dbccdb0364fee8b28fd5ad7d5a40f9e1bd86f298a11b3929f9ce4c600615a8c394cc1b80395466c6ddb8815a79006e93afd42ef28cc73b4b3901a8ab9dc7ca7ac149d76b821e48a3836187a09f2aacc63273c7f7ce26f3083b9f594d5dce52f444a9e3073d59e2d288825c919c3da8a76c161316703efbbe6cf08abadfb910985c21e72c778d4cc25389e5e12b6477546500165953b0abe22a21c14284be1f8c294c761e8e9ebd54b7554f0613da9ecb768c0d155803797da9da7b938a0208c3a10606de7f23d4cbe209fef4558d6c3c66849975d70dd04a1d7a6ac26b32b3e3d11d11dcd81d4dd559670095961c328210ca84b9d9b469dd5c417b5db715e29d39f31c8025a044930b9058e2e00c5b80956e237fcc5a6f0068c7db92bd2dd2a108d21e6d5e4193061c885a7fe2b9f4320e4a0199a888284e25fa92f454273bac8097b51e36444cb7f3b556a11d298d62a1ee25b94a360a31cb89018e94f2a13eaa0c3bb9f7de0557935712594f76689de240d09f41b6d667b6f39e7b5273de697b558f3c5b1ac84269d13cb3fdba8b35c0a7f489e707cb620c672e0a8112d637701ffa3372b572c64da9f6994e6adcadf8466a0e2e067b650eea9f8d41c3bc8d61160fdb1b0787b74cf2fae0c92b50da924dafca9717b1841e520aaeceec9e708e3178efa3517489627a991e67f681b6afb80165bddd99ee46d145915accd02cca0827f1be3b1bb1b4063107941700d5ba026be692e08318f080308ce9c42170b02bbf80d7aedc7243d536a48a2701d781b04e039"}, {0xb8, 0x119, 0xe6, "06ac07ca6e8b6530e68de4616fb55f8adc6b83fdefcfe68b964ebcf07416161693f7ce19ab832e88a1769065bcf9ed46eb59ca4dcd52107ff15dfc7286ee84a0d6a0dc119e3a87db410485e177bb1178e4daa481c0386660144027cda8bb8355c7fa81376a82fbb5ed39407cd352dd908ab3817b85a75cdae65a6f74467a15f2147db4d976800d8f3e76b7c3bcaea7b2893842c801a06c5f4a7d7addaa9d9b3bcf"}, {0xf0, 0x109, 0x5, "44336134640f370948acc904f33aebb23bd2dcc8782baf325d680047b32413395e7596be98856a8d71d7ff537a8c58c2fa9bb099cdab1dbc0e0db0a67bc7522ff74960a45f087f55991868ea7e8f9fcaea7a1d73e1ad2f4a38d1620d010209f6227ff828e852adaef7a565b4293af5fe42c0d3cedf322a0e338558f31816449cdceaf13acf206d752fcadf517334151e2fbb379a24fed40c409f32e68371487705fa9d2632a58576ba769920bf6a3aeb34ca24ea75d9825f2c87e50404e59c6aab389f4192ad73a95615dbca26176d7d512acbfe65c7314d6f20f965fdd510"}], 0x21f0}, 0x1}, {{0x0, 0x0, &(0x7f00000046c0)=[{&(0x7f0000004380)="a9f5e3e689ff775d6debfa953e67e22b087aae2492fc5e49b9b85350f8464e0f3512f1335e68c3c0ec448f98db1137ac80d7203158148a1bd0b8899257af15d33f4967fd0312bd323292d2876e96cb8b238878ceef5b8871062e66a676cff8b8b77f2cbfbcad72dae4382a8b68ec97e3934d803314b6485bd0fa858e4ca8af6194ae3babe670", 0x86}, {&(0x7f0000004440)="2bc62bb4f2302d13891770447b590ebc0144db3ad350cd9cb46125a81f48a4aa863351da22286e3c44cc1998726888785ea8b79d19d8ed", 0x37}, {&(0x7f0000004480)="59098a6e0e6bb9cec738518c412802ff51a5f71f4da48083755244055d1b57cb909a34585a204fb65825a541c301980953c78dfde30e24b8445121fb9b3c7309e5ef330cca06f2f14dda94f23324e47dbe288e8459d529fc7379190b63ec41e10f39d3242bf2753ba818f3c78679b70da72197a83f933f211f228f92b2322834fa17b283ff624ace7ba6d564ef49bf57f73c7aca81efe1398411a6d9948cc3f4d7196cd6651ba4caa1763e669a2d35bcce119bf1a63b199c3ac3723443ac9841ba1ec6f11b389873b03e7e061761db6160bf20ce93e7f6c44c964264082d66", 0xdf}, {&(0x7f0000004580)="0675f5be56ceeff8f7e25e7e432f2978d81792054fe63cd130bc41d726c35bb8625ce3a5ec3f55e6e752a94f86c6e16200acee0793a22075e74932a7dd2b3947a43adf20725fb59f61788bb50f70e2d53610434c5a1ed6c69bd40ca2530c3e68e5bdb81ba848b7185e619bcd22f67b2e663907682c2496d2514e69cc45a3e7f913c24e7dc09fd6f5d9459349f045c7aba37e5dcb3308e91bc149dc6144dd25149fe9d20b92a4e95170feb3ac97250a0a6f32876b0f4ec292c85c0de52da6e0f6b4d8376ce97678ebf4", 0xc9}, {&(0x7f0000004680)="3be886d477b5901e6ef5c3e7c54e9c", 0xf}], 0x5, &(0x7f0000007900)=ANY=[@ANYBLOB="10100000000000008f010000080000001bcdca99cfa9e2c2d4c22bca5f54524561c8d965737d520126ba7e32e362cd8790a534f3ff51777c2324fc45bff0af9addaa03ebd6eab2fbca2fdb4e286813508f585ad71101be2cdd2b7a8bfe9548e6588b32ac517f51e319cdbf5612a5145cbcbe4d6fb5a0b2f6e1644d9a89ef2e153f173418011ddbbbca80abf9f9ef0910516f6da4b0d16e3517c35fe5d0f14bdb5fad7bff059c74a4c136f35de75f92776ccb9649df186066cf0035f21bfa3661ea1480e0fb04fe9ead818c2d8e5d854b756b97a5b21282f7f6c3d7f60b4c0c3a26b67c153d173a38795d5c295685fb80f163ebce6e7a0dad61695cf092f757be22f04a2259f9a3a7065a160db6af4bc853bac68ab3de15ef1c0cead406dead51de4fc8e24c53a8450ca23dd1a0c4449b05b8bf15df3efe42e25f3f8fd9bcf65a4b857d4d5fd5b69320edc67383268addcf9a791587c790ee1566699ec15dacc0e9d013789e031df7c550dcb90a04adaac2baecf1cd201338dadd1a559977ae42c2c06217762a95704cb05446916c4eac586e40acf118afe00ab0bd7d29b530e13714cb26070db41421561945cd239a9b61258ede00b28a7b386357694431923a549805dded19f880d82fb6d5539386ec705bf7567e0c484bf8cc5752c86369289e81a9ff8b70cb9e9f3f7bf0546de7da5d1d31ab7b761ea2649ef32f7aa4efc8c6944ae5e131c98a6d003f52c9d88ba0af68b7f6c6d8566edb0e4332cfff8cac0c31e0db299cb12081c1f63b45059159e8035ad3527edb14545b64d09afcd129c8ab99b5c9b8766a2b59d82a84ab9e0595340b52c51465d50115b1ae38d1c238fc38b5afeae3a57bb9c6deb599e013c88db36ae22181c6f1b9f01b3c0d5c4a0e729b1f606e202139f35810fdb766fe3ee8f7b46168eea7b99549f5143741062b575c5a1697a4147a0fe5ffe6e63d05bf3991ecdd27c63a92409ce117db160af22794d2e05d5196a449f7ba690f598d4ef8a207ba7e9f10d9e526c93fc582a8c503a573f873f2c712cba4c55142d274ba970c265ad0f9a6e262ff254be1a0484787d81d3747f01be0d958fcdb8f0d1b5b945cdd2afe4197988aa3f25a4d003976b52f48b3fbc57603ef673bd28f544a0118a3d693edab94a8e458b80188523fb80f651997ea8cb64e71b184ba55957dc38cb4790830d665d7d488496a22db69c1f6e056654b68bc6b2f1823675e839916f2c3c2688effd2c287a39be5934731f1185695b636cac6d293f7c2bc0052f74fc632b1ff9e6d62039932e8e9baaec04ac4654514371f81c7a75cbc783bc21fd5c5d171e1de289229e17984c04392fdee904c0a8ae045bd00e31c56eb1c89c0cdac14869f01718a7082634c53e1bd9b500f5ab97ee513105c893a6d5bab132f01344452651123d3d2c38821ef0672b3abcf63322d67850ec7387c45f36f7b3baa6c16b61de9d26c534330c1400c214770f3993acb43f7c270c7407845eed3eca9d1ac865fbf43106fcf47ba0335f87ce983c1a36203b84a33e85f480c6e702c9cd54110940e092f1af365e1ff5f445e4357d7995a39f960d3d713db1242ad7c1829aed71d3da2d79779724af266ea30a547d39eeb05402054847ddfe1ea25a119f57229e73511de1b2ef7c75cb8d27bc0fa5fe87ab715d88e5c715d6c9558b456fecfb80a299df483dd580bf54afdfa1c0d7a805cc484a44bf0bf2e1ea0575a8ba2fb2e2b0ca63676f0fe58644866973368cc74f5bf22aa7dc9926104b9dffc8347c3bc226c8ccca6a67f4fa49db23e875e8e5aea09259de2b8c36e082c0c32ec3dbb405af4a2174e641a9320097a6e633e3ff7146e7f76b64afe9ad19a9a6f3f12fb54b96a54d0a89791803dc89699f04f45a5f9528756db149599fcd6a9b314f5a91c745ba99bad320dab2aacb6b7b375f378588429e90973ef40700c7a9ff2a03501989cd192eb76c96e28127b2432487261d2e2b4a6c7ffb545da46b0eb49491e668b9799e904ad3c7f68332adeb17f0e0a1474eb664fccb3b21cf235950874746718501decac16a6dc8048ff19aa37d5350473e508249c00bf6979e314eddfcfe30f5c97462bef8ca5c165d24873e137b265f5d279c96db3ba59b640b65e6619cb1362212643b0b17c1bb27a29c0e98cd7f342ed54730363f88a66bd870458d07039129b4f7f5b3d84b29a2afbc3394746219fb1a2fa6aba05b0a9c9471a77c4def886f8eff81a97517b8e35ea7f9acc793acc7ab05ae304ed2c51f798ce34a1aab61d255919643685a06f8955837727d784f96a71d32977001aa5e86123c92c10612af17c2d3935304d9153ea938cdb00458f5f415a2bef0f5cfbff25f5dfced12116f224750fb9b97ad3c3996e0aed806944e1cdd164f648eed85fc6b4f290a2181ea40659b4adb211605178ede00ecea112b1f0c4c0f2b81f2dc51843590ef272a64a7c8296e6f32553aa895bc07ebae8507cebcaa9ce6d90e707ec3de50b1fe776d4eda8c13410732b3200b0be4e9483283aaf83b50d1e117466d0a890a2970190377132cc0e58428860d9947ed82c34bdb6e73f3e8a5b2509f5b59ebe687352c8d52793f9c31f4e1741fcafe6ecb99e1a3075b88b7b9b0b5b8bb9324357efe6c7992157da32a88bde8f7ef65c8f8cb3dcbb0812ddd33eb1aca276933eb781cb2610b8d5edbd980a95134c9f63c1417ee0a1a7c72bd406cae70193fd8ee1946b996008d9ebac2dd7f395f0753a84c824a86cce380ba8b68f2486d88e182761dc13df8f00df0f20f5a58f133ca76ae8274208ad7948f51dbe8c00431922e2a76b72a49c678e2e1acb9b52f861b5bbe1d5274c127b38dbc139d63ff3d37a260a5282398198062836a0bac5b86b4bef1f94d3dc24ba5b745103a8c03b75252667e4a114e6c629928d67118e11077dc5a60ae6995b0d338b78d1269c4db96462e888cb04e2d6cce44bc1f7516897d671cd6925429f9446b41cd58ecda062c9b2ff1bc04174266a07964d85854ba3be1b4a32d41c0d24bad2bd0f486593d6c6cdc99e4e2b3a644f6185d8dca865afdb85d8207cc90b2290f36d42d3dc2ec46342b9c776d099c15e7d4f94ffd2802eca081c61e54abbecddd9d97ecf8b632417e43be6490286336e904826187a094fb6f0ab5a4684b3b878e02ac6de06b3dc68b7cc1318bf35e7af7842af127793d0f4232736cbb4fec8569d8b16cbc047d73087dcf7c84bc22135f15694fd70aefdc0fb904e344f0ae58f4f160fff8179aafbee083d38d935d9680e85b15421ad1b84f4c77a9691d9a6b8e2b1bb2d29d16a1670384c55621cf2f426b0cc7bb0f80e371f4b3805b7cf8ea5397433c8e38f4ea2f558433d13ea61c9572748088e7e5eb15d36285670c42a3389190bb4562ddc45561cdb69454ed9331215456f22fa12aff3018655356b79eeab868fce914624174ed8a1f6a45c04e6b0418484d08b15b01de0d4f8ec89243cf988ab20b904c385b9eee3fb07a1951f8665b70d4d82c0b4a39718a151146306ac42f5c88e0d480738bcd26bfe5aa07510eabfd92aa5169ea935adb4c08661bbb5432ab0a57422b1898ec097d48dea7484757eabbb36815cf9ab84649684cec9eb807b1ad5ffc72521d7a32ec34feaf4af45bc9e12bd2015e4164a45e5537ece86cd12b2983bd0fd2b5f3a1e32f967d5d3ad4c0d258a8626f746609967de54ceb560870b6e8373344271cd728750d6b4dcd92ff8814fdb3dc28a2c1f61cd46d51a5ad0094304a3851942d73d3d37edbcc1f12a99c65eaba1ec600275c5528264abe43be2bddb5e74977ccd8b380c385d3a6c7ee137281c95e4b8fde39639a3b90385d052243355c8b039a1156c12f32cd3470e306b5dc3ded0ebc2ff082b5b68dc95ae1da123488d7d42e644dcb663c48c851e9e2e3de9cde059399b7621eb94e353be9b08ee09585770ac7d4d81e5de0b4a42fc31d33e2bcdea740b52c06ac44d02440a0fe04d6697dff587eacaf25e121199f62425b5b7d07c1e27e17bc8cb1f7523c251ef25d7e2f72f0a7bcc02f71035df89456830f425622bee1dfb500560e9790d55fcbb0e02ef0eab5c89134525495df7ba6c446ec490a51d7d6cdf25cbebd9b0712c4bca4600c306553a36545bccaff2b65f88974c93d86916e3f0cf6d7d1e546a31741cda38b66591b846a815775fecdbcb137ec0d081845ac4b171d26d35617085cb12ee27f511cef702fae14b8e5ed083e4b3fed88f11d997467d45defc645e48a219faac55084ee25e6e7d2205d018b4d23b8f03981cb055a40e4b1c54b0e5525537a6814fddf77b089bd667d78f271d9f26382b68990672bede67b66afc00f459f81ab1e57bace7dff1290510918ccf94f0feaf81479b4ed19fa107da28046d2ced73a2e71c8182f1d8b5de4f4e67678dce0d8fabef91dd88b83a3be684fe681ab983e5f9007b076fd47adf953443d758b4b98753a5302a52ffc6a06433f78191654567bf686d67618f6b8789ec6d91422fe09146a85ad408bc226e7e472d875cb4f786b10b627db9c37dba8a43dff1576c623ad21d43e686fc089d83ce6f4e0055ef8e4208d430798e4b0165b7b04cc38d9d1a4757df14cd1c55b154d1637308fef6d515cc49c653086e7077c2c309e98e7afd211a5ad0470a52b904c2ac77286ab85c8fd029e8b3de7bc9fd8bd901e839f0a364e5169a340b21a6b9fbc27de54f60da40d5acfa9e912675e6d659c4d329e3ddb1eea70750bc86d723b1b5d45d1132e5f45dfdff135e24c0a60865ed3b0d46ad3d5d3e6d17d42c7479573d71bfe53fba0cf97176bb93027d3717583d94e8a3f7f04bc0e6cbbdd6bfe9a415903df094af0e3e6f228865115f968958ad3962e1638fa1e4353280058f4adbdc926924270f9bc1755dcb19f201f7c4b05d7b81172275ce06b3831aadf6c7e0409aff595c71e62ea6562cab4666953d3bb3bcc4e694acbf75b356457925b1d7e3fb16098d60209c91156929e904a40b30eb0b5591ce3f2cb03996c1858cc4e2f33825c4c73062b3d3a1795d81b2a5df8ec0f5e93b39e0e995da5a854cb12a6e11a414d661e5b432dd19951556af058a7ea730e427efeb1a6df377e47022da451efcddced639e5ffd00676cdde8ca83b658810ec15ca02a4b2a20d5e7a78708b5bbb25e18e968a34d94608ee3c0303a175dc97f811a853136b2f55224a6c79380bb135ae9989739d33a0d7f5c3e7517574a9813ca015f6a98d41c12a6deb889af6849aad04c9801024d50ee85e54deb1426a6176b3d2ff2d9efd150654d885f62ccb16fe671022f0d67687fdf9422b0bb7994fb9e1af161659f956f34caa998cbecd19012ca6fd1927d643c1cd03111e69252bf69ad3097a709ad18b97674cd1928da002dc43daa2aa6afc137c10d0a3d44ba488fe9a4ea599599e81fa0580142d8e16e4777e42b4190f68a587b268dbbbd532b2f1a83c9347ab36eac7ab8168fe86a526ba3dbc34e1c1fbe554e8e59d4e088a57cbf75440d01810c886e24f55b28ef3c848a49b2b8c6681892878044a8d44f41585f37ca1cf0d522994f6fec51e5a2cf7d2527e000d09c17b983143d3fcdfdb198b4a771ba5835c5ecde698064ad1bab3219473f4a8a09fe6ea13f4ed883191e15a4227bf7d3ba93a5cd8ac1b22024fa031c0cb70a35a9117848cefde33c0b3baf6585ce3d7a2345ebde2e6409bf489e369efee8639e15e6753e334f139f82ffb65bb47e14f5a56485117deeeb1d249520636957ed73cb4c48c8f2bfc2f0e0fb7255112e1552d84aa0a43f0103ed3a5a000000000000000170100000700000043bbc8e953fc79233eb7687054e2ca38894cd7d1dec0121145cea9b1d41fee6bb6b15409dc36f5f96a6c6e7782807118cbd9d674cc52882daa27e24975927a2bc2dd15a7782f02288d3006e6ebcd3b53e715efa11a55fb39265aba6423a8d99a807d6d4e3f53e7be6cebf384ee329e727661cfdaadb152704a48211b513aea7521fe8f5abdd07e23382596b6ff1a5e00f80000000000000000000000070000007700068629e63e607a21f8bafb604985d337a0f87ddb84fec4fb90696f4c436af69084af97f8450e575aea1c3029f85f997bc7fb0ccb53db7e2a76d4a534c4e6cc6cb75e42b59d2fc921581249fd250563347ced43099c128558c7450d77c84842e858dd2b7dec354ea7a98d8d86b010fb22ee52b9518f801b0288e1eb80a2763d658eab3122e5dc57f27102c879931b8cb6697b3c6c863b3d493ff40cb87ad09b14d66b8afe9041bc9f247bfccaecd6d3448080ca6f97fa40ef6c2b8befad45dda73f6f8c727fa42ea2ea21540bfd37cd6d05f04eeb545a027f041275f991a3f34dacef0000000007aa4d25965befc9017118aac7b1bbe71f9f65d9bf8f09424732e874a463c60918522be51c08d52e152facc0bb7d83c118f66eb2cdc6e598178c7aca64d3b4189fce3c8da2c434e5d5e207095548f98ec230cd0893a6b1c4a6475bff6a47005559e7df008312a2d6f406478eb8f0f4bebe1c3ba7bf53292f55de84402ffb7338ec"], 0x11a8}, 0x6}, {{&(0x7f0000005900)=@in={0x2, 0x4e20, @remote}, 0x80, &(0x7f0000005dc0)=[{&(0x7f0000005980)="d48d82230674194ec58c1740279262a42b949dc29714f485460e58b0bedc3d26987c24b2ceb2c785e1416173160cc8d1c0da6b82fa97ba859b14e00d64dede15a12ca5d052be6b54421c67e1f6de48c9065c08b5ff76eba64aa761999f8e494aec24a7b37abdf176078f0e04c7958bf1b9197b0004d0242c198a8d3be85fd276ea9c3370f6769f9635044dba0c34c37255fab8dc513bea588dc0e4f38239c4ca09c5bb55ceb0299a64f21d3fc9fbb1376c584eac32098cb1f0415a1594428152fa73c97cf6b0b6cbcf0b85", 0xcb}, {&(0x7f0000005a80)="dab608d9bf280513ebfd4517945157ab09f00673c9e1661d4206771fda0f3d570a0c5689e0496af2fb1062c42f6fdc5ae65ce63935adbaa654cd9363d5c35e03df17e07b05b1262e024955ab77e57b7a7a7894cdaff2bed13a4e40ab310189585dba93e7bb789a8d1eb279662f9311898229a19a881cd46be103a7b6651bf8da00dda5fcea754e75f691eaf91b8140507d9872b36f282de3eeebacd1d147d7ff086b42a71f08fcff912816ff0ce989c65a87812288c8446fc6b5b0c8228581f7b72d6007cc5c6956101b5e3010190de7b2ede8299feca137085610eb039a90b203e5221b0eb87ad4145d17513627dcdc810affb265c5747b4c740acd6dd801", 0xff}, {&(0x7f0000005b80)="fb8800502d06acd8b922c4d7f3331bdc3feac440cb7b51518bf049b6373303fb61093b437582aaf8", 0x28}, {&(0x7f0000005bc0)="46967894544b4b9598c33b8e10e6cd4f2e001e1785816236009a9079984e142d455b5844ce830c07f55f6b0ba989c437ea6420a91c62b521bbf0f59fa85430f91d55e45bdcbfa65db4093e816c5f68d071ae95994793fbcc01c67b", 0x5b}, {&(0x7f0000005c40)="d89a3d3832a5d46a271ff0ea68c4bb1d023a4214a3f5a82d0f76063d226934f9048190241426a0e7665aedbac4857269777323f651971a62eca4835ffef561c991d68764600d595a05d81f1bd4aa5338c61206f855b0b949f0df9e638cdd53fe7185a2", 0x63}, {&(0x7f0000005cc0)="ef09cacf89766b4a1bec2556febc68cd3a237ab26a9599a765ff97095538d4407bc42ef8f7c7cc9de1dc07dcd10bb6a570d6f7c7157bb5d4de1270e4cceffbfe0cc01d5e0af39e1c0eeb8d32254248b000ac9af8c8a250ec7e5141e2e470817012f84bde2cb0505b49a4d478e045350f4da843340c084b6851c11d168f966e10af902b9787d933fc17c72e40377460f0b1659ff0c8a7054ee3318ed8accc94f18080c8a986a71a48b05f389cf841184a864f70d9461fecb21a6795e7b6bc8f1b8975dc0234d87771a9e02b050be981cfb988a3def47bd977ffd8990b85ac797b39b5ea0979ef41029c182eadcf61643db255447a26951166954c5347", 0xfc}], 0x6, &(0x7f0000005e40)=[{0x38, 0x0, 0x8001, "d0b95da230453f9629d2cc890793611af90fe0c417ef4e5cac43f6d95c4e582e221c8b4d"}], 0x38}, 0xaa5f}, {{&(0x7f0000005e80)=@ll={0x11, 0x4, r1, 0x1, 0x400, 0x6, @random="150a757ef3e1"}, 0x80, &(0x7f00000070c0)=[{&(0x7f0000005f00)="07fc345f22b40e01c352afb312606c43eec4f74cbe19e4af01aa6c9af99b0b335c28156b68ab6c1360124f376c830087599df4410ad34dc3996972b8cc6f0d0a832c6c092375d6af08b43cfdfb38b403351535b081bcd9cae41a73e2b6c9431721b297c58d7ef75185e7ce93576539b12a963bde9f804cd665ab7e3f9697f32a7820c5dada485aef445d8f60e558e832fc46d667a90ab91a45c00e3582eccff40c3d6575b26ce5020739a8da7534648f59cd849787965cf64d1d1b32e4c0562feb85728ea560dd71c8d12da5f0178d900e7afdd98e1c05315c31513b012f", 0xde}, {&(0x7f0000006000)="bd17e905a980eb5a495ca65bb0a737f82a20c225f2183f6877ee7e7a1347f52bd70a564fb7334f7ae2ebecf8584c442922e959b5207176cffe762a667cf606ea54c48e561452b8f07d6f9b93f162d8d13e041c4839b723b9d1e846ff82ffb55c38af6526d6c349c1a62a8f16d662ac269118f93b48b71e600960d6f5c3db04efb4677793662d5a3bf613bec0e37993726a576b3d6dc32d61d38f12c7636d841a7c5759f42e16bae6153caad71e7026278fe8f41a11bdbae0f6c32f50adffee80df77643f55d74e0cc641d7de0993e93dbd9c9e11aaadfe4c8e8818b3bb5351417335197f3d52eb12d793f7341998cea195669d94b14a5e418259d084e59266080d5397e413c87fad95e73c447a1fe4f76ad54696d40be5290c9ea0218245b89d8d77740a784a8e2e8be5a7988795986db5fcdb0fac5a6395b97914bec4e154d88b3de36995e588651d5b226d5d5652544283e7abe16241ba91000126f63e3ac1cd50f13c32f276c8476c5e2b67d084c14103c4709b54b62be3cef965efb56aa85af13aae494a7b7010bd73366206cac9e600269177152e05a7910c59cc16d5bc87d6bf17aa80243fb00afc96c8ebc7210fbd622c42f1b02459cd0819e429f45393990b69f1c1c66f1cf3be6805b03403b68ff9211820bb697fa8f7a02120b59cd482291c09fb33e51b21e07dec6d7ee77c52d499cb13b89790162a8f274411ef677040e6efa18ebcd1e23f286d178eadde75fca19e2e0e3fbbca6a28146e2b215ddf87b27cd6131ed2e614d486119f862125fe0a666f97ac49bdc967efb7811edf44a23bed1e2235c35f692b4c55f0ced664cb006ec741bab7585c521053240f6c2c88902bcdbc8a16375bb2cd2d3764e18f75e355725beeb6c5e672725dfb5ccc97537ca3ebcf9916cfc752b134df8d92b4a75b20bf1979e63b23f02c68f11f8e75573be32f05ac754225fdbca4e813c0a31ef9cece39f628f70a7f957d4700d174e438f08cb3564fe8e4df7b9050856b8dd454210f21d0d0f3e9824309a0e86b2d235f4e735cb27c3d69db19b59320f340c096e0365c06752de943eb7187fa3fd54603b085faced33aee49ff4e6ba1d75b8b51a4aa81847f0032ec285b986d2543b55279ed3ad48193a874bcfeace9befbf132607a23a1a7ea9acf27d75213bc3ba43c5d52816e3f40f2e200be5817847dd953864c60a48e93e44fbeb35dfe226d49dfc8ee75d7a2f39dd771f54b8fe5b3c25c9c11f6c929b759ddf786cac5dc5699ee2de4a0e6d35e5e6d080acab158a7a7ffd6078089122b8e8b33050c6aca751d3c40a92537d409a881467fbd34a27520389d25ea96ac76691b3cf665b564b1e051eb459680628722724f1a3f880395e47f8ca7b79725484ed494e639ab77a63c1e9f9c80318d432a4b890ed387e991be9a747d790343899735f2ef711bf6b3576b1704760d1171c3b12eb39396b8a10289f461aa549bdc53d272f4a1ff3ae3c57c136a199e783e68389d5c5e4efd1e64ce733456ba7d7933ca94719b806be817fa2e93603ec28768873ca6bfcf6690d5705016ea11856acf192612adbf87c463c8f414083187cebc51664c603c731e0ee70dd72e31a10c1bb2459c16a86e6d663f33af2fc8b03d8bdfef970decebdb60005dc590e9a49cc64d258928aaf5fae3941ef93c43e87c57dbe124d4e2cf96758c048264dc90305bb9d46a8e29602a064c065aaf01ce08283748745b4744da9536c446334c4649f994cf4b760c205611876a5c40ce67ec9b00087473cb5f1e015cdeb815676cb13357b47a2d61fd40cca1ca7a29ee46698753dada0331bf15ac263951fb9e041bf0592f75b3640b9cdaf315a8b7f93d80bbcf62c27a0c8c0f37e68c343aea9161c0ac413e45ca7b207db242cfe6d2f7e6544c7f28918ec12c7ff8318b9ad56cabca54f9c4a0ffa5ad9486f54be4be4b73b3cf6892b3841b1216077375998832b9bbe5acffba857f287088d547abafc44a80d7b0f285d5a3609fc6ba5750d6b34b0db3b641abc9288f17bd52de33d02a967fc60b7da0ac27ce4e69e07f9dcbd7cdcb158e3f22f74f18753e7a795906cf2d07ccae1ff974dd2387a25dfd23d9b827e520be1339379dddc8c31a652d06aba4b6019e99fccfb4c756e88eebe553faf678cf0614df3d417d5b420603efe970153279d672afcfd71d796ac6b411d565af84c44a3f8f67e39f66986ccfd25e26268d3f736efeb7f9ef1b679acc3fdd428b5450b59c6df1b3c92ed6820c66c82dbbad49ba15c52f5b3abbf230bbd22a5c8e1c463cf0438842199796fda798ab462f5df8078c5b58a0a73688e7a09f809a9f4526c30991ed67e08f29728c1411c69af258420b4eb8a3e3f7e3bc2b022928f71515494b73f1bdbb5bce5a1a96135d1cd24a597610115afdff68d33defb83afab0a5d8b83d28718b97427ee9b12499941f3262ee7b96155e008216a8abfb13ebe04d69c5c768e14362bb528cc6d4174406d4b8cbff2413fedd2588aa4ed1a371f2dc8bc743f1ca975c75e1cb2fcecf51d15af3daf7aed3b70960c46ae07f1acbcf06e4649c0ffadd697fc476b6dfde8de7cd38a587d34279d52bdf9f1b19a71fbb5d8aea7b1f0d0b7786c3db9ba6cadd8b5cc42867cd10b4260c8f9773d379611262c4e877c26f28db856d59aa1993e3e2f6214022029def40d0e8f8469dc737888c6ebbf066f47a9a4b319f99dd00556fa8e83d161efd9fc61b5eac77a6738646339687d5c9d8219639b3a3fef90f7d44943edada341d3cb38c59f5ef02bf2870cb0ef975b6beee84f5b3b7fb3b2beec918378c3d583b87920ab81771e3de5479cb311c73fabe86e6d5cac2586f4594c39040ef9a6ac981091d12a263791f24f8bd16639528b42abb3003bb7a79682237fe5a2c746bc018013df57f96069b9b675f9916d246c649f584da1e71b0ad22987d25ddd979338180c77ce8506e07c3aea5e072dd25b10a3cf0900ca6c6be5d2159f687b92fe764f30571a82e959c43ac9171a366a94a6bf62c107f81e3e9acdae9d473b84ee0e993a2397e2f0fc817a72c36b0a806a20487ac9fba566cc35577fcfb6d72ea550fe13518707ddb6854a52445562fc9e72b754827c574a46121d001495cb731049314c7f485ce5b882cc4818582621d4eb4d3b033f2a036321c2078576a52155df4776b96533895db71148d21c97aa538cab10597cc28387dd0adbbd77fd417deb66aa301cceb80665baa0cdcb3e15826244f6437a9b5c095f16e51332775ef26b4928f6df374b47318c810b79754e5f6575a7f27a6a32f9bbaceca4e15ace7a5c6cc0b2d8519849b8d700143ed46babc963cd25342bc67b30d986670e097f0238f2fc59adfde4a38b03aac213a7883c644d9d4d0a076fee76d9da06c68523a6053cbbb97f1ff9cafb8b2bf4d7083b22c4a695718ef5d0d9dafe4e0d1bd84ea7f782f674cbbd3fd8c7fb202e6768c80f5cc96a410b31747b9f4b16a4dac233f7e0d3805e09b98ee05748394eac01f265adf1881209f9f613e6a22e5c1a785000c8e84bba87a8f686dbba88f3348d04690f840a80a2f3038eb4a1afccb38e77744ffe510b10e729cbfc4044343ad49ad3975ef1d4700c6fbfdabefe8e7b7e8fe94d9b0a95927ab74e906bd7d4ba8dd33deaaaa4646692fa0a23d30009df4f08f6d89611396998982841586ffe7c20f6b6e8c9c96cd85f45f185e1eb0f1dd580f3bc6b34f74b6bcdb8cabcbafc906084b1bdfc033811558476d6fae94d895a5399bc881ce5367a7129a4fcd37b63fae198356d8a5d908a1acbe4736d89c26e9b634ac11e640685e64d14b55c552afe336f4bc68c073f381915badd8a989a0a574e5e8d2074d3e48b38b6686220eb3566dab743a4984627f819ae05d5807a20fff10ed8152ff50ae6779e697589669ae2704943b2476ffe653bde5b7a3fda6322656722d5818880b988d916f5f53fa01cfa3ba470dd526b3d4bd8fc64ea0fade4d414d3ce4a3155b4e27c12c746a49d436b3688ae39bfa5ede91097e15e89dbe3b28551640997efe0a11b7ca52c91799295a1f8ef9dfbfd1075331d15e7fbcd9ee21d92f9d63b9065bbac26afb63d2367e338b2bebf82a7752cdfbfcfed73ef62effae6e2d26f5cacc5f3580652b2d7a9b90f647a975f79643cc68191b4c622653e04f62052af28c3c3a2e4979c6e3e1a64c707f6429fcd011726ab1c6a5e99f06c52482039f523dba42955af9e402236cb8bebda3a8c33d30212907f38a60eeb6c17630d13a83fe2e3a4d9fabc88a553b4979459a425d5e4c175ec768161b532ea034fb87df4afd72d270e79e198a2727f3ec173e0b30cfc58d3ffbbc0c763a7fdddbbf28a86e15b8494123b00ec021392d5acf5d83427699b94aa7ed1cef4ae1c43824335d2b62cc993999b25db8e44f3468fe216fc9b7e9552cb3958ab18ede28402f4007525b90cc5875150bc969136310f6779d29b40306a9ab51b34bd1ca58e3348412a39f60588b7848a7b572d4d8aaf4b59755956c0990351d5a1cbde825f209de42ff7a1a59536800dd5ccd95e07ce6308a1f52a59b59de3a571ef21d6c00bff41be5d85cbc3d1a7bccad35bbe585570318f899aa2af129328f8a3bbf343a8d110a50d6d77fef60bd323979710d991c09d9db30bc7670263cd2b24189e85b5f8503a0c130976d231918fa5147ea08f46f7a60dc5820ab1a703ebffe0c10c6f4647c54e45b2b13610a7062e4e5f41824438a28f0b099a7992b521ebf3226afadcead32aaf08050a33d56ca174f75005c9b32447e20b151dc975890df3ac162c117a97b62457bc48b07908c803198704d0567ba27192092a61510ea17ab609ff49a8cf978dbc5331e169b87818433e2c7d07f7081306ad6a060e666f09a2aeeea8e339560a724d3e3ff35f4451707b3ebe99e1407cd4c2ab1e7bcb74aef6e0f1a49e9907a0c680655410d8d9d26a897ebb71e9337a657b93cf1b9c2dc356953b37ef9e2c4f9dfaa5755600926ccb67ce30208a194a33f980aac20598d5ac16f9f47fc66186aebc0e9ec20b4588efa67c08882d3b2349a4833c803b701176c6d0b94c1b81a1fee7aa5fe72622cb7cbce699d28ba8405843207ec6b5f19a55c24e95ec788572afd395362b6a85909ac6c49ef2b0c7ec24e47b9ba58aaf9b78370873be62fb7519198eff62180b8d226d8a0cc477940ef847681977dcb0c5e0d5899f6737c73715a4443b5d5312344052ffd78dd039232256c203b06e66846bc571525fce23c1b6a0488fe19cab62403280f5a57eb7fb5d3d8696db1c3d36e5836f3f33cf9a4d326c13fbdb026caaeff6587b8739d9480b61457088dde58f509dd1cfe5bbef38f31cf02e4a62c97b5df5e084ad38f4fcd8915c8b2711df14bbfc05b260183bcedf6a799e808eeee6dd6a79f2a664e0cb3c4c9fb400a12d1c58fb95bdb6e5b2f6f72b5c3ff763973e69cc370248c5b62451017ad3489ae2261f158df74eefe9103f5e4f03925e5d0263f792ec33af745cd9a23762615f83142640cf24c90ed3c152f7161d1b4aaf1e4c078df029cc388d7fcab092eb6208dc9981b3d1d212bd46c03e581f2fa61b10176319c241e642c0d18f46f96d395644af3b2feaaaa87f31382c9aa77061d35dd4619f2486a7b02ed6c479be18ff8047886c440b9d5ba30fa7a5fdffafa32f56bdfa53c5aad6313c566ccd64fa7c8d12b4df40013b1ec795ab4d52af3900e628bd7d1ae9b6fddef5e66d230e84b97c6c2a4c9ed3ce0343773a16c15fda6b735f9", 0x1000}, {&(0x7f0000007000)="f93a08510817a88f569f53dd5d7df0f188bbe15b74b9190b08cda7397a5d7a717a6fa6018628afa77dc2526edd3a50416a06515442ef686d0d3eaf7bd8ded55be81582a1d19c00911193b23f9295dfc12b2a5262308e840f96da6e862baa249575204222d75e633a6489b5c15e51cb0ca1bab7e27651a2aa7c91e2d7589702b865d7a531589f0ad2ec5113070d25609063ac758e2a466c57263e2d9f10b63da12ab6294a415a3c8303", 0xa9}], 0x3, &(0x7f0000007100)=[{0xd0, 0x116, 0x74c2, "6247cb2b512791873216a9b471fbf75cc5079003c4789bafd620d56d09a982ac81ca0cd75b4b6cdd16441f9fc6d41130d9f8551fe3edf7aa7dacf85a62eed04ab201bccaebb423442860e90a4b0adac6c179268d30f19de6f3dfdc77c95765407d6a01dcc304a9652650621288112298e7269d43587a79cd39623533562b944da95a084e3b439b15f9551ede57b81adf2b30fa3a9939fb5d6bd16f987836e89aff8220153a35092779360626fa89c41aa9ac3415e5050003d04fb194"}, {0x110, 0x102, 0x14bcc769, "1cfcf38efed6332ab343c8b07776a66468a9263d8f44f7d1223a47875423ca5af243294dbd936d1e6f6f041ca88a3117f33f7ab3bb0e37ad13e395312ed1f09cfff8c9408f8af4dcef1063468e44b2b30682ad9af3eef1be76080734609cba14032dee62783f5542e514008959f517650a57a168714c174e0ed69c39d5356125809a65a1fed05f43b779438e2b6df9ff585b646a2a04d5f8b7e506336c4c4b4a06a44244a0a70d084e954fd0c3175a529faa16e7b305b2a749b174140615e8ab29c19c058713dfe5701cac1729807b4930c9bf4b6db6c0976129f8e542333666bcd98740088c88eddcdf9d062cbec508d5abbf40059292c2e3269190"}, {0x38, 0x11b, 0x0, "040cd9d7af632cf6ea515fec5bfb0b15e2a58c219e0c5f8b28053a4526cfa1d8aa11b4d026"}, {0x70, 0x115, 0x1, "546ddba59b1a29b11daa743aca9dddee2097ec6f7135613ecf8ca87e764a6beb0b1bd7b347a866fff41b57e45f22b86cdf3f05c6842d67c4c3492fa22d745aba9f7d83e1f5cb3e2b84ac40b04cb2deeb746d1723c7256a8daead82f215"}, {0xb0, 0x116, 0xffffffff, "0fa80dcd5f6187cadc88baa97fcf1c236b1f74adecc64c29d71425f19a3da02e9e713f71eaf8e4dfaafc6994620bb19394a483248bd6d1c6e1a13a08603b6ea9dc333b14ca2533783abdef59ea832826164233a2dea64809f2efb9a3a1b091e4156ae734d1629e79b85f267e0b0924b9d2df052c05d881497f0c5a151b4a78264b0930b6a475db3745dde0255b9a69ca5c989db27b0f6aa05aca27ef053070"}, {0x110, 0x108, 0x5, "1a10bb801f29b4eefa26ce57c040a0be9489cd93f751d7cca9a4710448421e36cf1a7cf81fdca55884010b9db2fd63b162400d0b828b8f1e3c73cc7b32ed27beedf3e51174c85d9c9f7f2a006dec222181fab9f9533c7e4aad7bbb55b04bd49721b8722959aed266a59256a7c04e534541e490ef0a1b893026990dd6262c1b8e0eec15af4b90540639f613a7e2361032ed8199a26a976cd6142f0924225b36157d5be4c933cd356d013797a53fcefb2b2f20c322c536ce732cba85784286b35058883e8a66b90ae484bf80cfe7d71445c36ad43a8521f2cfe2947b0ab319b866ba9cb8723e9bc6c25715c97b235a3672986ed6c5688ed0cf87361fdeba08"}, {0xe0, 0x117, 0x1, "2fe22422ee0439e141a14bd79f995ec0d000138a6065a4cb6e607cf62447c21e0890cd00545701dc5c3c1a047e67ce5dbe46326c53d50ec21710335401d9acdc5f4479d9865b0363880d0ec39273d1d66a1d07ef8e840f90f2301a3722c826c923c52740bb67ab4b6960d8284dc92a4b05b40e139f8e590bc512f7b4ce65b9d3540e6891c6a99f7004b853dacf3d94b685a8f29356a42756b5a603301944efc9294fca04dd8edd2360264ee9e76c45150e04f707c699d7b4eac942f1e1593a92a168723e8faf8b657e79d9c807e8"}, {0xd0, 0x0, 0x5, "422dfe364636b5877365b806e085df9908f5a419aeac45a2f6922993a157d3712f87c8c04991b4e612bbd9fe8403128a4737dd09deada80ae3b664b487c067bc9907bfad55fb596c3dc5fc05eb0ca9e5b125847bc76f4a93cc4ebf3542db8b9cdfbc8297b46e49c466fb71c241d6f330d8ea061664c4fa5ecfc07ca0eb518576131e082c3877806df7a5c1dd478f4d18985e85276b0fee71cb3b280e695ff136c6c86180b5cda64e2b56a2660b7751f09919d1948243eda22c9fd04055b884"}, {0xf0, 0x11, 0x5, "14e08516deb678252210aefa40ae64f16a847fff16d875af96968980fcbb4d12d76cb6c4455b0cdabb44d9d45e7b1280d49f788f9e5a1ebd787a2dc4691c0d219f696b13a2d9fea341dbcf69cdb30dcab67c8adb62169a5df5ecbed8e6e31946d98d3868629c830291f3a98df71704e1a197331b8437536b1285c144c3e8912dca64864b8b9c062b266d4245cf48ca3c00b8d0af1fa37364816a98c2178d31a1a895c9e390794d240bb582ea26853dd0fb85d92ccbd92e716b411821da593dc98db1e59f8eef8b66b7b56adfccd2d5413df8b84c3dad341887f9db7c"}], 0x6e8}, 0xffffffff}], 0x4, 0x0) [ 2006.454663] binder: 31408:31417 got reply transaction with bad transaction stack, transaction 5374 has target 31408:0 19:20:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff00000000}}) 19:20:56 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='mountinfo\x00') preadv(r3, &(0x7f0000000800)=[{0x0}, {&(0x7f00000002c0)=""/226, 0xe2}, {&(0x7f00000003c0)=""/245, 0xf5}], 0x3, 0x0) [ 2006.503416] binder: 31408:31417 transaction failed 29201/-71, size 0-0 line 2816 [ 2006.543049] binder: 31408:31417 ioctl c0306201 20000600 returned -14 19:20:56 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1fdd0100) 19:20:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}}) 19:20:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x8000000}) r1 = syz_open_pts(r0, 0x0) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video37\x00', 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000140)=0x0) get_robust_list(r4, &(0x7f00000002c0)=&(0x7f0000000280)={&(0x7f00000001c0)={&(0x7f0000000180)}, 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, &(0x7f0000000300)=0x18) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) fdatasync(r6) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:56 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'hsr0\x00', 0x0}) syz_open_dev$vcsa(&(0x7f0000000680)='/dev/vcsa#\x00', 0x0, 0x20000) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f00000001c0)=r4) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r3, 0x111, 0x4, 0x1, 0x4) openat(r3, &(0x7f00000003c0)='./file0\x00', 0x101100, 0x80) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="58010000", @ANYRES16=r1, @ANYBLOB="140029bd7000fcdbdf25150000001400050008000100756470000800010065746800300101000800030000000000100001006574683a76657468300000002c008f713c894f04001400010002004e23ffffffff00000000000000001400020002004e24ac14142500000000000000002400020008000100090000000800030008000000080001000500000008000200000000001c000200080001000100000008000400000000000800030005000000380004001400010002004e21ac1414bb0000000000000000200002000a004e2200010001ff020000000000000000000000000001eff100003800040014000100fcff4d20ffffffff0000000000000000200002000a004e220000000000000000000000000000ffffffffffff020000000c00020008000200ff0f00002c0004001400010002004e23ac1414bb00000000000000001400020002004e21ac1414bb000000"], 0x158}, 0x1, 0x0, 0x0, 0x40}, 0x40) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) uname(&(0x7f0000000400)=""/252) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000540)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x64, r5, 0x4, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3b4cdd86}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@empty}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8000000000000}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x367}]}, 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x20000000) [ 2006.655961] binder: release 31408:31417 transaction 5374 out, still active [ 2006.667682] binder_release_work: 1 callbacks suppressed [ 2006.667688] binder: undelivered TRANSACTION_COMPLETE [ 2006.747675] binder_release_work: 1 callbacks suppressed [ 2006.747683] binder: undelivered TRANSACTION_ERROR: 29201 [ 2006.761336] binder: BINDER_SET_CONTEXT_MGR already set 19:20:56 executing program 3: syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/uts\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/uts\x00') [ 2006.795697] binder: 31445:31446 ioctl 40046207 0 returned -16 [ 2006.796823] binder: send failed reply for transaction 5374, target dead [ 2006.826602] binder: 31445:31446 transaction failed 29189/-22, size 0-0 line 2896 19:20:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}) [ 2006.862821] binder: 31445:31446 ioctl c0306201 20000600 returned -14 19:20:56 executing program 1: connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x8000004e24, 0x48, @ipv4={[], [], @loopback}, 0x7fffffff}, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x4001, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000000880)=[{{&(0x7f00000000c0)=@tipc=@id={0x1e, 0x3, 0x3, {0x4e24, 0x1}}, 0x0, &(0x7f0000000600)=[{&(0x7f0000000180)="36173f18f1309b3b593c33035bf4d9ba7048a12b5656553465af7af8353938b7d9e403f78b871f1c8447a43bd31d3ee960446bc15c8f5684afcfbf3d6bd97b9c8a61a5b10b37dade078ac7c6eb0cfe207049da39d7dc7c979faa2156e732e3beaf398875f743ac34701e480ecde5055b9064732c8dbd6a8f35c1065be705b4bf221e779fb741af5a7a27c8d9bb308189d47fe2e6e3a14b38364dc827f7e8025d774b28d208bda5f419da5322ef28e20aa2247f56791d546f8e347933f8e7"}, {&(0x7f0000000240)="599438809d18bc619e85e760772460c0abec"}, {&(0x7f0000000280)="c6cad0513d8cc9ec60e4f21ec2a0d6e7115c274cd1476623d7fa88ebbab69360217ab145e262ebdb23cb245455058a0447a55daa7218053b08538f5c4e3ab39afc652c95704b54239b3387a299fe3ac97e6b1902d4a288a775c1065f9f308bac4eef78b6b0bc393e48c78d6afad8fce79613ea2b3f159fd8bcfc58984964a113cd5e277e873254faeb5ed19fcfe177c9e5e3b9733cd1121a3b8920"}, {&(0x7f0000000340)="5f158a7880856e1fdd5a16229380979848ae83bca29fb7145ba823c6d8ffa65049b7e5c379f7c7de09573baae41cef52028395d2eb15d23a2f905829deb244c827559bddff1d33973cb572a9229521f1bc1af4d5ebd580e6136e28965633db"}, {&(0x7f00000003c0)="05e0862d98037e5992e5b9287d899e18aa458bcf7c873ee665aa26bc165041d9848d48acc26235654c5b11a127"}, {&(0x7f0000000400)="3b0c6a6ac6a55c55d96b70a2e26cdb91a298f8d2a82b6cd69553bb37668b3fa38ac2bddf01726b3992f351fc1b465ab383a8d75987d8cb9b2b542049eda1ead8bd0a7c9205537cf8fc9c8186523484666e12093c01"}, {&(0x7f00000014c0)="96f21498b13b953d4e269b5b81e2272db45ca673ca2537cdfd4b92336c720a4ad1146d24e690e77f310ec024c0413d1b447767ff41f3289e32328b61dc22edd744ad277eb1b2882495ec4e41bdb2eb0777abf3be56c62e7f1a357d0c6bba6c124e086367283c0cd38a0cfb482c017c4211030d96c2aeaf27a92997f23167ecc72d4ab5ced3924db08780084e06533400e366649c0e602be950e09254f6736f4143dcf54e8f1e0ee7cd9e689ccfb28a186fee8090f8a1df3fc5ca40e49dbf8cd633ecc504da620af44e04367dba09a3913755ffa7859327066d5a13fb6cca5ecb1e8411149cf12d6c0faaf5a9a0edfca396b33fdb0081020c526f4f5ef4f12f9fc320f1d78bdd39cc0bcbbc7c5507220fc4264f62d364d592a27abb0ba6d605c2613cfe407105eeb639174d66d6f419800cd8740c54713d366ea9c570e1fa8085e3d1e161d73ddabeb21d5dcb767cfaaad49c4671e352c55582bd6ad57411acd666484bc2a0ce901462d3a8b9dd7ed4a79b6ff668c78752964c0b926967095c9364a483a52e0a5c32e34cc94e068c0f0f8e064a5b1e1d4932740177cf2c10aa6faac78254ee11e3c0bc3bf5648e2503c76a228f3a17b674a9c4cdbb9b330b68fdc19284a182b5bbd414b19fc1cab02db46d8a20a010dc9010d5d432ce8138623577f07d7c3123acd14bf92a8f82aab1c47544412764decab2f95856b80cd65348ffa755669eebd63d19bdd916045046090b33c2d343676fdc65049e65a7c2ddb762805db6ee13076054605abd7e111098b5b3381986ccb8725f1070d43ea28f44d42d2261ae3f4afb40eb3bcbc45ef27c22655834965ca349d1bb5a5fb27ded909ce835f7ac7990137c1d18ecb89b3f61330dbc16e8d89b8d60f507142be8c8a6bb0894dcf9ae0783a50d3052aba525a00acba3c49856a88f656eaea671f36454bdb684fb0da741df1ec34335821817221b9e85d81b1d90fdf53948611efa3852d0ce89b776238affb6c015e79cb04d7900cf28465032dc65fdaca3d129b7785bff2258f3335d8d1890dd233822b539459bdb8d8cdc5c0dfdb1de4d2003f1ebf4a16a93d04672c5985161f4256a96eec2367f384e087d2a9c0759a176d690277af5d0389d364e5cbde19b82586f4a54150d6128e24a151974bb675bc687dddc2e1dc6c7d50bb339c81c54ba11c23a4525f8130822e2b04c9c6a904a30bcf3feb59c133ce312d029af148e38b066d48cb2b7ec4b085c820b328e3829bec2bd5da19e314d2e1bd78fd4a4ad5cdd084468d57e2f14e94e36e4752d6b7e114c2b2a0872ec2d7b0273155aacc33a24226c9d38f00327684ed3fcc39c8998b7472fee7e6b676126a6ab32f3d19df225dff3a2d3c2c636503fc9bad60a482a7df1f843b21e84745650ac65c0b1c6fba95e39c606624a7d77107d8f021907ac5049cc25e40d1d307c9dbf1dc939a742dc4606b9561730a4ab86bb1c8a650cfd2731d394af55ba21bb03c4513f4da71b6c26034594041571487ac65e3192136a0491d27fcb068bde5906f6e6656de5f7dd7039a251735eee2cb4d6663320730cc6e7158344cd4d7aa70eb9ed655a43a74e8003fc09e85fe7804b81ac8eb4b3f3df72438cef3214a3391b63e26093e9f5a8cfd2561354d64bd3fad449eee515819a7f98893c02a091c329993225606937426f3fa74d6eca21c3d7a6bce6160622eca20ffd3a2126fbd4e1dee779e1b57550528790218b277d49fe423992e8d8b11e0ea8995ddc57a330ff464c60e43a9bd52216994e7dc2480dadf83ccb2f5f6c6c9dc28d83bce7458b1e515caec55c3d2f6860ef418292f64c9a2ebd1203810961d67e598924a0e71bce11bad34a7bf49ad77f4c947e7d0071eee0294febf17845239f5f44b65d08a4a508deee0eb54c8cbacb181ba79317bab614f49843bb05facf5c2e43bb062e359f7a6eb7951599775dd5d8b9c4059b82253956f5bffbba7ddfa87df2da21fd1dcea73f8d2a360b632ac7599a515af7ed4f35d89dc7eeb07d85ac0173d91cac5786349d6643a02644d5c5be81500bc3747376359cb5ab99f3366ef44460aaae33930155d1744eb688c12fc2b4276c2e5756ed1175b10a73380eb0282e53d85598218e16dd4044b6ba63767d178df141f267e4bb79cb624ce8014d1f0c3aab3d4b80c353e88e69848fd83bfb7e87e34f945e1b15f9375e14845e56de5aa8e4b99cf7cc228faff5a7e85479521c505af126e489e8c51c74f8e6931a316a18f3d4511e53a0db16e69ad67ee9a5c18e33d41822350af8f5bb059559e0af2538d80fb57ad3dd2d3f86974c0188b2457460b1b5f0bc04d4c4923cca4af1852d74e6c09f477678a39cda67e081243c82074b6978e32dd8d1a0953b9d35aa925f252fb4fee4369a4582bfcc21b728fd74d1c848602ded67bdda50660e5958098bcfcab2d12d61db90e05cf91af73377dda4472bf9b5408f0984682e29cc4e1ff5c9caa64abb384da45fa7b3430b65c37d059fab506d6b7dfcf3c2df3652ecb37fb81fb46b8b99091ce202a4bc27a99a8dd75b6e15f13da969efb056279fd5761ca482b830724594f6aeacaf660bef786a82262db8df305f0b676114b591eed72f73f38bf16d31e9cc00b74a1bfc2c68af2c610081495b1ecf3b835338990c6d61a8d4bff36a7fe3cf5432ea6df5482132b82f24a9e438e5e1ae49e86ecb5b12d6e65c7c80c6ab8f4f50b82c134a978603ab7557ae7f71c66494151f8b7fe069f2e010f00f80c21be786ed21f5684dc53af23dea6a12d8cede0188b99b7de56bb97b00fde8da9ca4fcd273c8c4e33212ce906b4dd70a83569a8b9ad9d8c2752552fea164faa1f5cdba4090cb58f025e8704fc0b8f68093d615930f2539ef0cd89d99b2f632840ad1c09c1a06b5fb106d038a7b9328e1c135bfc77cf6db2a1bedfb38858f0216460f1eb8a639175761899e89d3d90e1d83bb460122e5be16341ecc42d7bf4f46f50e9f501e1b772c0f066420b5e6f2d528abb52e4c9f4c691c39a35a6aac81449d43ad39c0122c74948af445f8681e0e7f791a2d68b749c4d4a3ca1671cc1b7606c795d655313de71d776231d8836009ae71abc4499fbf2e7c029ff77fc67602204cdd4b2fec9e7425a2f726b42913448aba11a38c827bd61772fe1202f2643df0050e6498d4ba242f2adf1a2cb6eea4df71688f0f3e13b6696086b4510a944e8327f275f37a5afcfef82d9e6719482779c66e4f7c2d000283840da004bf9c2c1bd958d45f30dc61ed81aa65e212231fecc8ac110328600e059b3dce3d4dc189bc51161cc196ed0ea1f99142637f4542a6509486e6cf0565765652692f1e94476b281beeb466f023d9b1246bee282cbac4f2026130546d63e08fbe84d520718cdf458eb8d308c6f504a910ffc97f9ebfee06335e8fe8b201eab02f76fd29db63a37628c7dccfc3383c3e25f04429ab4cd6112ff7eb0bc32bbe4ceb56bcc9f092f37b71630f649cec972b2e01f70110d121f088609f6885aae2864bcce5a7939227590f448df978c3f7492a2d36abd79c23d1b4574c069f153606113c96ad7d99342fc121bc2288aa3c6c0bfc0c008a0514e7bc07957efa3b66f1d83d8f76990b42614d5c7071954ec7bd774b8a6ed175fbf9dae18dfbaec1cda7fcab62caedc0c3e89b1fd9c80c9221d32ca81b145745df57ddb0f69a586334f4f733a75d203a10609124523ec02b4de7a61321269f281d80bb2b13ed56fdfc774ad66221ac368c848f1c68e54f7ed1e41a3a17fd0133c29f0d0aafae32e2e3ffe1958ecb96e5ce0cbed997a63f138b893a02500c475e1fe9774aad9ae6f7560981fdb09370a15b76614d126238d231236da03caf9e193da9a9bd025bceb8263a8699ad7846ad15cf294973cbdc1a35d6cc433503b6130b428778fbd7bd4d67c2609cf95222dd64b9a80a8989eebd8d9937e9bff7b72c0ae0f30ac07c5104acdc648bc28203ab52f133ecf433f31fdd5d178c66a2bb24c65304d9deec47adc0c5d0793eeeacc27b095e72b5481fdeecacc12962506fcc312c78aa5dec7e75f3a8877eb3b062da6cd2cdd12b5096575b61925f4df0849a017faf0d51534143b05b87aad2be52ba0176541a5bef4e447ea6dc2ce8864198fe38969244c8f454190eb25787d886be85d8bbcea09dbdd4db75424515d40e3c356393a4a99d0cb56adef26921e553b2873bd72cb19dbec0a87a746f25dc4e34935dd892a180c61862f0a742c0ae3c7e5ecc627dc5c950d26236394f184c3834b4482db93126cdc7ca644dca6c10675989330a6448be0ffa8b8cb3a4c6a49ff8ef93b093154db5ac0a78eff4b2af89aba77c43036f5c69e830dbdd5b8dd354259bdb52d25479ded5a6292afd34f935e37dd59792d356af3ff7ebf30625158bcf933060ab79555e56e4fde958d6dfeaa3fbf24d34cde597bae2ffa4937f3db677c229da6250258cfd48339e21d6e6fcc6fb4edb207fe7a1080127a61119a4334db4db57e2150ab11beb7b523ff7d546058199576f5a505a152746b6ce6bdf1e66156288b168f900f1c8d3a8e9a2350e1f9dc787e5e369c95a9c11f21390c00d70324266eb1a079bba37f350d791d113dab922794077f1fe97fc7c2bbf3fc2e1fe1d6cd6112cf8ab34d244ccc81bae3106417322c4607039585004679ed7b36f8742017eb7fe2eb566030d8963383645fa6e51e0c2f64d1fe6d077192ca451c8c7545139455e3d158f22b6758bd4d3816af4c524c69d319313ac736c5f01ea0d4125054e936991a317025787ec5947f2ef883c3aea346813ecf01ce7a84f8d0cf583effc0db01eea4497468a671682e90869f515ce9643456a5b5fc005c4910bc21a0028b90cc79562ced1a1e400c566af57134e0c2a35e89dc8ada5b49066a27731fa44b55cd9c54ebeafc46a7fceba8b38e334b302ff505b525b32f5da27cf0f9e4cd4d93824ac79b523bcc5d1e27b0ee6865dc2da684b1960131f395dd26a11134fb5be086c4518a6afd3b398c68066d6d93b77afe9cd87a91489e19c2aeb6769d418cb616c25a437426e88832a66f6c31a2e2f55bcee5ee0787dae40866bd95746e38243bc6682d778badadae0d02793b7cfff0faf1077c55c068dd70c0835b3217f55ec6af85e77fa3ed96f6943967530699651798b2fa3b5fc4d91f83fe28338cf5037e9151d64e0109957d938b471c7f26b6a19061a2074a1173a6ba785e4bcc86a487419ec93855df4fff9748898b292fb10bc078c4ec1d7c6f98c94fadfb8bec862898ccc9bb1067b937a0a9e697e2e119bf393a74d624343a835457cb4134584d98efc988ff17d08dcd6edcb5e7a6d54c1da2dada15b35d56a053030ea3e6872cc8b843795b252170fa3d7ecab6bbf100e63826d5e5d7d3f92b62c96c95f8aa470afdb955a51fe2c17ab49882ef1bafb342ac6c2b62a56fe49909b983829064837f0772551314f0e80536125fcd1865b73425462fe0237fa9cbcdeed936ac9fbf7bbe3e2bc9225223c081349a8d5e6dfc526c34963df98158ddef18698f3e768c507df8f3d2d183484d7f2ad3363fbc69d57d0e5957e0cb4eb20a08d06ab0d51a980a929d095ff76ebbbd59c4b0882669bdb88c56000e45edf0c3b9a8de645fc8cb4d309e4d5ae300dec7b1d3619a2f33075757ce8825a5509a0708d8d658cdf2f85382bedd7ca59c6913eae72cae1dcc71ff957f84ff6419ae79808cb86347a1b563cfb7e423f369ad1b48743394b93a8b4294de53a67e27db11a08e6ef201be9d4b1401d22c7"}, {&(0x7f0000000480)}, {&(0x7f00000004c0)="fd128da4c10b2ef18d47d953e6bae8d503caf21fe0a47ce572ef27e1c49e821f95ebe0b1830ad739716bace1ea657475b18f8fc8b95afb11d1b6cfc01d22b5c7cee178e5c4438cf74573c24c276f7d1ec0a1474cebcbfb8bd2681b3ff3d5b4a1c6233c25b365c007badb59bbf0b04af417e63f8203d9a85d4f"}, {&(0x7f0000000540)="bb473444d5aa1c01b9f76e85d723d682f3f188beca5e6fd0943a00c09eda54c823a3b0caf77d967518e477bee0233f294dcefe560669d9dd4592da5cf91bb22f4154e25480d1f7f9359f589f8fef04c46e16226a3a342951e10b8cdd5544f53b0e7031ba5e82443722e28abd560939c22fcb933f0101ad1d3481c4ffebb6fb5d874f83871501bb0f7d7bfea360666f3252c9f578"}], 0x0, &(0x7f00000006c0)=[{0x0, 0x0, 0x0, "196242578ccc4c8e45d71b475a2c12f589c08708b86c35ba9f8a8c887a50b8d710df34c29df24a27b8588f104886edb4ec1451735228c05a9ddef5728a6d96b09e6ed8bcd57213ad8125e2d1b1abdb8b0edda70e5b2d9cd9b6f157c95cac1c16ad1b7a735981d766d7ab944af5a373a9db9e0dd1a2d7e49cb401aaf95fdf953c995da4aa249594dd9edf58b46833b9aa3ba4b25f429e54a721a4d715a8171bfb026252cc0731ad2b285869ae07d2cfcf5a8d"}, {0x0, 0x107, 0x5, "c0990a612beda0d005d9a76c8dc2b3240276a8fe18ff5a0ff90a2bc6606b8717253e4c02ace2f4322392b06a465940bf9bcd15dde914f5304147a869d66dba2c0170013cc05a9c490a15f952ea16b02f0b48497e9f96bd73e209480c881751e22be19938c20b1bb16d96839fdaf26e052c6ac1be00ff50ab72a48b44db208c1e95c7522ee926df171434ef4c2b25cec571287e85a239cadbb6178f93f31509b2764a5daba4c988bfde377413275c04aa4611908b5fab0a3b13dbd277a961640a13c62870aa8086b6671a7193f9756d46874f135b5afeecf60f60"}]}, 0x7}], 0x245, 0x0) 19:20:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:56 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/28, 0xfe91) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bf}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc0105303, &(0x7f0000000200)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0xc08c5335, &(0x7f0000000100)) r1 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f00000001c0)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) [ 2006.959583] binder: undelivered TRANSACTION_ERROR: 29189 19:20:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}) [ 2007.014503] net_ratelimit: 25 callbacks suppressed [ 2007.014517] protocol 88fb is buggy, dev hsr_slave_0 [ 2007.014553] protocol 88fb is buggy, dev hsr_slave_1 [ 2007.019554] protocol 88fb is buggy, dev hsr_slave_1 19:20:56 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x20000000) [ 2007.059989] binder: 31476:31477 got reply transaction with bad transaction stack, transaction 5378 has target 31476:0 [ 2007.084868] binder: 31476:31477 transaction failed 29201/-71, size 0-0 line 2816 19:20:56 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x40000, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000180)={&(0x7f0000000040)=[0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], 0x2, 0x3, 0x9, 0x4}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x1fd, 0x0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000140)={0x0, 0xc65, 0x1ff, 0x80000, 0xffffffffffffff9c}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_IRQP_READ(r3, 0x8008700b, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r8 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2007.131859] binder: 31476:31477 ioctl c0306201 20000600 returned -14 19:20:56 executing program 3: syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000100)=[@transaction={0x40406300, {0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000080)=[@flat={0x73622a85, 0x0, 0x0, 0x2}], &(0x7f00000000c0)=[0x0]}}], 0x63, 0x0, &(0x7f0000000180)="1721bb6d21373c443da520fc443bb73bb5aec55223296f83233ffe720b234e8691a5243070bd81994b9e2d6bc516849fd24d7e352adf753f63899b6718c82d4c14a843a8c82c50452d552277dec18e516095d30c372e76f36828b169644cdce9d96b13"}) 19:20:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) [ 2007.232147] binder: release 31476:31477 transaction 5378 out, still active [ 2007.256821] binder: undelivered TRANSACTION_COMPLETE [ 2007.298829] binder: undelivered TRANSACTION_ERROR: 29201 [ 2007.300076] binder: 31502:31503 got transaction to invalid handle [ 2007.326379] binder: send failed reply for transaction 5378, target dead [ 2007.343661] binder: 31505:31506 got reply transaction with bad transaction stack, transaction 5383 has target 31505:0 [ 2007.362704] binder: 31502:31503 transaction failed 29201/-22, size 24-8 line 2896 [ 2007.379482] binder: 31505:31506 transaction failed 29201/-71, size 0-0 line 2816 19:20:57 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x3f000000) 19:20:57 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$inet(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000300)=0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)=0x0) clock_getres(0x0, &(0x7f00000000c0)={0x0, 0x0}) syz_open_dev$usbmon(&(0x7f0000000340)='/dev/usbmon#\x00', 0x0, 0x0) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RLERROR(r4, &(0x7f0000000340)=ANY=[], 0x0) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f000075cf53), 0x0, &(0x7f0000b25ffc), &(0x7f0000923000)) mmap(&(0x7f00000f2000/0x2000)=nil, 0x2000, 0x0, 0x10, r5, 0x0) waitid(0x0, 0x0, &(0x7f0000003ff8), 0xa0000004, 0x0) iopl(0xa500) r6 = dup(0xffffffffffffffff) fcntl$setlease(r1, 0x400, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x9) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @my}, 0x10) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x2000000000000000, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_all\x00', 0x0, 0x0) timer_settime(r2, 0x0, &(0x7f000006b000)={{0x0, r3}, {0x0, 0x9}}, &(0x7f0000040000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000588ff8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r8, 0x7, &(0x7f0000002000)={0x1}) unshare(0x400) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x8200007fffc, 0x0) fcntl$lock(r8, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(r6, 0x4040ae77, &(0x7f0000000100)={0xf9}) tkill(0x0, 0x1000000000016) dup3(r7, r8, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) [ 2007.394051] binder: 31505:31506 ioctl c0306201 20000600 returned -14 [ 2007.412120] binder: 31502:31511 tried to acquire reference to desc 0, got 1 instead [ 2007.424434] protocol 88fb is buggy, dev hsr_slave_0 [ 2007.429571] protocol 88fb is buggy, dev hsr_slave_1 19:20:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40, 0x20) sendmsg$nl_generic(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x38, 0x400, 0x70bd28, 0x25dfdbfe, {0x9}, [@typed={0x8, 0x84, @ipv4=@rand_addr=0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4008800) r2 = syz_open_pts(r0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = dup3(r2, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2007.494493] protocol 88fb is buggy, dev hsr_slave_0 [ 2007.499624] protocol 88fb is buggy, dev hsr_slave_1 [ 2007.504895] protocol 88fb is buggy, dev hsr_slave_0 [ 2007.510504] protocol 88fb is buggy, dev hsr_slave_1 [ 2007.515690] protocol 88fb is buggy, dev hsr_slave_0 19:20:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}) 19:20:57 executing program 3: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x0, 0xfffffffffffffffd, 0x2ee9}) [ 2007.577297] binder: release 31505:31506 transaction 5383 out, still active [ 2007.590505] binder: undelivered TRANSACTION_COMPLETE [ 2007.619804] binder: undelivered TRANSACTION_ERROR: 29201 [ 2007.649878] binder: send failed reply for transaction 5383, target dead [ 2007.676805] binder: 31528:31530 got reply transaction with bad transaction stack, transaction 5387 has target 31528:0 19:20:57 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) truncate(&(0x7f00000000c0)='./bus\x00', 0x1000) r1 = open(&(0x7f0000000480)='./bus\x00', 0x0, 0x0) lseek(r0, 0x0, 0x2) sendfile(r0, r1, 0x0, 0x40000) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}) [ 2007.742633] binder: 31528:31530 transaction failed 29201/-71, size 0-0 line 2816 [ 2007.795700] binder: 31528:31530 ioctl c0306201 20000600 returned -14 19:20:57 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x40000000) 19:20:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$FS_IOC_SETFSLABEL(r2, 0x41009432, &(0x7f0000000140)="5ed35a00ff4a9c51a78db50a64623818a3f8b93e54b12835db14612c5febc0015404d58132903836060e9f8a92cca1308dd6f29aa5ce755881e531e92617569648a40bcf7b13ae7a4ce3b458fc954354575b45ccb561588eea2ecdabeb230af2714f52e6ffc82a5fff43ee3cc8dcca1663cae34bbb03414d1f41c08844a31662781c87c7a12cd92efb360350f8c091548666b27f71e862fcde562f6f2c56c2c580cc1cefa44f8a19341f66f47def6d0c7091d44a18c76e3cf59113a5b79ec00b8b3d27bf15ad8abacf5b0f3ba9ccae3325fde59c7a6bc4cd6f67c88b561b07ce325e1babdbc9aae59f0145567b9fbbc41668810e96d0628d51649c45ae006e7b") socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x1) r6 = dup3(r1, r0, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x20000, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x60ffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}}) [ 2007.931263] binder: release 31528:31530 transaction 5387 out, still active [ 2007.960352] binder: undelivered TRANSACTION_COMPLETE 19:20:57 executing program 3: [ 2007.995053] binder: undelivered TRANSACTION_ERROR: 29201 [ 2008.034630] binder: send failed reply for transaction 5387, target dead 19:20:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) ioctl$KVM_X86_SET_MCE(r5, 0x4040ae9e, &(0x7f0000000100)={0x8100000000000000, 0x10f000, 0x7, 0xa, 0x18}) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:57 executing program 1: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x2000, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000040)=@buf) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) [ 2008.070607] binder: 31560:31564 got reply transaction with bad transaction stack, transaction 5390 has target 31560:0 19:20:57 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}}) 19:20:57 executing program 3: [ 2008.130301] binder: 31560:31564 transaction failed 29201/-71, size 0-0 line 2816 [ 2008.154694] binder: 31560:31564 ioctl c0306201 20000600 returned -14 19:20:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x740000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:57 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x60000000) [ 2008.287164] binder: release 31560:31564 transaction 5390 out, still active [ 2008.299626] binder: undelivered TRANSACTION_COMPLETE [ 2008.319426] binder: undelivered TRANSACTION_ERROR: 29201 19:20:58 executing program 3: 19:20:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00}}) [ 2008.334247] binder: send failed reply for transaction 5390, target dead [ 2008.345076] binder: 31587:31588 got reply transaction with bad transaction stack, transaction 5393 has target 31587:0 [ 2008.368208] binder: 31587:31588 transaction failed 29201/-71, size 0-0 line 2816 19:20:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x2) r4 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x2000) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) r7 = syz_open_dev$usbmon(&(0x7f0000000300)='/dev/usbmon#\x00', 0x5, 0x0) ioctl$VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000340)={0x80000000, 0x6, 0x4, 0x40e000, {r5, r6/1000+30000}, {0x3, 0x0, 0x1, 0x1, 0x6, 0x0, "afd55bed"}, 0x7fff, 0x7, @fd=r7, 0x4}) r8 = socket$xdp(0x2c, 0x3, 0x0) bind$netlink(r7, &(0x7f00000003c0)={0x10, 0x0, 0x25dfdbff, 0x104200}, 0xc) connect(r8, &(0x7f0000000100)=@nl=@kern={0x10, 0x0, 0x0, 0x614020}, 0x80) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r11 = dup3(r1, r0, 0x0) io_setup(0x2, &(0x7f0000000180)=0x0) io_cancel(r12, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f00000001c0)="d6b06b39fdb416ace4883a5012e37398", 0x10, 0x0, 0x0, 0x2, r11}, &(0x7f0000000240)) syz_kvm_setup_cpu$x86(r11, r10, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2008.405269] binder: 31587:31588 ioctl c0306201 20000600 returned -14 19:20:58 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xf5}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:58 executing program 3: 19:20:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7fffffffefff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2008.563487] binder: release 31587:31588 transaction 5393 out, still active [ 2008.575066] binder: undelivered TRANSACTION_COMPLETE 19:20:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}}) [ 2008.618341] binder: undelivered TRANSACTION_ERROR: 29201 [ 2008.649734] binder: send failed reply for transaction 5393, target dead 19:20:58 executing program 3: [ 2008.666556] binder: 31613:31614 got reply transaction with bad transaction stack, transaction 5396 has target 31613:0 [ 2008.699210] binder: 31613:31614 transaction failed 29201/-71, size 0-0 line 2816 [ 2008.708477] binder: 31613:31614 ioctl c0306201 20000600 returned -14 19:20:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}) 19:20:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x940000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:58 executing program 3: syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="17"}) 19:20:58 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe0000000) [ 2008.817331] binder: release 31613:31614 transaction 5396 out, still active [ 2008.824875] binder: undelivered TRANSACTION_COMPLETE 19:20:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TCXONC(r0, 0x540a, 0x7fff) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2008.860823] binder: undelivered TRANSACTION_ERROR: 29201 [ 2008.879565] binder: BINDER_SET_CONTEXT_MGR already set 19:20:58 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}) [ 2008.910501] binder: send failed reply for transaction 5396, target dead [ 2008.917530] binder: 31625:31632 ioctl 40046207 0 returned -16 [ 2008.936817] binder: 31625:31632 transaction failed 29189/-22, size 0-0 line 2896 19:20:58 executing program 3: [ 2009.028144] binder: 31625:31632 ioctl c0306201 20000600 returned -14 19:20:58 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}) 19:20:58 executing program 3: 19:20:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000100)=0xb, 0x4) write$smack_current(r6, &(0x7f0000000140)='/dev/ptmx\x00', 0xa) 19:20:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x20710000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:58 executing program 3: [ 2009.222998] binder: undelivered TRANSACTION_ERROR: 29189 19:20:58 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000000)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:20:58 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe8030000) 19:20:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}}) 19:20:59 executing program 3: [ 2009.345942] binder: 31668:31669 got reply transaction with bad transaction stack, transaction 5400 has target 31668:0 [ 2009.384918] binder: 31668:31669 transaction failed 29201/-71, size 0-0 line 2816 [ 2009.429458] binder: 31668:31669 ioctl c0306201 20000600 returned -14 19:20:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}) 19:20:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 19:20:59 executing program 3: 19:20:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x80790200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:20:59 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xeffdffff) [ 2009.635352] binder: release 31668:31669 transaction 5400 out, still active [ 2009.642426] binder: undelivered TRANSACTION_COMPLETE 19:20:59 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}}) [ 2009.710043] binder: undelivered TRANSACTION_ERROR: 29201 [ 2009.734773] binder: BINDER_SET_CONTEXT_MGR already set [ 2009.740104] binder: 31700:31702 ioctl 40046207 0 returned -16 19:20:59 executing program 3: [ 2009.766238] binder: send failed reply for transaction 5400, target dead 19:20:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14, 0x80800) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000240)={'team0\x00', r3}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) socketpair$unix(0x1, 0xf62966a4b350ff73, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r8 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r8, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 2009.859995] binder: 31700:31702 transaction failed 29189/-22, size 0-0 line 2896 [ 2009.901629] binder: 31700:31702 ioctl c0306201 20000600 returned -14 19:21:00 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x40000000000, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}}) 19:21:00 executing program 3: 19:21:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x90700000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:00 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf4010000) 19:21:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000100)={0xffff, 0xb1a6, 0x80, 0x5, 0x12, 0x80, 0x5, 0x7ff, 0x6, 0x202, 0x5, 0x5}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r6 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r6, r5, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xfffffffffffffe6c, 0xfffffffffffffffc, 0x0, 0x4a) 19:21:00 executing program 3: 19:21:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}}) [ 2010.527058] binder: 31733:31737 got reply transaction with bad transaction stack, transaction 5404 has target 31733:0 [ 2010.573825] binder: 31733:31737 transaction failed 29201/-71, size 0-0 line 2816 [ 2010.610685] binder: 31733:31737 ioctl c0306201 20000600 returned -14 19:21:00 executing program 3: 19:21:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa0500000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2010.728308] binder: release 31733:31737 transaction 5404 out, still active [ 2010.752850] binder: undelivered TRANSACTION_COMPLETE 19:21:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x10000, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r5, 0x40042409, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f00000001c0)={0x0, {0x2, 0x4e20, @loopback}, {0x2, 0x4e20, @rand_addr=0x99}, {0x2, 0x4e23, @multicast1}, 0x103, 0x0, 0x0, 0x0, 0x5ba1, &(0x7f0000000180)='ipddp0\x00', 0x2, 0x7, 0x10000}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = dup3(r1, r0, 0x0) syz_kvm_setup_cpu$x86(r7, r6, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) fremovexattr(r7, &(0x7f0000000140)=@random={'osx.', '/dev/ptmx\x00'}) ioctl$PERF_EVENT_IOC_ID(r5, 0x80082407, &(0x7f0000000240)) open_by_handle_at(r5, &(0x7f0000000280)={0xca, 0x7fffffff, "0e87db52c03ba09558bffa16cf32ef720ed66a2feb81b97575f807a28ecb200524f255872c1c92344d1747483893d75cf900e99a10f430dfb265b28c1ac4730a1d87ae15d8dc33f6b268374aa2516bc5298bbd73f870571e0775ec73b9f25ce4a9065cd348db3a821432727b7907f93f9130e2d900fab584eb96d7fefb1c01a295e81f2dd0ff71acd192a3b9ccb75421c80378cdf48fd39672f18ffce53143112c5ec1ac34344e9993a148b477578b239199ce5f124f973519bfeeba5aaa2d2f8d0d"}, 0x0) 19:21:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff}}) [ 2010.785547] binder: send failed reply for transaction 5404, target dead [ 2010.811622] binder: 31757:31758 got reply transaction with bad transaction stack, transaction 5407 has target 31757:0 19:21:00 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) socket$inet6(0xa, 0x80004, 0xfffffffffffffffe) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) 19:21:00 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf5ffffff) 19:21:00 executing program 3: [ 2010.873286] binder: 31757:31758 ioctl c0306201 20000600 returned -14 19:21:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}}) 19:21:00 executing program 3: 19:21:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa07b0200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:00 executing program 2: [ 2011.110971] binder: release 31757:31758 transaction 5407 out, still active [ 2011.133071] binder: undelivered TRANSACTION_COMPLETE [ 2011.152664] binder: send failed reply for transaction 5407, target dead 19:21:00 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}) 19:21:00 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x4000000000002a4, 0x0) r1 = dup3(r0, r0, 0x80000) setsockopt$packet_buf(r1, 0x107, 0x17, &(0x7f0000000240)="1e32ad81f5f599d7fe9fb0d754631e2270c02149fc853b942b07baaaeaf7c7b23cc21dd3ae77c1b850896cffdadd37ed813316d45e0abde1b54b41f91fcfe7174bf411231c20d0ba0607a5dcdcecae75816a8da3122671e2011dc2a7f4b66bf5a22100da56b7d223128f4270541e0a4b806cd6aef10641deb9bfbecf4a35f2e1ca2554d83424cfff26c1bc2cc2cb60f7a0f5d51ded7fa3dec6761269de40d04a3dcc2f368290c5518ee6ffa03318a57abf5a17c589c7d1822f985b530e61e77a91023731d4ffc18bf571eaa976535ef921bc2e", 0xd3) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) 19:21:00 executing program 3: [ 2011.237576] binder: 31790:31792 ioctl c0306201 20000600 returned -14 19:21:00 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xfe800000) 19:21:01 executing program 2: 19:21:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}}) 19:21:01 executing program 3: 19:21:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:01 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x900, 0x8000) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000040)=0x2, 0x4) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000080)={0x0, 0x8001, 0x3, 0x1, 0x80}) [ 2011.457715] binder: send failed reply for transaction 5410 to 31790:31792 19:21:01 executing program 2: 19:21:01 executing program 3: [ 2011.536464] binder_transaction: 1 callbacks suppressed [ 2011.536478] binder: 31818:31819 got reply transaction with bad transaction stack, transaction 5413 has target 31818:0 19:21:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc3}}) [ 2011.604611] binder: 31818:31819 ioctl c0306201 20000600 returned -14 19:21:01 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xffff0000) 19:21:01 executing program 3: 19:21:01 executing program 2: 19:21:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:01 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x2f) [ 2011.750658] binder: release 31818:31819 transaction 5413 out, still active 19:21:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}) [ 2011.810356] binder_release_work: 1 callbacks suppressed [ 2011.810362] binder: undelivered TRANSACTION_COMPLETE [ 2011.819562] binder: BINDER_SET_CONTEXT_MGR already set [ 2011.825960] binder_release_work: 5 callbacks suppressed [ 2011.825966] binder: undelivered TRANSACTION_ERROR: 29201 19:21:01 executing program 3: 19:21:01 executing program 2: [ 2011.920055] binder: 31845:31846 ioctl 40046207 0 returned -16 [ 2011.920082] binder: send failed reply for transaction 5413, target dead [ 2011.945830] binder: 31845:31851 ioctl c0306201 20000600 returned -14 [ 2012.005822] binder_alloc: 31845: binder_alloc_buf, no vma [ 2012.019400] binder: 31845:31851 ioctl c0306201 20000600 returned -14 [ 2012.027003] binder: undelivered TRANSACTION_ERROR: 29189 19:21:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:01 executing program 3: 19:21:01 executing program 2: [ 2012.054549] binder: undelivered TRANSACTION_ERROR: 29189 19:21:01 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xfffff000) 19:21:01 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={0x0, @broadcast, @remote}, &(0x7f00000000c0)=0xc) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'bcsh0\x00', r2}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:01 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}) [ 2012.134602] binder: 31865:31869 got reply transaction with bad transaction stack, transaction 5419 has target 31865:0 19:21:01 executing program 3: [ 2012.204907] binder: 31865:31869 ioctl c0306201 20000600 returned -14 19:21:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:02 executing program 2: [ 2012.322393] binder: release 31865:31869 transaction 5419 out, still active [ 2012.331806] binder: undelivered TRANSACTION_COMPLETE [ 2012.358783] binder: undelivered TRANSACTION_ERROR: 29201 19:21:02 executing program 3: 19:21:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}) [ 2012.382952] binder: send failed reply for transaction 5419, target dead [ 2012.408482] binder: 31888:31889 got reply transaction with bad transaction stack, transaction 5422 has target 31888:0 19:21:02 executing program 2: [ 2012.474626] binder_transaction: 6 callbacks suppressed [ 2012.474644] binder: 31888:31889 transaction failed 29201/-71, size 0-0 line 2816 19:21:02 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xfffffdef) 19:21:02 executing program 1: r0 = getpid() sched_getattr(r0, &(0x7f0000000000), 0x30, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x109000) write$cgroup_int(r2, &(0x7f0000000080)=0x7, 0x12) 19:21:02 executing program 3: [ 2012.532244] binder: 31888:31889 ioctl c0306201 20000600 returned -14 19:21:02 executing program 2: 19:21:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}}) 19:21:02 executing program 3: 19:21:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2012.713954] binder: send failed reply for transaction 5422 to 31888:31889 [ 2012.768398] binder: undelivered TRANSACTION_COMPLETE 19:21:02 executing program 3: 19:21:02 executing program 2: [ 2012.802476] binder: undelivered TRANSACTION_ERROR: 29201 [ 2012.808697] binder: 31923:31924 got reply transaction with bad transaction stack, transaction 5425 has target 31923:0 [ 2012.838320] binder: undelivered TRANSACTION_ERROR: 29189 19:21:02 executing program 3: 19:21:02 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xffffff7f) 19:21:02 executing program 2: [ 2012.893616] binder: 31923:31924 transaction failed 29201/-71, size 0-0 line 2816 [ 2012.906265] binder: 31923:31924 ioctl c0306201 20000600 returned -14 19:21:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}}) 19:21:02 executing program 1: r0 = socket$inet6(0xa, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = dup2(r0, r0) write$UHID_CREATE2(r1, &(0x7f0000000000)={0xb, 'syz0\x00', 'syz0\x00', 'syz1\x00', 0x2, 0x9, 0x13, 0x0, 0x9, 0x6, '7x'}, 0x11a) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:02 executing program 2: 19:21:02 executing program 3: 19:21:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2013.078566] binder: release 31923:31924 transaction 5425 out, still active [ 2013.104076] binder: undelivered TRANSACTION_COMPLETE [ 2013.125749] binder: undelivered TRANSACTION_ERROR: 29201 19:21:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000}}) 19:21:02 executing program 3: [ 2013.157016] binder: send failed reply for transaction 5425, target dead 19:21:02 executing program 2: [ 2013.251480] binder: 31953:31955 got reply transaction with bad transaction stack, transaction 5428 has target 31953:0 [ 2013.262477] net_ratelimit: 25 callbacks suppressed [ 2013.262485] protocol 88fb is buggy, dev hsr_slave_0 [ 2013.262545] protocol 88fb is buggy, dev hsr_slave_1 [ 2013.264485] protocol 88fb is buggy, dev hsr_slave_0 [ 2013.282777] protocol 88fb is buggy, dev hsr_slave_1 19:21:03 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$MSG_STAT(0x0, 0xb, &(0x7f00000003c0)=""/129) 19:21:03 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @rand_addr=0x80}, 0x1}, 0x5) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000440)='/dev/rtc0\x00', 0x2, 0x0) getsockopt$inet_udp_int(r1, 0x11, 0x6e, &(0x7f0000000480), &(0x7f00000004c0)=0x4) ioctl(r1, 0x4372, &(0x7f0000000500)="846639cce4d974e9748e0aad329012e3a4323b36650653d8ded639334ab5fb2516f65a2bff934eafcc79e6949dcf0465a78c4e607b6a6998bd751b7dfd7e5d553ec677df") connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0xfffffffffffffffe, @mcast2}, 0xfffffe92) r2 = add_key(&(0x7f0000000180)='rxrpc_s\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000300)="cf787300b3ba9f8c984b9adad649181fba0b97eee7057a4fa1b93e15b339dc0fafa77930bada7cf7a88f6ba759f84c67fb0c8d955380c400cc2c28b1a86defa5df666d6331f7d855657f1170ff19d06dc77c21c288d9e6caec475f2fd6ff51e042f6ae2482392a38323eafb6e221c23c41b7164bd356b7342779c4f72be89f214769", 0x82, 0xfffffffffffffffe) ioctl$TUNSETLINK(r1, 0x400454cd, 0x102) keyctl$invalidate(0x15, r2) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101001, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000003c0)={'gre0\x00', {0x2, 0x4e20, @empty}}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0xbc, r4, 0x300, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x58}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x8800}, 0x20000051) ioctl$IMGETCOUNT(r3, 0x80044943, &(0x7f0000000400)) sendmmsg(r0, &(0x7f0000000240), 0x0, 0x0) 19:21:03 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xfffffff5) [ 2013.319193] binder: 31953:31955 transaction failed 29201/-71, size 0-0 line 2816 [ 2013.329894] binder: 31953:31955 ioctl c0306201 20000600 returned -14 19:21:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}}) 19:21:03 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x10, 0x3, 0x0) open(0x0, 0x0, 0x1c0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000440), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x2000005) syz_genetlink_get_family_id$tipc(0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0) 19:21:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2013.409812] binder: release 31953:31955 transaction 5428 out, still active [ 2013.425645] binder: undelivered TRANSACTION_COMPLETE [ 2013.456054] binder: undelivered TRANSACTION_ERROR: 29201 [ 2013.481831] binder: send failed reply for transaction 5428, target dead 19:21:03 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80, 0x0) fstat(r1, &(0x7f00000000c0)) getpeername$inet(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, &(0x7f0000000080)=0x10) 19:21:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}}) [ 2013.503064] binder: 31978:31982 got reply transaction with bad transaction stack, transaction 5431 has target 31978:0 19:21:03 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f00005a1000/0x200000)=nil, 0x200000, 0xfffffffffffffffd, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000495000/0x400000)=nil, 0x400000, 0x3) [ 2013.564760] binder: 31978:31982 transaction failed 29201/-71, size 0-0 line 2816 [ 2013.589294] binder: 31978:31982 ioctl c0306201 20000600 returned -14 [ 2013.654456] protocol 88fb is buggy, dev hsr_slave_0 [ 2013.659621] protocol 88fb is buggy, dev hsr_slave_1 19:21:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2013.728817] binder: release 31978:31982 transaction 5431 out, still active [ 2013.734459] protocol 88fb is buggy, dev hsr_slave_0 [ 2013.736672] binder: undelivered TRANSACTION_COMPLETE [ 2013.740988] protocol 88fb is buggy, dev hsr_slave_1 [ 2013.741083] protocol 88fb is buggy, dev hsr_slave_0 [ 2013.756267] protocol 88fb is buggy, dev hsr_slave_1 [ 2013.760876] binder: undelivered TRANSACTION_ERROR: 29201 [ 2013.770142] binder: BINDER_SET_CONTEXT_MGR already set 19:21:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff00000000}}) 19:21:03 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x16994f62e0d) [ 2013.779259] binder: send failed reply for transaction 5431, target dead [ 2013.786953] binder: 32006:32007 ioctl 40046207 0 returned -16 [ 2013.818577] binder: 32006:32007 transaction failed 29189/-22, size 0-0 line 2896 19:21:03 executing program 1: r0 = msgget(0x0, 0x4) msgctl$IPC_STAT(r0, 0x2, &(0x7f0000000040)=""/224) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r2 = socket(0x9, 0xa, 0x5) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) 19:21:03 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x10, 0x3, 0x0) open(0x0, 0x0, 0x1c0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000440), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x2000005) syz_genetlink_get_family_id$tipc(0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0) [ 2013.853455] binder: 32006:32007 ioctl c0306201 20000600 returned -14 19:21:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2013.911325] binder: undelivered TRANSACTION_ERROR: 29189 19:21:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}}) 19:21:03 executing program 3: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000280)=0x0) sched_setaffinity(r0, 0x8, &(0x7f00000002c0)=0xff) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback}) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000180)={0x38, 0x0, 0x0, 0x1ce0}) syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x5, 0x20101) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000280)={0x4, 0x0, 0x10001, 0x3}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f00000002c0)={0x99b4, 0x0, 0x2, 0xfffffffffffffffd}) r3 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r3, 0x40106436, &(0x7f0000000040)={r2, 0xa}) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x80, 0x0) getpeername$packet(0xffffffffffffff9c, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0106434, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x5}) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x10d101, 0x0) msgget$private(0x0, 0x0) msgget(0x2, 0x40) setresuid(0x0, 0xee01, 0x0) add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$chown(0x4, 0x0, 0x0, 0x0) sysinfo(0x0) 19:21:03 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002680)={0xa, 0x0, 0x0, @dev, 0x1000000000000001}, 0x360) recvmsg(r0, &(0x7f00000001c0)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f0000001300)=[{&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000000080)=""/8, 0x8}, {&(0x7f0000001240)=""/148, 0x94}, {&(0x7f00000014c0)=""/215, 0xd7}, {&(0x7f00000000c0)=""/23, 0x17}, {&(0x7f00000015c0)=""/4096, 0x1000}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f0000000180)=""/10, 0xa}], 0x8, &(0x7f00000025c0)=""/151, 0x97}, 0x2000) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000001380)={@local, @multicast2}, 0x8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2014.088480] binder: 32029:32030 got reply transaction with bad transaction stack, transaction 5435 has target 32029:0 [ 2014.154538] binder: 32029:32030 transaction failed 29201/-71, size 0-0 line 2816 19:21:03 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}) [ 2014.221653] binder: 32029:32030 ioctl c0306201 20000600 returned -14 19:21:04 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000007b40)='/dev/dsp\x00', 0x84000, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000007b80)=0x14) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000007440)={@multicast1, @multicast1, 0x0}, &(0x7f0000007480)=0xc) sendmmsg(r0, &(0x7f0000007a00)=[{{&(0x7f0000000000)=@l2={0x1f, 0x800, {0x80000000, 0x4, 0x3, 0x1, 0xfffffffffffffff7, 0x643}, 0x703c26f4, 0x2}, 0x80, &(0x7f0000002700)=[{&(0x7f0000000080)="0a80c858ecf747c39843cea439e090e2cca6658b93f180fabbebb68aa2de194ae3a19d162c86653ad28cd0c18b96c5f88a4706a147ce77e221784f3439e0a4de3058d83dc8d678991524487d434740920f41dc31b2336e5e2ffcbf8c99eb77519981e9f1de456a7d17eee4986c1526b1c9e17397511449b0b09581db147e1ac3ba5826277c", 0x85}, {&(0x7f0000000240)="87897d4957a50d48c6be7dc744b479a2176556d0b9f5cf47277b56c4cf707f561b21cc278aa597af1b1260060141b28e86b216a6f9d8facc9158b8d1ea84513ddf3cf5a44a4fdc77bbe78e2006fa0f416b1894ff3987580bbd3d314ce19eaf34554924f2ca47bfe077edea8b3f2ba77deb9c8d9e9e6554c36f0f1aa53cb2b8e9ded8861925d8790b8c5e59a72f262b91799468e59a930c90751b5531047a861dcac0505d17f13e95b44d395a8c480362b930e20e870275eb914a070cdd45f25f18ff6159feaf3b7e2d", 0xc9}, {&(0x7f0000000340)="0894c72cfc110330c2bd18da6a05824eedad222deb09f730b73ef0b1804c7b787ec4b1773c687a618df7d8f196a8a16728694979a1b5f7612e126b7cedd39ec375dd40ac624fe9a4c6ac73970dac9d5a7e6dbcfd9dabd359a7e947e6a48eaca722fdc91b607c0607bea908043cdadfa8d55ac92e476009b73c9d24d1367de7db2bf9782d1c1327ff7efc00fc6b4a068d90b2e93d0b1a1908cc53d92f4a02382cb87036d2c0a9f846f93125b1665fbbce330a80473420a5f6134baa8d6dcaf020b787b4bc497114e4aee19b87d6c243e61fc2b316b3aac3d9f221e78b121cd5f23073174cb439b6f58a25c36e8992b884d2a1f01aacd3680e966699101bc3f9af189492b8028df2fe9ca43546fff5b176ec5057606fcbb53c1153a0e581cf90153f6da8de18a2939a0ed188d4521d63a8ffe3ff84040c2905f752ef62399d49e9359f4b6af2f1ea3042d3f19bd4c510679aed7755d1aacd2dec073f83d8eade508dedcbecfa5c386c451e3be0688d7f8bec8c7ae0094514721de45bd2e5af7131bc1e0a7ac4c83b1d355660df2a5da46339f3c300b79a5d7ea48b45c6bae8114b42095401a261ead2fe9c9b00aba0c7089d38c651f38cd083ec91e140c4c765bc0fe69906fa4bc69ece0e183ce5259cdba409c594f83f165e338b58576e65e24ae02f031f2f48a9fd604a2ca5c84368b691dfa76c96d92c813c49053b5b741ef7b07a1fdcb739710674ea2a081f36683562d17d709188a718d615afc1a5599ce09d18e2d1f4d7b14fd01de31500d700958fc68a729e69ffaa8c4d663d228c78eff10246b8b4e61bb1086d3d81ad40a9262e28ff6469534ae8df7d511ef45ebb18fb611a7366d4db8fea05e1a9885a38cbfdb01bb7f5f18cefab36d0bc2de306fe4f9e03b64884a6a169f5d6f27a8716999a0598ab30bb2a6a30a1d24eb2c8201a41799f264fa13e232b18225272584290b9ff06f2ad76ba92bc4583408f5847e905665327cdfa948e2df4951d1ba36f3b16d915e1670302033cf3df4ebacc01c7d51d37e1a7203e945b3387c3a175f372fcca6c0e39485076513a7a76a801702126c7b167168e1f25b261fa6c9b1642520230c153fd5c3085521e7798d3105620bd168dc7e2a56d55f9719c8684e83fbba2512e967bb7b1a370b8a9f532d5ca3008a7133fac555e89d04fbcf0d0da114b91e21df28c1cf5b118a17d5945a6f0c1bbc1e001f25b52e68c14c45114a5d5a86953c1893f1c11ece28aea637819707738a68e3359888b9bc1330a23da908c05e24e2208c371899ef459580f8fc4704c39e66f8a9c1aec6d3d213da714c32fba07b8ce70d01dce2b2b6a9bfb3c51a8d07d85eb004ee5e300b1f726ebcd0ee3347680475d6ce26cb17388c77bcc8cd42b592153d9a9a221385a9cd209ab5f303aba991def7c049fe31fa0fa42acb3c1357c51cc0f6f241b4e13ec3a2517700a0d59ed19a4f4e6110bb793a2be3300d352389b37bc9fc4fbfe936a5b5cbd6febfa2a82aa8606f804a0e152c80beb663320eaa5705ede25b511ee9d5e72399b8c5b0fb013a918d9d69bd2d58b1765efd2c1c5b1bed42cfd23699c43aa9d90aedb52923832718a997428fc3cd669aab08572c04b24b561f06ce20ac6a0ea3a78af003ec2182d9d583318e928712daf53807e082907d6eede23920c32db055038ea9f74384ad9dee603cceb8f3f3106cfdc2b1b222c3545acacb9300c142356741ca680993de1f2dbd58e3682b454cfd40d32d27a378fe11383d6a74a7b4102e3266f31f1cc8495d40d51da2deb84d2cc7971b35abf6d90bb28cbfb42f36d9bef447a35834379852ab6d794962dc97e5f590f74ac14e69e88753f004cb0be62a33bea2b4d7c9ec0a2c737f173b91629bf37c117616452a6458d60d469166a81ded92fea57b4aaa62e9c064c68140673a9bcb223c1172a3738fe88fdcd42262ea841d5f18705bb305c83758814db7eade6ce996920001517f7ef6e9a99c25a52ea6c27c4efe1a06d1294dc9ab3bcd2c004a9b8a75102c582fbe20467a6194107c19e1160251c93f3e3903b348a8b20ac41faa66155393d3530cd90e1afe053d6db77457eddab6c5157998f441a708c3dc6ec544c0ecc96697e7796c241a58ee45cd9f081f482fa016bb17830ff5a0a05722f5f55a17c699f82424a7317d4ff470187812a82cb908a5fe65335973d30be44bfc2ff2084925e692a68cfbb81fad86193d090bb0a81c90b3ae9c8c7c77d4a37cf950b7f262641e1da21d4c37c647559f9f15a3550e0574528ad01ceabc21e42145681b66723cec17daff3868e2b767eb715a03c650c104943b51ca08c762701fa79702943a47f2c5b17e0e37199ed99e1f81b14a6070e1c98d0c063a5adc1850a57cd344dbfc62224827af825f56d4c60b968bbfa1a9e5997b4d9f3be7e30da8264c31efa4991164c2d7fde271bce87938ddf93c7c3d7a959caccb7198b045c4e3890a2920c5cbd39a356e405aa05ecc62b17653c6aef9d9661be336e55e264dae21989ca70d925fdbdaa0b05ab43f011a398a07a5a50a34e2dd9b249dace232ca3a357b7113c371816604aba93a5daea3f5b3c01766e34f761ea830f51cfe694654ac74beb944ce2e2344309c96071a60086d704bcfb4e33b54fbf484e31efcbac4c19a3e19c801024eff43b47b163bd49d9c430ec4e8599124620500c8ad08e2cc2b523049586884402cd5eee1962eb26c6edc8044647634d8a99f99a58245af85a80674d4c9b7d6c39d6ce278c9bb5f5af81def3ee622870ea8eff999f29ff847a80e532539de295811c19ec2771af74ebc8da2ba5158cd4415a5dd4029d21fdaddfa9dfbbc617f3638f126b75718413277142ff1ff09ad35712b7c6afafa46e7d1a2abf66d2a1fe08d774751680763a08361dbd5469603147362bb1ec3d9672f8d1deaf8b1d332fddba061fb64668ab804fc30868d6c65d31d1d6f85a912f374e28d36bf5e6cab9a29012f4ada9d61659ccc24d5646c512e28e4d0f3c8fd1fca20341a33e3d99a6cc23be8f50b870f52e17a92d4082d446bb2d25f98b7125bc6a5d578e5679ed68cec81a296e1da01ee8cc36ec10d06f510cca4aa925e8f8f6a6ed1409e62169381107fe6ff45116b42eab61be9374497e3ae599ed69a0f136ac16a5acb56b121bf779ba7518573fa0c0e08cf57c9653fe350e9240ee22ea209d2f6c5957012c6db8b2f34a6de3963c1254e6b7fb5397d857093cd4f17fc9514774310922437214cc7d0825120f680d297834c818fd867bf1c656a55099e43a59027faed4a196df106f52fa3980cb7506c095b559e4e800e7f6450b7c057ef94d125b20c6a1791d42367bdce421bd479c8b92c3098b4789ed10e6f559878bf09f243d9b7253046f1de83991ff4e33699d1c5e91468c6b725915fe8db37d5b144ce628e6655998359176c1cad476b081f96bd4c5c34ddad7ecde19ea100283ebe633b8cb39f2b2a3941594ab1bcce97fceaaa9105819d6b8f759552f5ebffe62ced18cfd3ea4993873762c4b5026e9cafbdc03f3314e7e593b48854545a6830255e4e5217c05db55cc94fcaca3da48b10e6533b3a0bb4eb706b24d4c6fc7dcf0bd79a1325378bfd1af2530c96fa67478d326681f6b4ab45da3cb17a84e1293e28d0eaa8766fa9208970bb37d17ff0dd002332e25c46076d83a6d4354975a7d7955af9f507b71d84c8ffa62bb7d0018a56a90127b116075d130f9fc2b8b898f3a61c74af895ab894f616186fc75d0c19426bce29205d2854ca6499926cf96c02c3b7bcce9af7abc482d6035b5d31c28db6310ef91bc2cb6ca06686e1b5c04adffa9ccd7c9ab8d077c68ffd2c693e619dcb8a8800e11fe049532e224d03becc88b82104ee74ef1c0a3dcb6e9a6e7ceb52d7a77ffcd7f13eb54659870b8bc76e35328526b596d1fb74c215671f463e6c56cce8cd1f5f1eb56e71f173d22949bd1ef9e226f19d50af35fbe0521419e857c0b9b1e3834a79cf6fab649139a6960dd218e78d21d8b7e65abd65e412fff8eb254c21904261eb9f9c8162a4ca19f0220abff6f8d8526f1cd2e8b2eb8b0382d978fcd3b679aa413492f55ccce533a465260199b9934be8475424e381e0f3af496b9b2969062f61c277b16b807d6965a0a1b96a66bb6349bb295bbf843d3a69a0bc7ecd13025cd977aa33f736cb2bb511576eebf30b5323549f9018144533c194b4a8a3c90e154f317f48d4ef42b4d1fd7b801f643f262166e217d6c73241e6e5665a8e0a19574b9641ab9da439d2343e30213a35d642618487cca2762442e6df7ddbffd172ea647f7a42a3a4081f7e6d1ab9f87570be7a48feafdb3c258ee7e1aa09a4832c732abc2ebb914357f019ce84adc281c76d940d56971e39463c1522bd8fd916c046c09d8a1f35ca387d583900739a73b802bfa0ec55c13d6ef7be8b32e1032222e4175a8d4e1d97a2778151e55096f6eba1364e4f85586953dfaafbf258682bb057f72e1190d65e16d22ced623c75d1ef65d8924bf86c9361ed6a32a0c4ec4cb3017aa74ed03fe4ddb2e241361778c22ac97a5e40a9ea12ee9b2d4f78007003a4116a80779f2feacd0dccc53ad11d435258dde427956134b6afc0fb3fe75e38848c5e762146b179242badf9b92e074c9500f3102917bef9017b94c1e461202341a90dde24ee43942be49db6da0aa97c6c3bcaec45fa3fd01d46810c389532095690aec39c1cc2284fd45b7099db0e93081b9f34f9ea1a2ba1d4eb6ca63c2dcf59b89c4943b02e19b51d9a5a6542a68ebd9242456f9f76551066d9aef5f930a9d2d6c81e22edc99366b8b4dd85251804bf73835d467da021a19adf420ba7341a415560a5e9b426820fe9ed7d04d9e59a04684e51eb8774e95e1fcd423993dcc833daf57513be9d26ad521f64e297cdc4af121e5d9ff1cbbaf8508c5b3e19cde26c6bfe0d539d66cf569300435111ca035f9c58bea55b2110de7c473850643a2372b41b45a59325deae1c4062a4aa4e19abce4787d1d0daeea38ddc6a68763119a97e88ad44104e7a14c68cec20c0543b86750dad6e4d0298d7fd79526f7dc3a781bb6d3a251ad98294ef33fc9c4809713f87f780eb62d4046a26c9c1cb27d517ea53a1d0e0879e540de6031b8dd0620401bb4d1405f626426c9bfd1826551429692211bc8813438e748ed3f468fe6eb1685d2fb6ce0e29ff225e9a6ed729b84487ea3fa208e7b0f811cb5963ffde28fb87d562c74d07fd6cbe151cab0cedf0a5e0c505c8612151bd56a648cdc5c41794daf37be1dae4fc0c2e6bed4245f5b9e0a8b66cab9bad897e2289b271abd510b993a2aa4d92ac06caaf019ef2abb93d7a6b46ba7a5f7bb937f30b69b974d63629995b56673e122687cc084ef13790e6f11b1675966801c5a89185cf1271d1386bd313dcc9573e333d15420604fc90d3f85ce0f5753c9e27df96a4b2b4238cc126005faf94df965f902255ea63e3ea808dfd8e0e28d79cebf830181072efd2647a28ed63daf89f809fcf92a7f77cbe03b3ad1f997202499a4226fa52c712cfd17055240e57b6c7f350c4f58b0c999af7c5420710cbd3902669d37dcf3439d5ccc050172f299c231362dcfd27ff901d9d72b4241ea6776b11a28a586f71eda36cbe48231a6567d776621430554ec7067dea7b9311aecfa48852b4e33962776dfa79643c13b3194bcf3b0901dbbe18efef521f044893f1b92e06b48c8ea3dc814331d2b9a8a601d4650757b04d934d41ae79f49ec07a15db38d3e9db6d3188f", 0x1000}, {&(0x7f0000000180)="32964059823ccce092de10d2c4fc3a4c7d1212066cdfd99c015855716b6a43394a5afaac06daef64beddd13186da043da1ba54527f564fdac72c89f0e22042c5c4515e009a27b8f760c7288f920fc1df8a19ab7fb471995564c8ec8b7d0f98a28a", 0x61}, {&(0x7f0000001340)="f04d2623fa04cc234e667533bb26e3372905a884ff8f21754930c274d4987fc3ea79490809d4f9a5c1efda71401e80fb12a771148e008b5d00211af3e014814ac9dad8e4e776095d6f1dcd5d069efa288ab55eae0e824be3d35b7d6379b59dface993aab15f52109c3fa2725393de1caada43e0f65265cb8c31eb6", 0x7b}, {&(0x7f00000014c0)="b959bff25dc2bc1278b81dd373406d87209c75381cbbda08e135764e6796d7070ab5f11d7674fc72db32742e60e5c8fc50fa31191ff47bb9f8cd23cf95757722eb3dc6d889c9b5f08311054211f8a5f2fff2689a5a201b59741e95e87399f3082e3574e7d30f5fb64002ff5131f42c1db7df1df4b1d05452ee46a319cdf31c57ae1e63e742ee76c517b699bd9466b2e100995d6d47906f254704f060c77b2db574dc9d2208cee2a6cd601e52109b55b626f991aafd4a8a1003f7cc099169477dce09f41ca36a3e0d78573d3b5cecec7734a6e36dfd488a13e8355a8722209deb1967a7bfc1ae07bf4ce5934fb09ed58572d6fc353672870838be658fff29972cd7a3fbe3d10ee2e5205e919a49f8b462832f0bd91a0349b43152efe8b8f57214de9d14dc595fc02ef4519d54f521c7f1f404fd7749c5a8939a51121cc4a3a6042ee5b725c9af11379a87cc19f085b9016207cfa743d1919f2d4b2639603c922f521c38b80fd524f48e49387c88bc86faaa8be9022671c632cfcf5859b3648b6d76391be9d443af6425b342de664b052f5d1bfd3c844347cc378320ddf6dec0ac8e06744dd2056d4057cddff49e69368207f333ecfcd0fa6b97af806117d5ecb3b7c02049a25e11b2a095068de81c82f2fc827a8e7208332b99f566d6dee698bcf324f40a91f74d5637369cd0bbde468123426c4f43c13d2835951656c4843755485c50453d3f4681adfaad40003f481828e94a6cf85f0e6e422080ab8d2a0c35ac4c0ae4be02795211a16fbc45be946c3c6853728b68e20c12c7ad1bb86fd665ebc39e38225ebac99d5d4c3a41fee187cedb89f5352ed66eef5da5828c68a1725b21f92d6900e409584a1f997acec4b2ccc8545573e9dd062a0498a0135fc490b09ba9607622e3a26544feb83e7b61dc67a8523ade50fca7324882d753dd6df16c24f387063a34cadd3cc532d59bd1c09ff6a0ce6ded5fe25fedb6538d927164b77cdb06fc5b873b6e9701b15544f2a392d4b4d21af6b000f843afd480047331115f6abd7ce9cd4ae132b2fa3d90c8985650923b9a001d945a2797634ce893ba5dc065751e26680b8953e826f1193b5d4ed9064d90c85049787a033fa948bc16221c06edd6366d87c5805cdc987aa141dc90b9082c491561876c2992dce3aaadd3e328152193282ff1a5175db98df4483be8f8d4aaa966f38703ec4b63d92bb82bc9be5b031814f6cd81f8ef7b40ca24a266fb1430b3b5155c4733d78fece2a250e0a5aeb53418d258c7598dc1da51b895ae12f2251eb67ef47860c35ce5808fc11fce1beaef87972ffe62735c0ddecff83ccb375998da62160375266e68ca23dcd8afb0a492e1ed2c98693e10148d1befa17e0178c28e560bc6f0b515e1b169ddadbd8915c95bd5b33b21151f8634d14d0f9cee01c3b504cd020fa8d9fe3d579fcb9e644108417562391b35cc826b9aae90ad61451991ffbb09b4fffbdeccf21d6f23a9aca17af0df7f07eb5b2c3bb9989dab79f60962067d2c563ac330379465d09a4b00799f4c98243ce4702364cdf040336cd75fbb5dc508fcdbe2f0e33da58c2e3614f12a14ed3543ed8aacf254a27635b7bb128656174d2d851988757770ac4bb916aa05c7b7cc04789523581f0ba453301798402a9a05e211fc973f3c7c33e63450dfe753db40b2a2c23d6d4e6a4b14034ac05e76f4d480eedbfe8039f0f26935383da232ad359deff4331a96ec312d229982980cf2c4387c9ed4a43db79801f4245b65f39b097f2f3076bd19122fe89bda12718d1e361275f28c77a1f54196a328358d93419334e544aabedc4e3f9a0b52a0eaa163198ca9c73ee622168a97a9bdcc54ff96bdba0944ee825fc7d2413d9f5ca273348e5388f0cf5e4c19025a2762c35443382f2694cb8cc88de5f80b354c1d0efa742f8789cd03dec28e55b551923f6a45b0ad2eeef51e4d3116acdabefe653ba38ef174ed3547c21471a9630ced289a4cd7732ac5ffbbc952082ab577032c0c8d33e05fe05c40d12c0334b974c33fc732d0b1639b9ff1e07b25740791deb7d36f56c78b167ceef5981729a6181c5fb72bf8ecc4fc2ea62222a0eb079ae8ed53ff79e00d2cdcd7d66b7691e0e256b155f0d34b51f957ef8d39ecc98a2612dad9596bfccddb14b1067e38e04bd28b61a9a08b80aa6f82d15c70ddc178ef3b0297a396b7b9a34d0ece9bb4fdef3f9e338e1639cd589cbd5459d6c4948c0f6c4b235fc68772d0eaf5585f0c845c5607fa3156ae56a3730f25a0ab5bb6f15bea17c8224648d8009208e36759835c4d3d8d9371348f65540b389e8d533bb7fa6a243e264e65ac2accc1116ba03a55866078561b2296ddd01a70005bb11c225a16502e17782eaeeef5364f2f22a275b5f1a279a4b170c4cf04c10dc26c37a090d37f9d8c3acc8d468c822f860753aa1c8308cbc1a59ab416c36e42980e4de0612ba2b5ce782572dd84a41d93cfeba51d44eeb40bcc7d58a34f35f6e10fc9c2f77a97dbeff6b65d4e91972c096dd3fedb06f92eb59a1e9f8f1882ff70c94de49692e9d89e750c6e866d030b4c6346f7b12dde3444d933a7aed768a5bacde21f89c1363f80da714af6716292116fc589b16bd13ebe6945b7a347a80e6a8ff520366978874f8cc1cc960086c696ecf259199078ab0ab57b2e1caa51e531a7f38faeed272ef78ac1382d92f25bb518ebe474c6bf24d5e3096ef1184e21d83de277f5e202ec8baa761fce9f78bd1a5e0b43841d6a9367479fc2797abec435272ed8c1d3009dedd439f991d3e2839c17228833cf3ec44d3969ba8265dab44632e212a882bfac5ab21987ea5d8582b4417259ce8ac5ef8d42a3ea71984ef625be8463a84a507be8eb2b5eb4e32161fa15c83e863742caaca15a51fc407212517e7565dc92da69857d25351c7d0e1a1799706500f54a15d08b39089d2c9026ab386ae0df9f81ddae24e7608385add31b4cadc5763a162713cb2c6ba1e6fe9b7fdafaec9b8c452baabb3621cc544d27464bdbc7ac98121912d037314e675cf7a35865e1951b281c41c16f1e7b2b79ec9a2f97322de27b3e68c4e25df682ecc91f4aa4fa51bfe91eea5d55d959e671ae2e5d99397eef14589be14eea2ef33f2418d04f662e9ce68ddab01f9f54825e261db8837b154f6671d17d3a8e05ca7170d7d7cf1cf3570e6413b2e69387447645548088687221d8dacff18feaa25a5ee133d063cc701eb8dc68bbf091e0a8e87d19c8333a554bc3f52d58b0fb6375f1e3ce31b6591106d4cf05792ea0de7f6ff81aa52991e8e55e9b0e1f313cf88ac0a729647ad191a3ab198ef6fd178d414a24f697de8824ce538ca92c7d8ab0b87c8ee2e50ea43f0e16061ec9297bfd3812080952d9d5f395bafac5c95ac53a4e54bef0942f725a9670b18e1f3fbd9f5273a95aea4f170f73506df575691df5e3d034b97c4e20f46422fb19da0ed9cf5815fd38e4d3566622fea8873014f92102f4db3e237ed0a2f77763e55dade4eab5b9d6110a2969f7a647f04255de3c4aa66790ce114832683d7e5efb92b66821f8252688c2bc43e3b27ce3481c21d7acd6654f8337f77d4b740e638445105d891b17783f3f14e8eadab22024087e6a0b9e6c1da447a0f50d55e8b0c9675241ce45f98dfbf0bae92950cb22096f33b106b833b52afcb7d113a891b94d28a71c997e0d74e99cbe485b5693385c31e16fb0db386fe27bfb87d2754a3b78d48b326ed11a76a4ab2494db82d9c2a7781b26bc704b64877eb7b568cdfe3f77eafe764349696b5761f93067a4ab413cc828dcea2f781fe1c5ca2fb69150ff91dcd6eca2a2b6ec806641c55b0a8c36c74646b0bfcef494d832d16ee2ac4da863bd52e14d6e293b271aea2a68b5108a341c8efc4c46ac5d2e77ecbe8420c289b1b2745a68c49202bf65447515e47ce622def0acea0ec144702dbd0d03ccd167419ef67bbe1d8493ad1d70766c5fcda945d22f3e51c93f30498fa64284d0678cd143a8d3ec6ac58ad628c2b64574c7ba2e04f6580c40b5d065ca0dae4137b5ded5f003baf67dfe8836b26529f3ec8261aadd124976f85f41454c692f671433fcf44cc2c1189958513815b551d2966a789428d0eea85fb4e8a75a04369aaf51df3bd619f9a52c686509b00fa09bc6680d5fa926f70104f093d0d2328ad413be39383ae0b51e34536eb6bf4eeffd091efa2b0e6786a51e3199d28e0b81d47110aafff1c243e9d1d7fde6b208c4049ca71271be838c2fa12c1acf578c44c0d9669fa973da2d4ebfef07477d8efc31d58db8ff1acf693d38f84c7f0e8638d938df95c031b7bf04000bfa2944832330017558975597177db3f9c3b62bed136ee3c3b206f2b719f40a9f513b72f89ee9ccc1aae1af80f37953fa939c1e5a2bf3c3d2c24ce46c175031673e92210ef060bd1bfdfaf6c8b0915bcc81bf2e2fb09e014f07a6bb3b9b648e719f815935530a1935570472b7ce6085b7fd98d90bc2a6bb4734e0e76a9e34a1edafd962432d8666d25a4e6f871fb2d9e29362c18223482d7fb63506c5c0750f78d92f8f1a8ee1674c1a6b19a9919156a435eab2472065474596cfb740d557bf95d544f623e604ae34b8231b177eb335365e7b9e68709203dc1ffd7034c7d5990d847bc987f4e96b1aa368d14fc45cc7ded0cc11ad448d82d41e95d507720cf42478b3c0d4e143666ea7dc06e2768ef894e42dfab365d07eaad816e936e586a7ee21dda15555c87f6df7cf94ef0360a067cdc828317dbeab56725c5509e8b70b56baf8e094700f6fa9f5a03d9156251276d86b4f2f11bd32245c9bf17286ce15ef799e30a49c106caa94dad6fa8d64a4bfba2e279cba2471a6069bac45a339250f8d255b8f50366e757538d63f76dfea72527ae61084653b44a74a522a7d9cb1621846c8eb750fcb8e2a9447503cb9d451bd2698be82a3146341672ddac12aeaa8dd4b9f031ab6d0c0dabe9fa5e9350ba83d2f482cbe96558d708e3c15bdaa1c9b400e8b3f0337fb103bc8246736cbc52cdd57ae545c07a7a552dd49876ef8b03695901b01aa4eab7c002dfc5bad913d8df707be42a85254106e989e4acb4865f67b9635bfb70277901c9699766687b3c1be786ae6152e2f1e176ba9c13ec34fa8af4b572463524b64558d2cbf4721af58d5c87e196ea8ef056a2657fc9556310c9f1cee735f13328bbcb23208f039c7d9a6a58c431380d41eb18792f0ee9703f6fa2d26c58586e51c88b51ca0bff733b8abac808783130830c25aa4ed8fa74628047488d6714280383f9d1202bbd96932224676798a765ed235e5d0e2b5cb2a73d2175becc89bd86c68b31efc3a46e1e741b65761aad5fe04a0c1283dda8a22bb819f7376b22468b0dcdf155bc7968daffd0191ae8731b6b145418ee5dc46439f5b6d723c36c354c2106c86da18c59de62048d83b66f294414bb76ed1b36d2613d1ed2aa54656870d3389b01cfe007ec37119fea652bbde968e8ccb614bff94383c88005ed08149d287e8ba6d1e05a22075c0f89bb2e5276af92b959ecc3b46280b969d605dd41797e17109ce8b8eeb163a9acf5443ddbd0aa1a5e9188f9728e9b748fae10c92edcced457696508effd1be225ea48331dd5879debf0457cb4deeb18c40f096f3bdfdd1ffebfb13a21e1f9354a49993a366dcd3301099d0d1c9e3d152eb1289f621f3ad0cdf5d47598ae4a1fab416113a42de0715f9c13560566f0c9c46a797184b733d76009e1cc4fc743567b0f7dbee6910fa2e0a93f879f9a5f5c5", 0x1000}, {&(0x7f00000024c0)="52bfe0458d91cb9eb19701c5f42bf4e04a2795293e464804026d7a32bf4bf2f236b26f00ea5d5707bf1564431a19e93c9ce4f79b709e6dc71a9bbed2fc5802dd4dcb1a5fb3f4022c102b728feadc5c6678269cafd06f2966cf3b37b190c2a3ea5d622897f587422f0ac83d2fcad845b2b2e4852f7fbbd516f08466ad6f5a8756bb6edaa13b1b4f9f4258e761212e10103bb104379707b459a036ae1d1547c2f6cf9532e6a59e0626062322b730a5ae9986f8282429fc805245afbd3b82", 0xbd}, {&(0x7f0000002580)="c52e228f063900d398ab6f885e96fe925e14d37a3ffccdf44b4f8512c8c0399cf757ca9423b5b9b86919021c8d23c9bba0490dcde264904663ec01e9be3e21395c26a8ad0d31c66c61ac1beb6c3f777d1c25f4c615704697c9246a1921e1f490b8b78f49473a818fe6e9ae308920f6c7f03b5330282837e2297a9703b691cc0ea54cc0d7b1cc660454ca99bf63aae03394fe115bee99d04870b087e001271220ba3a360836aa87ee04b55b7f89", 0xad}, {&(0x7f0000002640)="7f9fade006c73aaf561d9a2a5a6f1f9c39bf180fe09cbad694b4f680ac15ac423551fd666c9c674f347b946f6180fe91590d38edf20426bafbc0ac6f16b1f9a71e398f5d7b436a416c2f2fb854900382b01dd99a2ef7870f3d5be9580bd60ce26ad0d0c8781fc898fb8162b88240a291802a0219f0d54d5cf41d0ea7706c446b7a4fd0a854280c840557ca8e5c7dbabc799e1b0db8de", 0x96}], 0x9, &(0x7f00000027c0)=[{0x50, 0x10e, 0x1, "fad8bea7019736447e6dd67ec86d9f0fd301a572b7a021aec664cd37f32ed297bfa4430870e1e556f64b7631b80f136478c931c745fbde9eb0"}, {0x58, 0x111, 0x6, "c4e0fdfac05fac6a6833f375449eedb93882e071757c0bf5075d475063754f7faf8a5b7ee81bcb7bbe5f49eea0983d5ecef9c5ba60b54443acbb81305a88ae4d64d47252"}], 0xa8}, 0x7}, {{0x0, 0x0, &(0x7f0000003a00)=[{&(0x7f0000002880)="5b6ec8787aa70a7f4bbee777b7f5bd095c1b6bf5f533723c31ba9c570a47d184e4bd73740aa95ef9919a43b567364d5955030d7893a40858b3922dc75145710be4c8bf0bf1e2e284e79250dd4285619a20a52fee93a33a24ee33631301ac3675465b4e13a7270ffb340b1740b4a2c244093930bde222be031e920597f3c2c80112bf7a9942a6ccdc03d5112782728a13fd736702f0a6c08f2507d4ea859c2ce35afcc1dafbe872836e40ed585921315b2e", 0xb1}, {&(0x7f0000002940)="e8e0876e3dd5e7c8e11f635520a7b1268c18e62c9e23e78559e83b5a0e345001a74a8b965d0085c014d799abb0d10e95740aaf713cc243af9a9c1fc8c07540f7745cbd16461052510741080b541552b99e0b12eb9db9e287f81eab9f4a2bb7382802870ba65edea2b1eefef4b3e4096fab51b3fb085a501bf7b727d74c1f6dc992a5d4b869b0377c747f452df510d9a12c8a25b56e5fd562194eacdea84b17f48685514404e624aa", 0xa8}, {&(0x7f0000002a00)="539e475f2baf3f1351d5e8da824c900ab1b9b19dbb42d7e0638c388ec85d8e3cf13b90486e18cb7bc9da2b747067c38b4020da57751ba55e4f1ca5669251858b7ae84bcf5c1ffe4e31fc69734e3a5645810b6680c632c577ce0129fc67f7742eea39a6f5732b693615c60f9a8701dbf821fc223fe76b0a86bdab679187942ce9e0cdc5d572af6daf58ce502e5858d47cddb320b3f4ec6b5526a3f4d257131266519005711f96245b71c4b3cbc9074f31e95018f54fb35e6bbe5506edd5fc3cbd985982ae97aa9d7e9301adbc26f215634d73636e65ee936d7f77c6b99a0a975065351a183284f35a18fc156bb8adce08f47b5ae44bf3b47cfe636259e2b1ca00074d70c4919b90059d03eb5ddba0a884cf6e0a3d555e217b450b723fe5c91e15ef6f2d26a764a1d071fecfedf5feabe792f44909dc1321242e5c07f3c5b5d9cf7009dfe54858fe2945e26c83a917b21fac20183962005a223d645f7c74fa70cb8cdc5a7a28ee41c1acda1869b109bab938236a63d796e96d55a7cca68e4acadd0ae176bc828d38e68992bc8e13f91e40e75335c8c5196ffdd460a23bb4f585b7d6d974faaedd5eeec466914d2b78456d94149fae59ff1e939947ac7cace96aa45291013f8168998b0ae23d8b46bd3797cbcdaa8355e23634dc94876ed1fe8cc0131f82f9e36f9d05a942bb7653372a6010da76128c8f420aa0294f6773fab5da5c09cd138357059f1ab846e951015d6a4a3304a9ec94239cabfce18d0eca9e9d38b3777ae9a7121c839f5c8d379cf0f6610eddf7b84c395a3a21354c617544d8dda2cdea356638d6938e316a0d1461b777bb20d36cceaa422e2b06166e248a06bef37f43e8a213abf8253fe1c9050522853e7915bcffcea54de468e0c74046abf5c96cd97ca312b347801b3c0e52d60bfde539ecd728ec87022ff94fe099849929322392e8c467a0f93dd3f0750a3a06c23d5a3b2d74542df0ed63f944a0a730a73b0912dac3363359a8e1347e88e18ca074d1e9aa8bee56367174c42073a6186491a21c33c2918e022dc2dfc6a57b697334d277e54ec4c3a99e14128a669d7bf0164b95a8b1eab3cf53f4186ec22b9f2b75fe1cc6e2c2c4f520a51be58ebff5c3cde19b548a12b79d59b80880232dec109b22dd687d1491944a58f698ceec552b7c270f7baca65156508dedfa307d3853378718dee9e3373af5e8141cd7146804e87fb26ffcd448461a88e2b617a85a74c831d5a20a1d58b66a6524abe71af492b364217a5ed03fa31dd15edf7228d89f3ed248ec9ec7400f4e74e1f1e7214614ddcb8244d551316a6fb3a26793b830b9416c869243e7a40558ba47ebe6d6c7e31db7822a6e35000709561503fe59df54119fe1a8c4308bdb254e707e4865ec6d16315377e27278e9f30088be3fb48d6c9a5a6835a3c066efa46877d44b5c5142e82f8054433d882a3bec408bd0d4328f8fc5a595c74483fb7bcfa101d8667e312cb48084606dcca733acecd81d268ac36d51367e8abeee4b24c789070ce3410b9394064c0582bed44fc0ac2dc22ffd30a28eb39ebdb6477ba5b701e7b00bda42214b0b70e489fdef80de391679415f9b08916c4693997f4427a797ac55b4e10eec431a7cb427a1f813f89cc19cdd7b036faa1d6db3b80b61d96933d3244a057b6d2907af25755acf41b881f5539e990134b13751ee187f5c708621c6f199772439845528a6eedfca443a834df0085c065c337482f81483e56fea1e5549a94ea8c0ea1c84bb77770cf7625cc2555362d2a602087b636974a7e242e02142d9ddc08f2c422c9d43b9a3c295de820f521f8e9c245cf4a8702d758e3431e032007b6d99a29f68cbfb9e2cdcaf4d29e36507f302165e0c73b7a33e1bf7cd607f358b1c658984f90f19c11b0e038e2f82755775dd0a795410c92c5de8624b12ca3e1f147b3737648971859b70be26c4134f364f413d12ed32a97e1e959cc4c8d56f042c7da4e6f6584b36d8fd3028bada41c57c30c9ab979146bbeb5009906badf209f82a7e26c914050f5beec66463515d9e3d028608f1925cb050b755d4590abba28181e6213425365e9ae5523c396f4b0d40550e275f45fea5492f68e66b67e59b0f6a7dadd25338b7a0b6cec9907e22498c7a09d7ba4cfc87c680d95344e49b67409d2947decd94d4e45a85a973da73931e2d15be85134148125e0a80c558d7353d461f4ecb2aa97836cca337303911558d0c7a4b649956d6c47b4d2e968ecfd21d24558d417eeba0963ea3b50c140ca12576cebf27b97508668486d8da8bd3b840a55e5ebd9198f3674928ed1be6fdcdafd920ccfea80d6c016b11bffe2a92816304c1c2725bfe50b1cb8274e1ee6032727eb32270b446975ba08737349e1b4d59113615b01a4f1a0bacfc37539aab22ac87de1de3805c80b513f0ae146e2b9fbf880ef6ec7b904b302ef16b4e9a6957ab13ed2cb4cda47b86427cff92ee5159fa836f8bdb87e7f7b842cc298249e3e90aba87eb618a5e9a900ae9a1eddb849db6b582b9fc30a7cbc87f02cea6e27d9d9cf1d57a35f74df1446a7c4c9b0d5197cca3823d6474f20b8d4de15771ceb5dd9270baa147dfad8ee821eaf980da87b9167728ff06db1063ce26d70f83e9f1a179202dd1f0abf39383d91fc4f8e5f1cd3051b9fa5c6b7319cafb6208e72cab6254650152072ebf0e819c7a081f1c626a6752798997fa473949b0b93aa3633285837963ce3629ff3c6ba998e2f416797c98fb02ac32897662a65f2eb6b9aaf6912b638b8b267947ac036df80f0191babf9ee3be42a75505f7f07339b4c264a47be1fd9afb2896faafe1cdf2b940bd9f96d450f9e48500047d78b76a37d9d4b4cd8ac42e061c2242d247c1d237d77553db1389e051006699ba89576f4df34b79c1a03cbd734b58e0f7831d535bd86285ff1e8312099f6c56e7d697a7b6bce71a91ecdbcae28363193c3bf5334dbe5769c4470f1e8cf580974e45b6ea7a77a3231434204fe34c0263d7e4a7791bf31e51313fa2680c9e857fd7ee0882939f6b7810fa46103f0e9db48577d57c2761be62e8a974b4cc7cb1a6f6da25d3ab423171ef77e19ddd22eed00bb496df4fc9733650aad807a44c21ca967b0f5fa4f701b79ff366bb2a66a892dce62c3808428d62373789c2481cbe6daef62c5b13f5ff5f6a98beb0bdebb4c10662023337df55e50780a2c00d5727e6ac7a6341d4a8a0ef121488726a98cc97601dffee9ed6f5220ddfc1dadf216c3c4e7f44f826d18297ff62f1a6c3d15ce74ecd790684bb1fea394aaf32aaefdca411267489a1f642ba30120cb0c7d744e7dc29539639a40d4015155b67a66a6a5ad27e071eb697a240737ecffa7f17531a28592e58d856fb41dacab6d94b13f3ce2c56e67620fe71bbed22141d9e03eb76c3426a541da0f00245b47d8474b401a941d2592ceef5169bf4596315fbac2a3f8e17c41e5485c9eb8767a0e1a4b933519f318ca66238ba15b070d8aaf74f3fb44d6f9bd4578ae9cee8f0ad611795d9c25dd849351f35edf0b79c38dcca76dccdef4b71347a305769c6bc124848b732ee0bb71b3dd69b11da6981e370f63756645255124636ea221d870d1735a5f40f2e3ebf4cb5a849cc874d716a4c0058681840bc7753fab78b4236e321344e18d753d8c1062dc8e8609bcb36e5aa5a40e98b85de192eca5f96d98e810cf035c7dbc16094938a700e59dacbd9436283c8ad3da294513ef62bea7d54fc5e20fbe6b00da37fc87b4b23cfbde116882a25a3f4ea5149aa424f838370da71341dbc0a5ad34d5be9211005bb82ee217e6007d8cd3de53706a7eb455fdbe30477f00a7c43788545023f96f7a9de1fa8b6832da71c0a3647aba89a818aeb5453d9e4497dcf17a256f22e73c303f9c82f00ed6fb5495f3932557097de98d6992b5105597b1dd2a7141e1c77aba247e1a85aef6b37883da3a2966a0649d26185428888bd1802ecdf61b5b73d37a2c111eec9419b4d86eb156af755f836ab03bed733b269bfc6170f6c178b49fa17f5dbf593df2002daddb6daf53e0c1dce681b6ef7f20282279505e820edd76a4ea8ed17f47689015f3bdf5f823260663066ba8db42283ef05fbbce78c771079c3eae046a322f257cdffdb1c854c376b0e09079049321901470511c6d34c38913db483e721fbf400f237fca0f123c61d45d1974a8825ca7233a0bcec55bd3e8d86d25ab2fff7075e966bd1b39dda95923883a8d5810197217548611cbdcba60b3d780e687077e835f392590daa10cf63c549ad46b375a1705f8b32935e4366ad7a8c2ffd414db283bbabe96c3372a141972aae818afea89e89286e2f48f9a3c15e82d25dec80d8fdcc4f5c7a350d4226058bb1be4fe0d6750fe3c45ea0178be62663a0f7b4fd29458cb56280a191bba164ddb2ed3ddc9753f1e595d218cbda1df838e9ffdfee2a58e67aeb182e56d8f988d6b6044c996a98309dfb2c152b7b2ced7dd824d9b47beb0846b7343b872f9cbbfacd027bf13bc9aba6c0e14a4e359706d940ed3ba373028ccde42af49dabcf6bcc3590d856c3d0c252cb902a62311ff811abdbad0cee77b0d5340e2b4ce9290bdaceb9d3fadeb86c3aeb992fe8fe654f1a993000a6a58b0cc7920b5e0c4f2a7c18e943862d81420840ee432fbb158be6b46a2ca6bb4d6fae44c2383b4989c5895d90a7ee4cc9f5fb40f0ecacca6a4b1fb6d26404b7a6c4a9bf6f1ad8e27b2eadb3d6ab4235fda7146fa64ea9a8d04520cebab2abbe9620d4491619cf37f623bcc08ef1fc0d79461833ca809c183d5de845860cdca813209094872c3d1f15ac7f7e7a72879c062c45c5dca0d06c8e7aba99c47f46e7e7f1844608f3810d612730ac550bd74373410317b2cebf8482469297ef61e19bf415a76181b61f566c0400214837df3d259b9892b50417cc08f97758e329066258220ca1b24ec28bc86286b29e5ffd31fbf4726dbdc1863cc5ad14ec2172dcc551acb7475771e667540c6f57abe26319a7ed911d8d6557979e8cdf00ff0a3e7b2d747904e1df67f5d85b5c7dfff252702d800f6b3118f67ad70f98e3108f9ef5aa6061cdf48ec6425ca3cec78c53669cd91b0d0adc2de67feeb8a6bb1c46222b6af03a6e7d505e790c968ecd146d274c2ef5ac06dd745c36e570afecbdd03eae9034f202a0fef33e59d48896c6100b85479c48ffc4d025e1e0742f51dc66f26099d27ca14011ae129293056c5813601c5df7d448a4a80b0df3888bd1a309090088fff7659753607b26e62444842c3e79eee5fb3c339981f974653cea2027250a960c1583abe45befc590cf2d5d2fc371fa89bf08cdc7793eb8b5df5ed77813791d043a2aa1f849b5d881a7e2ee9c63178efc527828a1c01bff5ae6af44e786d61c34ba75478203026609581490d861014cefc744950b429815d16c0759acff40e7dd5643795c64dfa4e2ea679de4897cae179a4d662477c5a7abbd68f78cfa0c27e5e39f163b3a35a96bd090fea273a46d723128b1ac0c7304f24bf9fabb2875bbdd396e3f18bee5fb6fce4093ab1c08a48c75e3ee4cc85e89788b5afbcbc8b149f15bb7199cb2a00f8d2705fd1f9cef08ae4222efeaba7e58b262c01f03d2f63d3140eb6173e00130b0481ac3a0178347a133c1e5346c9ed80e2baa5161d551997f7a836871b897a6f3e3b65ca8c42b36dbd1f1247c50e96a802a94ada317aa627fcfc7fb4fd5db66e861356aaebb86bb201cedf8607dcbfc6a189644d037582d355ed32e48f72c1fff7b2fe6", 0x1000}], 0x3, &(0x7f0000003a40)=[{0x50, 0x11f, 0x7f, "973ab9245891799258960afa9b840b6656defa355a4b1304ff992a8cb8ce0bd979aadb28655ef2be4d8bcbd21603694b5aa6a1f9b90270056dd2d8c1886b"}, {0x70, 0x11d, 0x9, "704aec4c2b56f6cb486a87359296f59452dfcf32a1c768065a6971b48f2401573f17ad6167a1cd57fb38e5001ba159b649434c204a07e0421cbf724e63c715e780772d475000ebe9381e60bea9c571df9c06ea024fa8b739a3d4bfd972c57260"}, {0x20, 0x11f, 0x20000000000, "d545c01d4e085efeb27d12"}], 0xe0}, 0xf91}, {{0x0, 0x0, &(0x7f0000005e40)=[{&(0x7f0000003b40)="c8736f065cc863f1ba053f74ae4486b285b34059dca3b121af9dc38249263e2972926cb0416c915ce99c560c2ebbb888397255d54e149c", 0x37}, {&(0x7f0000003b80)="6a01083442e3605f410c964ebfdafa5b8379d0fbff7085ec0c4eb571ab349abda83d9038d77bde87937e688a25b8c64750d231c2d6b42e4af3097039e21a9dfca8fb3f6a90e02b0d1e4ab1b6b63c67c9f7eb8d13344d0fc1c7eb153678e0fbefc359af50df0354c08ee87a37d0bec037a4a76d8f86b0f711731f35c50c2a4647e6c0c4b779116bce6b7fc267ba60e07b3256bd0cdd255877361fa4a5343f2030b2070bf4342d1c91218737fb3dfebba0be830e300e499999db062e612633db", 0xbf}, {&(0x7f0000003c40)="3d100c40d46cfdbe51e796df300c867a03fda5e2222ae74f078c79ac0b7ea556f7f6e5ba746be8acf7b5b2dccc00ff98d3e2a5b8acda032547e85f751245441b3864978a7a5defa6bfb995c760b96382ac6ab412aa5cae16e7fd37211065093f008b1b1b5d7e4d8919b2dcc4cade8ddf95be6e364e0ccf8bab8889a1e7ad6b757ea3779d25a8a942146d174555db93e2b563c3225abe65b554ac523a47ce20d5e6c26e7f6114c16016a2ef47ebd4696d34d7b53df6120e19b3", 0xb9}, {&(0x7f0000003d00)="270b914a4967488921fd7f45f8f64d77fae0840561de9ef12474e60d6491c82aaaccc75dacb3d72690dfadc9b59a39871ff06254cf73fa8e978d46b0ac38537d1569022525db8809817e99f6a788176f76286229c01e53290047bb618567ce17565d54d77aefe7dd0082e89015796c15b2f681f4feaf2f898e34445a726a1658cf875de6b5c1c324f7006855be53bea43630944d793616149d7e317e8a3c29824a08c723f64da27c851a620bde4aeff2264fdab884873ea1cf9ed7292ccad48c628d61d605d3e7e1c8bbbd11f73de4733d3eb9", 0xd3}, {&(0x7f0000003e00)="2cb0107b7ef857b1392305c0dd9b17f84623819bcafc0414874d96cb47f0d1e532f36b6d6277d2c1d689049411f9a60c5393c5899176a4", 0x37}, {&(0x7f0000003e40)="1a78ddc20d201c77d31506f07fda10eb73a3dcc470f2becaff43bf98c41acd30f4a2b75571e001e6e757cbc2ff2e7a3577e24911a4ae774e4f2576c0e77cf713b4b91170b5ab8c7f1bf49dcebcb3b25db75de827e13a30bef76cc67ec940c7af9288b411e358143f5537a18d364ab98d4665fd8ce833dd4c1ab0bc7c55b068d1f88d0b6c17c30b5dbdd30797b6e48699e715e9d15d8677eb819a3c8265201c5a8fd182ca219c30c4a66d6a6a9858f6fb71cba5d1ae6a42b30cb74bcededfa7a08c612634b8ab8c94bbcbe005f957b3f7b98259f2fec9c2a60eff213eb1ec789add68428906cc0af1802fb1b2f93c3697b29f0b487ced019071b9f67b29af86a0689173a6b71542a1a095153dff2d79ecc186ed5c6685be41207c571b5d962066c7068691273314198964f91444175515fe14789d18df5f62faa9b8e164ee766609e0507ee95aeb6d615d3e290c354f1e1f45045ad7fe35ad7d9b3a95c5092bad3e3c624905802c5433dd7a2a0f916a727b59e660c5bb7ea41f0200562770d1d87da8b9cc00e3c274da606068b4a92d7e3afbb33048a0cd8ddb56c9ae20ce54fcc14a3eaaf0b1af77323dfcc2ea343772b7e3a8fdb9097930478ffe80e3056da9f1f2c0a381def3d0e75112bd39f4377628ea48dcf67ccf839424209e58b7fce9274dcfd32915de5f243f7eab7adb6ec3a3a48c38d7a8488f0ce23b90fce82f5de78c588fd0bb8ed12e48e22346fe3be82ec968797a9ff60b5d5ea70c7ae3a1b72b7b201f939236cfbd9e74afcc96ba2527a4a29e896e5795b45460fe29cc64ebe0460549834ad3cacf5d208ba23b787afa1bdaf78b3ceeb1f7f3d4e20211496997fc08117bf47508c3838bba70d5f59e511a00d23cc44a2b98f2763e45ddc15f1432af5840c6a266fceac50085a1a549bbc7ba5e7b77321299502147e4acbce2384b6b68dcd41fe98279248561d22c0c5aaa7120e52070a6e3f9bbc502b1e3c9fb6cf48c56ce49cf67e81c34ca9c92b30eef7ea9d75e2a0d81a3cd686da1c63003345660a002d98d569bbcd783de51e3fe111f2d59a0005ffa61c2e3cc9635fe94266faed4076deefd764dd3e8f3e3a0298c5e07f9126e9b887917c102ed9fc84a55fe20240633b2d63e63a0632ddb5a39856d1ee8563945cfdedd269b4531988e692ea86a935fd7c565065a3a5f63178beb8e823684db4484c6d84a3b29dce10c6dc2920ccede8e460c30d3107bfe0af084586f96393595851a9ee850903cbca5d8ab280550ddd4909206ba569af2bf738cd0c7389f289d10b5cb29eefb07af2a0c46a3b867e59370d8792e7d34cbdb283ca6436611829c84bd0fe98f8d806a48bcf376a01275a3845e23cb566d235f23e2ccb948d57268d1683f43a49c750f5cc8bc7e8c99d3046ee10c82119b1f002bb7649f006e8fb5e3204adca5d8db132d3dbc0fde0818339df624ac180309ede13d2428b74e38b47efbf630d8569cd592e930e0e5ece355ec9b3651b63964c8b39232f59df48ac8d7f7dcbb585f1703a708589634c6b65e844d8a57010a08d43c1ba20651b2236cba00f602426abc4aa4e47b5f3dc555098d66e91e4876110aaa75e73c3103d93beced18aab7b2322a8510a4ec02cc08f234fac96b7f0bb66361487634965de59128f0902f86bb86d30579d653120b6af8fa30406e64677501ca0403d2e0a618dd8744bb7b3fc69e62d8304e2137dc1a452010777fbf852cd185498f303aea3e0d96fa9c69a818cc3791d23a0c80eb3c6e529668c4e54ae530d7162637f6beab6c549029f12ece7d584b972041732058122f08a6acafd2e535bd9e5da12f4eaffc2d58bc275efccc0559d6ca7bf6001da09c9a2fc1cd6b09abc41192073e0ffa64f9ba03a4f27c6a68fc0af3d2f77781e16493ce6099aa431515c636b2373526b1c0473156ee36089dfbabc9770ebea120e207d4def6260ae5d703eb7471ac60de83a528ec0ce73f5c60a9960c4365b5b0794f8e7cd8930c6caff32f8c423b11d7d1112065b0b0a345cd90f0e0c8f634abf72e4bcb8fead311bf94fc0dd7ed50eebed37a7b974048826f8c9710a0be355fe9b718ccf73ed18ee731a0e55b6d719f60bff9c810fc41d1a93071958018bfce9f9db5f3039bd840c4629972aca8884c231ec057bfecf9103c1db9df9edc521b45cebea625faaaa594f2db8653f6bcdccf3ef236392f3d2df2b115fdb4a4f2335a51231394815bf0e7259012506968ef08dbded45d437b667481901ea111136945053d143f127d951f61a9f341862d6502ae6f743975be7153d1d614bb4f68c3a7e4f44959f823eada1fd480c646721f1bd938ac3493fb9dce07e3d06154014d79b9f6de2670aff2ee939e3301cd2e8ca7560be7dcef96b47408896353f99a96245b69226fb885e06070964193eb62eeabed318d354b3577f53af33ad22df7de55a7f2c3f2a94bf3f757c9c9137afa224c0261d07e2a68579f8b1da2b26460a69a2a2a78d3c75fa31a206508f266a9e7bf30cd3baf896edeba9bb5ab7e16a1837c648c25be35eec31440ef9a85b7b9d9600049fe6cc35c82d6e31313636d3bdded46beb2bb6501c27781e150e8f2b2882df7bacc2b61b9edc2223110fd8dd8bb8670a0c31e4373527c9bb887dd4c7e67f96ff76ce3bd6ac82d3fa21d1399985c6ea85b1e461eaa7b10b17305636a4b951c640b524526fd7cc0a49acb80e4e60eba4b9a05183e3fc0af610f22df5cb8fb087c5ee95b90d8acfce26595aa83af932076b7a5922005ab7baabac1997aaa5ade55b257587855818c29e7a400340b45f680cc28b340310c7ae1ae64e6330b7a837e94feaa3205ac9c8d630c2fc92b7372db7f3a638b96174ace1860dec43b32b7ba8fda29770c2d340b002dff2711a1160afb5c26829b2e72b6a88d99ce055f56f7e0246606b85e50ac509058ba16a29079cd413c3e5243b376c86f80d40d9b9ce60eceaefd37abf2e9176268a7c05126e2eabd6703a17e4f5c95deb986d9fbda47c85fb01753b070367a57632f68c436b7151c668d62ffbb08c6f513d076679a60df944e844c9d2d25af27a9569da6e64077a0d4a117e5a250b7eb34e9d3efea981ff84893a4b3413f80b134f3c5fe0145919dfcd826f80da6d5a71cd8e8b1428febf11a5091597d51bf7610013e523ed39f0b4f7c6230a160a9aeeb7254271e2e2d01bbafde00145eb110b9e78085347a5dba6f5a24f43f3bc164da5d56d2ca7dc35b29fa400b20d4326c59785b608e20ddfe93af586c9dca4d94196116bd8f489730a85bfa916866f07bbb90ad5b0748bad3cdb2fab0b51975640b52dc63a5f2494c6ca595f1cfd1197ad3e17aa7c5c65ee2950ea151cb58f209c8118f7f82f31e9a47d6e25b19050813f55a095660676c86959edb68f15fd0000e1d09c9c580b682e0c21039e2cf1b29634ead63ae59129bfa5046c41f0f7598195bdfcb9da00ca2018e8ed908d461b5790ca55a608b5b3e3bbce6214ffac75dfeb35bbf6df8b1745a67a15337b0c3e840b534575a9dae320fc5cba10af15723e05c975ab64a26e5324df923d53c2c2a92d2810e72b934453ffa6f8d612480906c72e388029263b84a470621d6a5d06ce789f077498122557c2fa6bbb6db95cbe603d239b640773676e930e495856f4dc925a60c3d5b704b71d968757217cbd6aec70a30da9b466505d25e963e1826a42e36c64f3f242dadd702bde0c0e731f73e0f13326255a1885aa13bd55ccc86f131dab3a68a7d4f441ce3045512c293a1e2faba604e408bd28d4dfd2c1442f029ba25bf994292c1f2c03306c3b0ab3e9cfe70ea4a49bd27c19931fc39ad3671dd40daad05ad885e74a6a30cdd369db21a3b53087fa128eb0c558f6d5658c9522a8d6677917783151702bd665c5cfea5d6b8b61dcfb73a31fdb65c62f9c7b918007a7e037e9a2deafa8649329c748c27611466c16ba791b17cd8e4aeb0cde1d5b5843170e4ce94306091704013c8ab4ced44d03a320634723ca50d88240d7651a6cd2455100d564cc7b2d919d1453e335bbf1d4cc53b6b5c2bfa4fd97dd3242785be2f4c3eab3756b6bf2ac79ed2ff7d0102850990cc028057a8170eddb4f3538b6f9970a2523f533537b20dd9a0a9619f52479842ee22aef7a016756dbb023d4e328f56c2a80913598587fdb2468aa7fb7b9788658c8cde2d985625d595c925117e7818b011a8a0bdcf3b83c8919f403aefcf5a30f8cc22a64a89ff26e33eb1a77545aa69e60dae80ab31f75eb628c9604796303c112d05f5da12f7492b78270925661acb28cad52c4dfc2081083c51325c5949a01fa6d0ec8914233a70d541a16eb9c022f703cfed39be06fdab953fd368dff1dedc7f088ac732c377c38b948da2782795cfb566820171af921564993203657f0b5b333b7e14acfcef0d7169c52d402cbf7e6fb09c2669dd3aa254b493f7a1b84fd00ff0a0fec64c9d44a36c658af2fc5212ef57fc864ed3c4b84abf3a8f41d326e2ca75ca1e6797a35e0ff62ac5f954d69e5e6e20d1098be78487d9ec153cc0305eef6e182ce41e3bcb6c2ed53142e7c789b93ab6305536e5bdc7c0632192aa7a05b230fa5f0b10df9418917115a375e4ad48113f894fde11e876e093a230a5f8a972e03ccea85d0ca0a6518486073073ced220c629e0d5a7f46a14257910b06488508b6f5d4935cdb77a1a910c0a5ef7297e1a778f95f259d822ef7df47739614ae20f257ca6145ec7fdbfcc3adf706861f1970a482d8f1f7569624c44bf48dfcf01b31cde646a764c2d6513b006e31939462ec2c84748707b35d27d2befacd45030ec8981d41aab1c770939c5688586e3006f81103eda14489090b035c5250386852bfd0a0e72e03b0af18d5ee452e07d2e9228a43839dce2916bb64811be8f41fb8a686faa875f0bac0c971b617b6c67b4a52e42f382f03b486e305b3ad2b3ca0910e2ce3f32ead9105230fd9134fdb959e868ad6de4b089f6b8e3b9ade564065c40b155febd9a1425c41223f8f24e01bdcb66c3cb5aa39647a1cd1c0e6dbdffad00b81c4eb66b711a7c939e91c0c20d290e5baae111c76df8b40a61673a57c34c2465008fbcd69889ca65c29ee01f6ff962bb577405ca87905e07636a1b819566e7721c4077bb979d7287b35e8a71a9a52d0018fee573b39e60c16dfaa702c00932b7d7eb82b845bdd64137ec11a3d7201e254788d1c5405b4b7118b7466206eb8b36b4d4b69e9fdd1d32295d5bf5b9ed072d6eb9a18744d53cf5f2ddf0ad13b8ada7d4a027474e4b5798f775d03dfef198b0d24de529b3c0400439d4b04c7b5854a3f48e90c693a7adf823578de5a221069730a104eb35994be272d0b716c82f2407d0451043c080207ddd0d8383c3747c12bbe1e64121ee11d94fe429513d70d6f74ae1072510c51dd30f03d6f6773964310d52347332327e9d25490cc6753e236d66bac0a6dffe69c9add74be8a0d48baeb5dea0a44c791d6c956897899250353063b580a671d815e40f93deea54b62c1053f2e76c25acc3ec9864c313c135148b4a4ecc9dedce306dccccf1d181db81c24dc9455adb353acbb8704e5c85e7469bcc5ce698c300288550881fa7539ef6d46443f42b07022a62f2713c2af66c09e691d930eeb5aae9ecfbd6f72af4417b75ee1d11a37c21c98387a349216eeb7a1985edf901a0bdf9066cbf5b934debd965e1cfa3d9572458e3be485b136ace1e11a5a3823ff52626aac6c4b035455a57c83f0922f2d52b36688f9c9dc57f4dddecbc4241f2", 0x1000}, {&(0x7f0000004e40)="2d3bcb509105e39f18eaccd2436e7ef6780de2b7a000871b3270403d0d8485627b2e5a47c5205da6d1db4b6b4a9c98e22277933b5244e186e1ad7279b5ca108c416588b699465db6f9fcbe5817ee12a632f37c50dd98556e495e095e5986a240617e5926d03ccf90be6c5c153a95a2d891d40723b51da540815109a0dee4a59bfd699890be56e8a29e0fd2276d2921088bf06c0ab50e3b101314dbff8bc97a89ddc07de2e5cf246d22e4764ce38c166b56e6a3d9b73426f8526171d657605362006f994721428c10c2a156b33a5deb2e11bdb321617fd9218d39976d43b675578140193d140172fb8dca472ac714311b1988b772c4eef2012c696751703e2cc42ddd60da9cb717feb03aa26bf5b32e33bf01eb17cce95a8794a77b9365eb1c7719d09ac859c2071f4cd4742c72a7cf67d44ce6710ff445647717eb8e2ccabd15c030fb17ffc7c1f342c394b49ba3dbeadb258ed9f4091c5501da04e469dc0be5b635c973c717fc867c9b937c908b043f66ab8a1f9b0e603df7792d03f539fe6c866820f0c489a854f560f2adec57021130650022220f8c190553907898463f05181ece575e6b3b4b6406fc4825388c6721418391a41be3b0b870b1143ab2bc833822d8745a93b5e9451ca7ccb28c9b1e1b70bef6cd088927dd1f88ef763b85717f9add5a740076ad86d12dc37545e0d749f37c4434810a588c66fb35e071fe1e17ef7fe166056968ef497a0bce9207b04cd1278148873130839d33a30cb2ac359f7e5c7f64b7c3c069634b55ea8a43ff36622bae3227e118c4ef57b42299cd792e99fc1bb7694c0da48039de63570125a45ccdc0964da5adaf840486a2ca290925a7761fdfd7a93540cead4852e8d284f398ec6a744f332ef7bcd8a00116ee7f6dc0f25040f8b5321842e4789f8d1b21e31aa47235a510890268d9a877fde34377b81c996980c68515c4aba766abed71f8956facefb3da84aa6d6456cec779ede57a6854ce74aca21c1485eba9dd8b4e5740468d9200d4373a4fbc85b057289988b3017c4cb5aa2737af46f61997441061eba49269af1189c262d1b98df0cfbe98c6d6621359ee2c3d03b3dfc2f6dd5405bbc837158dfebbca6120d16c21f4071fe51848c4d598f4d2da516e01f8e1bef2529fbeff3ed951fa01d08e0b60e1c540509f40afa5236ee30c1a1ec953b4e602e50cc109aa6a78770cd2a91c8f1c2f0305366a77ad4b55e751f0fa39d1fde90a11be42093a5f3dddbb6112336e5fec548e60462c7b6e7f036ce84b48d07dc2cb53320145855d2c4903d011435ca2db52de31a33af698524c961c754c53e7bf68059210a386d5c7601aa815847291a3a7c20837c3eb3a56203deaf5e1d206df98709a03622eb1a31c4a177b24a84911b778300b173a54c9982dfca8ddb26958fe89d5248cd9ceb07ac728df3d599d5c2f304203fea5fb758fbfaaf6f21957f0001b577b7ef709a79dee18ee917e791677dd3022cbcb7644d8712dd25e08400f78dedce5504dfd75135bcac7aa866a6059cfad14bf75ec5f2228c545d3ec372ab9bd94d4c1bafeb0d5de42fa90c772ccd582c772c672125ac2f117a03c233f68002b877ff1a9decff31bf5fdace6079c67679123f9ccfac8a028104c9d776e964e803d936e0e93336e5a200be4154aac5cc86fe96a919301ad82e2336944824738209fc8f0dfa348d7511dbe3f765c0d66df2571e84cbb16950d62fafd57f6843c942d7c87f61a3212f9deeb0bcf5274a08ac0dbfc1761c9e501c2b70840ca2d2c5beb65b028c4573172d574a6c1f6e0111b233ea4525fe474266f8e8a2bca96f19fdc32b7d82aa5e2f41578bd6b073d6b686f25ef2a9a26bb23dac2cb1ccdd156be6bc2229f02b19394f7dd2a86a1c9c3795b299bfb7434255a52e45eee96cc4bfd6217c4d0feaec1f3e25235a2aacff18f1fa82db0e73cb489bd04f06d1c77879eb9dd00c52eddbbe3c283c2302b5f4e19734b55899db1aa458af6f68da5f9ef07269061d21df4c970b71cac7e3caee6eec1ec39927d76408879e95e99fc4c9168897893d40a0a0d7f2cfec38574864c6f8a17763c358b9ac84b57903c5f671e25212eab478a99d2f62095695d434b129dda59f7f6761e9efb4426bc89921ec8d28b05605a43aacdb6120514aa1c1c0c5eff255c497b11ee4ee722c78d805fe6a32bc6c47a19bffe1c3bf3001cce7158fad6a01ef22e4be3cde9f74bc44aa0ad066cd254a0cdb670d39efe6b152e844987c983fd77689ade903dd49094dfa052989de70269aceffc4d398f3dfb4ac5fc8e0161bcc0458e6e6cead46b8d93aaeb490b9d9f3657842acc774f836a849355b7c084a87609064fe8b5218b0340a33e2affc49952ffb10c750c347d60edfec99d1ce5054d31401c8eb68a08e4a9f56b7ac282a738425254828309b1d165d2ce59db50eba62eccfb251f682203ee75b1d3ee7bc0540c29a78fc6f83e97d9c7cfaf491afaa60f2ac2e343bd0cd7f391cc4f3149678a2ae578bf06293c0635efe737bbf697f45bf02db0e97b4a97f2543dab26f005009152620b0c2698249ae73e0b1513138090aecd6117394af7a00b0585765e9738244144c1b8f5c79d39ea2b6de168eab66ab3b7328ba63e35425ae035ed7aacc1cf9a0cb404e3958675f0bb75d74239614e21156cdbc4ba07913c64d9c0b839e766288284e4a74073caff125b6ffac83a5c13a7048f436b503bdb52c17ae323aa289d9a47c6e0a72ccc041d99539ac00e87240b5e596b22132c39fc2cb4e1b504fcf333fee0ec2cb3b49a858b23f0338e74f6dc12867477cd48ed708836db161983eaafbea8e2994d623c8e251f43055e05b66e3186bc85e391c8cff540aaec189ad99b79fff03c4986d9808d3c6adbe5016a6ef1a965c23853c75770b04fcaa1fe697059aead00be1d3fc3c7c29d2d3b8b2b1bae639d62f78cb90d5f3ac05a9d1a62a5eef680968e43b3a8e0df6e540d57c33d89e8747e5abc02bdb77342c32d603869c938a0515a524eb9df5b49c327d2bde8f3d6cc7116e65b94e63c9cbc52214c3d5160dce08979ea363b79deaa683249f56c7b2f6c8b1378057f2dc49b95f0cde74503fa589ad485621c44775b8c45062dd81b577486cd1e9dbb8056046dfd847144ee96676dd929c8fd8d71a1fb926b5f1ed34c7ac05d9fe49029c2268a139fc354610adefb619ea5310dde52201fd2d365e034e5daf1a0678eeab896040f122c7a65031c73e25b66ebda45f81e58b768520408d4e53ef2544310e4a21d3755ecf1fb5a37280b222033c19bf5f96efa8e90c2d1b0ee33cf13b24382f1396432bbe1a6a1343bbe5b69567935666ac8dd45e8ac035889200f03da2947f97ef2cf8244b2247bb449a33a79ad0b361f1e8ee85244823743af90f9dfd0604a547a35c9f51a6ef10cfe2467a9f9501c4c01efad558aaad481947f70ad991017cfa9760bae6142cda6763ee6e7e8177a0648a70073eb41309af4b4bb5096f1392b2751bb32bcb1dee977889374fdbab7538e13f04d09a99ef9aa3e0288b6c759072315ef44c613bf45bf70fb538bf1fd839ebaa35297cd5a1ad6b35f1f1531887abdba1999458761b1de0f3aba29aac61d291a7185e6881749adde871bcc9049f5128cb6493f30bb8880c47d7733437217141468736572287f157bab560fd7b478e41eb937725b1e132bc2f432f548e0f7f0d364429d2c85c6048e51a901664d0143645745d8e84dde63a09c3f45042cfae960c12ba9745dce7ba114eac878ac35888fe897ff454055837257bc7dfd9bd58095e42c937c667dc60b83a16a54ee37afa6dda4d5213917343d60501bee1e6e92e6fff322e09c89a833f5592aab45db3eb17138133c9c83e8ad94169a59180ce8104592fe2dc8c4450c6fd010ba0cd99fcc64502aea3218e3e07a7b67602f8b5119816a74329fd3bdc5ef29182687ed508600a74cef672ea039d0a49771becd81eb9335f1ba0e2ed07bcaba102e17c4a19a5f5f1c4df6f17275dc158c6e8bdc6072aa8995b9f019286455a73a5ace86b6d768ca7d436e891ebaadb83461f7d44bb784996c573610b49250deeb8c4def0a1c4eca46baa067216b792ceffa85a5b8abb65b4dadcd8bd1b7e3ad24e8226450d652bd86e09d68f19bd5d585bd711b30171faa68af34742596249a3e6e3600083c778acdc8b825d92f61fdd7d1beb614f58f89a82eaa592737188997156d103e142ab2179d94e62ce2aca36461ca64692604b6bb4b804b13e28d6476e4ae9241b1065f01ef3ac6e8adb669202d070ec84d21effbfe6bc797548e148c7f2fd9025cc7e3ad41d91511a3add741922dcf9550f9ebe87c895ce35b896695d09ce61f3d1d4fe7cfa486b764f0c875c881a6d791e86809bb46a02f74fd92dde575aff14fb6709d55feb08a24b8e09937dd6c405a2aff98d85e453d7ddac3eabddcb58f6551ca21cd09141fee4d7989b1a9760a7ba234525d044d45a98646bd39ef98326ff4f58c09364d504f2f17f097ff3678b94ab82fae60b2e49cf2e4ad3a36553ae94f910687c25f361ac91ae31f6626d36d7e14b7528ebdb32bd9636324d2011a6b3a6872f50d0ef9c3775d8ec40f56710040d427756c108740cc741b119652f352be03fcfba104be6a9e0a6112ba2f2726dd99dc676d00d26c4e20bd0e64b6b5a6f2f71034169f05f7a4aa02aaedc1c0024feac34acb814807fcd783866d6b8107890d288500720a777123c0addc85f665cf1b7db094e9922634008281a121723be212523bd32a81a9f065f30c71c6c973ba2ba33d28bb757a4dd00720252ef3400176eeff06fe7f0d227134a98b5da0239b42842ffcd990eaa95ea7a1764b1169dbbe81494e76c222bf12b448164f0adcf98aaf7d225fb2a5f66971be1db50ee083c7fc9e377f6d91552646a50f820dbe83bbe93c9776f287f9b4a6310f70432237c4cf57b9b0282c57c85de9ca8badd0c687163f81dec5dd709b46b128602dc4bdc6b5c4dd5eab5c1652328d2dc76a12fc26b33070c69ae205dd799813c36b9eb1ab61948c472f346926f17cc479ab45309b25ba8d3dd71d813bbf70bb2cd6ebb467885830f863f5aa61384debd79285bd4459a9d1135498dbe8086e401e36fcc4d00bb7777c96488f542e8990696f932add10bd026b7e0fbe7de422e673239056676c7c523a5f22528e6334efba7fec2ceaf3785cea590873b842d18fab9bbd72831228b5b33e80b21e2628474dddf9d1e479c7e97eebc0b49cf82af8079fc14d97dfad2dad836b868fa14f2b5e0f38e01ba05ae375fd475440e4225a9fe85e88a489f351b7653f00826650a819ece5568922d3a4ff59ae7315024d81fcfaa1c653914c8dd12df4f5613345e8a119777ced741676c1fa9e41c38d68e367b0baa403ad7690a7e063fde9fce0bfe730eab368feef523f720897cc4ac37ddfe4e5ada29032c887014e7b10ffcfc72d2d16bfdcdcf468b839306ac673cfa0de295089ba40faad8f7ef2a33dfbc29e68441496a03778b749e8e5694d639340450f618b3a11275d086323bac028d2e4a676737a1ab138fd9b425cfad515d1a070c209fa556ff3ea6761ca2c34661f5686106ad9ef34a61248da728134a0c84ab988bf0b24204df26b28dc25a7a96af1c17b59ecf0d40869a327d13c8eafc67e1e9e11afce1ba65862821fb989e96f80fbc284a00cd385cce1a10e9ea824dc9bb983c7a4d7d3714a672218c1275e189d8cd9f42c75d0b3ab4077245e662050fbf6819d3f788bac95e45350", 0x1000}], 0x7, &(0x7f0000005ec0)=[{0xf0, 0xa9f68254841b025, 0x1ff, "18a31a0c50020967ae83c0b89f7a6ccad1f5b6154f2bb0ab6dc3e212118e6572eac1c2282ff4f2eadd75a0ba5214144f839c53a0970af126773cebb0c0487283d01cd50e850907f5c0f735c4c0e67d510c5ac9280ceb8a3ffcb1f59f643425e45e7931e3feba912adb0272e2306190ecbd332200a833f6804d53fe41073fff3db334a3a63d8c83d43be5a6ab23a9916ac7afbe3032b94db39d1ce123b8717be65909ca8fde1452d2c1596d2643c8c57a609fc39f81fe0bcbfba3477890b26bf6d7fb5a781b1bb93507b23589390b62532cc4d16b2979b354ac"}], 0xf0}, 0x603}, {{&(0x7f0000005fc0)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @multicast2}, 0x2, 0x2, 0x3, 0x3}}, 0x80, &(0x7f00000061c0)=[{&(0x7f0000006040)="fc52c22f5c7ef3c3263ce85ff1d15764b8f929dfdfd34238114acd76fffe0f70e43e835ad31d06aac9496c6ed7518b177c4db255131105360747c5962a25b37b57a1ab6f6dccfc94f6b5f3bb5ebee7870332ef151e561e4707f1d138e28de4be266583a0f55e49f8112bd15107b8f7da9a6992fbb33003c3dfd2837f3a8e4dacd08532a27aaef6410e81a11975735e5ef50c", 0x92}, {&(0x7f0000006100)="2b42fe76421ad9eeae443f2b1b9435a781dbae355488cdec72916bc28524bf4f75716310430706206b9732dff27d982a3d1ab0ff2b8692253c5948d2147ee388cd8d1b25b239bf78cc6b922818124c7e5e2443189b963a175f148ca18900e78d63c5356a4d1cde30d4862bd2a4b1e53179192abeff57efbaac854d739e6160d7805b8f7da9048d37c442a2cbda12ea073debdfc4ea3ef9eccfb2bbb05b63e2c1f36e02a04be6abe763fe20fbcf9d77dd7caef0272c7b3a", 0xb7}], 0x2, &(0x7f0000006200)=[{0x60, 0x3a, 0x2, "97ff1ca23e1e76870270fdc00ad56b6e72b89d3ffbc49ff54d8cd86e61b78779ed0416aec6a7724aefaeb9159706d19acdd1f8fabc253f0ef4430802bf50bc7c4b15776110aa371e44725e9b55"}, {0x10, 0x11d, 0x471}, {0x68, 0x101, 0xc89, "c2cc5372e2f27276199606c355591fac9e71de2f30cccde4583d8200c178cce77cf2637e459247fdbfd57366d6dc5af02403a3fe6b5548ed02586a6d579484865755660360875002463376181882784d17dd3e9a"}, {0x1010, 0x196, 0x3, "36be59d5f28d25a9eb840930feb1acd78132d8f3b0c7a45a940b1c1211c9040fce13ea5c5a16e1783f1c0dd0ad9f8bbad320b227782d208740ebc475da5439a4fc67f3c1b5d642074bff8a805f0d7396832f802b4fdc944d0d7db83f2f9c3d0b348334d0e7ab8c686250c25972ee0051beef97a104cd269d3dd8e2936723206fa197afa0b375cfbce5b3313ed1d520f7323b5034887df274c85a40bc3864a56ea3740ef7f1f651f8d177063a18861bc739ef2c5f4e2513f53556ec1a86fde3a7cc7c23a481aadec30ff2dade9b7534d62adc88825e3670d5457302ef4c5584209a1b3f97d8a6ed31f72256e03759ca26ef48dc7a2653d5f8b4138a3b7c398319aa2c095ad6c5c7fb3cf260cc0b5a9cfb3908d3d7b97b5bb3c5113742ef777e1869aa4bea3f2f25c89daca7b24c2829199c6f9dea44e77aa7adaa692aafdd7411e5a5c4640ca9a73ab1ffeb1c649400bff2700654228d579d97c8a98f0d97d2b6394e099215571a802dd168f6381b6cf0c7e5df97b3a89ffa6b039ba9055a51fe72babe3518e14ad58e64055ecd8b8d8a10a01d2a64c6fda90a7cb24de10ff3977e34ab4ef593525ee23a12ddfb34294463f001e66553add971be7b1ce9de2d8d11299de575e62be48f0328e515422222b5c0c02ca741fa9b3f5a085140ac206bf46f4fe71db4b7c42430748407d739d2c80d6c408a877e520b60e9d54307b91ee8bc9b4f5c18c54c124b1a4d90d6592fb71c0b398ba392ab547974608d832683782b6c511d4cc258729a849d18ccd26e3c6c4d4a56957712caf6171409e1adaf70f1d6a04acc377deee12182423156c129c3e45eeeed359a6ff877207c0785367d4b46f8e248364322a0f9a740ba6e53e91142ba5abab1ae8b49e47ac03d2b3a04b14139ae9421df1678d348499014251e25e1376339698ac052d9dfb207308af20362d201a7ce49a994fd125b55a676c6ff5ffb2b89e05fdc9a7a417939405dc898c1e892f1bc0f293418ee0ae930ec7da9caa2b39c8369bd71968f0835b2c4ba656173a276fddf4e7098d92760a453a645a3d76410287f1f64ecade8ac45dc47d7055d36dc7f50ca129b025c5fcff30d151be974700efba3ff65a04a737d25acdbc08de46966a29e2e5810d6c159506001aecb888e2208cc758ad1f39dec6c897b0326f043c66e3521d74f6ed3079cf84d6bfcf420c4ec90781c9ebcc54a00ee331eba23b5e9718ccfc4827a1802be3f502300733dfbfc5459e2e91fbfd2d8fe34fc81e980824f5b33fb31a2e956c7a9a19c8621283cce8a80a28226bda2facbe289ede00a741b8aab6f3e74b2c623fbf858845f5944651152230ba92e0bdfc5cf92755245090d314491b25de5290743a72f749032eb2713c5dd1e485ce8a3a63bdee384fd7111cdc2cf641b96c0c364d790c639a01f075c01be7ae91bf723875293986ab66f0bba3142e8e111f1a9cd49bd6ab1e3b5f10f452e84e18aede11cabfb90cfa0559effcbe47be36d9633e66c0767cede05a5fca78098bdf62d4ebfafe8cc7f3f52463840f991a92c70b57af6bb8ead6f96d2cf1ff71a5627f2f058939dc815ba6dd737aac6ac7415f5021df96da95db6613deb012f5205a19c7beaaca2404c35956e96d9f7fab5f12d0e444b7e521660934d45724704124f99c7b87f42e65259a52aafac03e4b37c7fccbeaf4178da16a5e31301cbeb46f9e9446e42f13acd969c67050afa64c51782f5f10789ec3004f4955615be51f0881f2db884e1dd09b21202a0e60e26ae5d8206c88873411ded883264a7a2826c4b21b3c6c6aa926d08e9c89c5a131acf9092be23e74dbe224b164ba53473bb21216fb9428e31505c6ef3df252733396e11766a8ae64eae2d53091210955aedb19531509847dfaadecbbe54169581a8f96149d49363874cdca8bf71ab25ede13eee09b88c7f53f16a2dbf60e56a21537a261a0005747d113824b510d69d4a1020f13ba1dddd865112c458006c431205145ff2fc7c98772ace6e3e62e320abea98a15db78a48716f96ddcfc96f1cc1b6d719ec9115247b3607174535a3cc4abfaafe7d6dffdc6a652ec38732b2d784460448b7299592426477c992f0c1e8f3192397ef802aed89726db2534fc85246613b464fc8cf540b020645809d83426835e451584de95275534c910912ded3e51634326e1dac1f4b0aebb26dfa1bc065bd48db70588db55da0042c59478f37e7d1a14a29b2617103c282489506a403457c9656b41da669cad3ab9e64d6d5e0fa758371589628290d194afed31b55d50f6ac3f085d12627fbf2024bb379a3ed0dcff32f98d6014aea05d51f1ecea613ef03dd670736ac00054db28dc2b4dbbb182e7eb724210ee5455530186955a7eddbcffc41adb1ac6464f76a20b577a3ddb254170856d7ad46d61fde2db09ee8663718deca094525b2ed91f075ee7ce06978bed59f009a676c85c71b8f017334e12a89e7a0c3a2d538d28e9a0d3829cab8e3a90a51a534cba940a0d3000099c2105658b1d40e0848113b5d5cab70304987271cb1631d16fd2bca506af2751c14a9bf2b0f1e77dd5f9d5918a08719730515242ad4cad0615f17a28da4f8c1af5d4e89d759c078e137424f0c74954a35edb329f4da185d7da519aae8c134d1c97e776266c1a5251f5cd2bc7b2133c76f7569efdefb55aea8b874e51e3d199659ae17a92ef163e8da65329a4673c9fe43f6da4d5d1454d1921dfaae32a0bca0d24a36a8c9c3b007bd69ed8f2421ef6c80ea2895d4304516401534b0419f2991609c90bff04320c0e2570137414c9d8e95080ab9b13ff8ca0fb9a2c425b5a685c5192b7a98b01041de78eebe988b748f6db646e73ee8d99d3f3a4d62a0fdd9701c4975a37b4a68082f7d3d18d77ea2c96fb584c62e729d65232dc4474374a1e114fc9347d11a2fd01df26790f913f22427f498f0c374c7470d6fa102d1e23378da5bf92e48c1c44afa4fe9890f40f7488a02a3b0c41ea989473642455552f532ce7856e80d46326647d01b6df77aca46af9c638d97992fc2d13ea8dca72d8f2ee22fda2638b96bad3c5d1614ea4a9660269095e84a791a16494c68f51d8e09d0a3463c56e4b3c97277fbe8ce5ad1059375b244ac2c3b1c4730e77707d922f40ac255f99359c5b6173d681126b38c53a2344eaa60b21fdcf7c22c41060d606b6c35a9f70d9718462f760fbff076b3775b61803259f94fd4324fc3be43eeb0f5c9375b9215e380968b4aa49f45ccc0b25013f9fccaba83a13fb675535df6052e40b2d6ed9ca4f87ce38bd61a5538b8621dc17e75511c711bc9378a782eac88156558091e21d86438691d4541309cdf1a5c42933fa2399966f916a390895d0f41900a9b58fc61992db2d15872a0a101c2257b559f729971644963729a6bd7e9efe65a595c8f9db5100c216e98c17c2f470233f75405fb038acd0d5300a3b9e20c46bd751a6d420bf1fc4d8c9c7469b2d93ebd56703131fd10471891a6d08f8ea2cf11ec15ab6dd1613ba402a3f2280de964802b45d88eaf745ed0b14e2f64cc23ac504bf8d8511608b75df4c7877ad75fae620ff75522ebead94d70bef19033534aa69728fc1daa57929b3d53e264dd1d76b460f067462996d7a07e55e0e5f55213eca4b8ec0ddb448397b7ad94aa9493c449bc909edb9dc28b9c2d9a400adf3e2837edf80e012db2f942254810ba2118821b9ef15c0ab10278a46ba7e12d754f37a6b836baeca1a2967654bb6707ffd9b0468e61876fffff51e095a0b61442e2d7220e9d718dc941813bca02937fc90d17daf249200464fd1d7cc37069a3b0a7215e2d269dc6c04d841cf7dd10e4b12b96486126de8cec94383290d2f2c65ee4a7b6143e7e776363571733fe9d4a59d5516b757aac449d93327a4cdf4a20b83bcb945b527e92fa5db1bce6c63879fb2d4a3de63443526b2c5203c5e9e41583a803f59f66db08ec5d62d5353e19c396c6c9fdea44543839f1887912442d0559e8dfccadf34a2cfc40d33fb2a4086c3898876197046b0ce9d306b0d8bebbf51500c86e41ca27b722cd389b5c1d11f3823a9fa86946f25dd65f01bd006836c1b0ea50deadb4d4dca13d4c1c43b074a2dfc66230a282f13e8de1590ccab1b26d36408b87332b067febe28a27fbebd96f7760a4559760b9e2a992790cb4f9af1c942e6621f91421843dce1a62bdf40d48be0ceab49dcf5f372db96428ac803a2025413631a15e8777b99f6691a53174f3898460fd5687d8efdbacc7c9b29fd58739402fabc805176155a9b5a0120d5c7a67ba6fc3e9604d811cc76b04bc8a7f1b8641ebbf5754764e43687adfa03a5397eec2665966d097d8183375f37c05cea86665d7b61296b1269974958a1c056d3aefbd690b118682f9a15a10858de109d590e4e9d25a6f558115a030fb775f399355c463d86596ed13a2fc1aa95a4eae4447cde037d165639cb568fa3e11e3cd14de269eb0ce14fafe7278deca7123956af5f3b306e98f90cd83117811b95f5c4601fa8a4817d207a442777fb7c23bf6b8ad9f97914ea562e794a3d49e54c4b4d035174a0512551fd386b573850a9f218397f5b2a3eb58bc01d9c42fb9e4148739f9d688c59328cd87760b7ffc315b45b7d660a76f9ac714a1315de891cc451e9e95511b22f4e8097b5f732678117bb10c2188199cea86270dcfa1e462e1cd6e31461c8a4ce535e063e37c9b0bb19201b27b96797a98e547fa3c704aa9f11950277db8d14c30bfda4eb9cbeee26967252576ba52c45d90197c575217f64cc55b0403da21d0079dc2c1ae68a4f6e55c75bd3b58ba023e419fd97104d150e87411450b11cacb7c269d9c8e3de20d833ee826fdbef24ca31941f63e46b7906f7a90cd037c554a0a559c79a189c250d075547147c969cb123f8a2a717b13dbd5d32f78f24d4800d8400339469560d5078b8664ba85f5f7b9e732c011d2d2b6367f420149fa265425dd964ae333d0fa6a9682bd7a845dbcf09aa8b86a01327ae80acabd177ab63ed054aabe34aa699c8b7b62b3cdfb721436166c464a79d6e36c1fc36f180c3db76b4abd54c733ca91e21ced93727c4e2baa6dad9a024a0d403c25868a36dc93d00170d423a7033afc48c6a18a68ac639952472130f86e6c01efc5e18ce0e57e3b25ab113544c257d481cce1e145ee9a78247eec05292847453038f3637fa1b220d2d51ab70de7f74d55b61c77aae2c7dd612e4c361124c8fe13f079d7e466ca04d32612e2514fcb4572785020b2ec4fafba60d7b11ad18539b00908aa35aba2ce62ff522d268c256e2983177746d2851a653bddb9a241d471b8d5a0658b5935c40cb4e5a538ef9d44dacbe937f4fc0010e4b6aa195b5b448a59c6dd83b804cc758ef83eeb30eab8f4b6dec2785daf0b04e4323c3e610949be613f4c97cb1701856a55eaf3fcbdffe1838ea25b65cbaf290f284b9718f7ecaea66a56e669fb41e25478f524a582463f9c81dc5cebdd4b2e98161205818f950642676536db83ce57815bc380a31ee77e7ca1d20315fa8268c24cb9e0d7292438a1effd27fed03b80ae05e1d082c433f8d731ea6efaf91b4a051ad056285790e967a6de992f7c2ff79d3b7d0602000632663816ef92372b2894eca369356846180bce7c53fbd4bd564d7c22851abec76a9525c64302f0aee01001d9c431f8dc0de23bc82388119e014103d86cf7844f57b0a0fb9d247ea6d9dd4eab24ebf0800cbf6b99ecb44a470b65802f4ba31eac14ffae38254d21d0dfb41922b06643c58e"}, {0xb8, 0x1bf, 0x81, "071dc00fbb6d9c16fbc6cf743560c590ec558c20d506a6722ecae9f157452828d06bc7b7327cfd316025d8fc2e4a673ef4d6a11c1b8342d446b0eb2c2082a51b33324e98056eeea20dfa7902539d4011ea0f53b1eeb27fa18014a2ba07558e8370a44dfce6ee5ca0e31a8f056f1e5ebc214b8dc91dbbda3d77596254d9b0083047469215813ebe6c75746e01f6f848c5f6d5117250d4a622e82b8c3cc7e4ecb0c242964c"}, {0x98, 0x119, 0x8, "8946e5b41081b62ab9e6ab294632c4feb273054feeff2f8d39ea90c08362482978e003ee8379fff031fc73b735f3850f8c4bd903f9016c3c324a1d29575d1d07586ed0eff032df0746493d8cb1ef12df5c9d884bc0151f23a10ec4a8349626e94d2f6053851c6f53414eeb63134e0149fd85e9569c048bb1c0ce8a0f734b1e23abe0d4383c462abb"}], 0x1238}, 0x2}, {{&(0x7f00000074c0)=@hci={0x1f, r2, 0x3}, 0x80, &(0x7f0000007900)=[{&(0x7f0000007540)="cbf95a86e2409b76b5bf7dc116fe16ba7700506071ab75ed6be62f505ee480466561cea1f1fbbaa7fe96bc6133cee0bf07ee689741163f0ccb15ea97dd023e0f945bec7e97ca4bdbf05779359d8d86fa1150c5deb7e114ae937d16fbe7b5090411e15adb298df7833f01ff169b8680e13e3c13aed8a397e2ef35468c3bac933bea97f2ea9b5e190a172e161866a3596665b9cf40c10263871f965a467d8ec1", 0x9f}, {&(0x7f0000007600)="93ed82e44b5b5e7ecf0134b8cb7841199a942ada02e4ae264d0118f79099931400e537218771ae072c626a1a772d3f6b70d3b99a36b1cf30610185bbfd64ec372372f95748f902a418f0604d6c4ea5106c949864c2a54153c5ece9ba4255f92d4af37504d55aa65aee419f7153a76e3f2fbb4b722cf103d6948367882de1a369589689997be1b42318ab4d8f44a61e6290180930ef91491bb13fa3081490aa330feb3d5c49715a631a5886800f388997af8abea8b55b2fa2452cb43f0e9a9ccb571a6c3a51b8fc8f630557889924931651783ae5ae4311091ebbf0d9fdda439316c3b609ea", 0xe5}, {&(0x7f0000007700)="b7854aa722", 0x5}, {&(0x7f0000007740)="8deb326154ef1b8a7feabe888b85f3a280b32d72c5a51d6c782e80ffdb6fae0ddc37760c2b300f6fff852bed9f77a2874c5e92dd4e08349d267c8f52e220591677480eaf028a5f31812c529b17ebe5745ef5e245e50fb5c931cd3eb7051a8d4495417952c518e8f3d7f7f8a796a9da57ff7f74f5014af10168e50f8bc906fe2ec471ddc23436ad2c765e94e1c03e0b828d300549f816479fda20352856b8f017b477b9357a4f19f169436636f18e85eb169d25e8cc9273f01d00fe243f648a53c16fba7a4294a42e6675b0681fda32e41d92ca5a1f6b1bac635c2bcbf9869bed2cc9c5e227bc9e2be0c2e9d8", 0xec}, {&(0x7f0000007840)="62b84273f48dadd9cd6a5289d19805c9ac2b57d9f615b6f35f9d948788b6b764976a24b57e3d454795bf1d7844829cd6b880389441215822346860e48a03ec5108e806c46e8f6a310f869b0caccfddb3b53525022ac03e3e7a296129228dccb74c0112a628ba19b9764ae7cfac017ca4b5b520f746cd05a60f10af5c00040eff21311726c4", 0x85}], 0x5, &(0x7f0000007980)=[{0x50, 0x13b, 0x1000000000000000, "0381dc9f255c1bfe13fb926434e23dda8ee1790c0effa97b5547ca3bfbc846a8a15fdb328c43f01489aece012e7df431e2ca90d385969ef280ae01e88e0d"}, {0x10, 0x105, 0xfffffffffffffff8}], 0x60}, 0xa10}], 0x5, 0x24000001) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:04 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x4000000000000) 19:21:04 executing program 2: creat(&(0x7f0000000040)='./bus\x00', 0x0) add_key(&(0x7f0000000000)='.dead\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)="69ae5d1bed87ac90b1d029337bdc68d8a36387dd29d27a828d7e4eb9b3aa7f5866d7cf2410935eac5d5dc7665939ae7027ea8d72c2a6ad2d679534", 0x3b, 0x0) add_key(&(0x7f0000000100)='id_resolver\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)="096a0867d2faf8642809bdcbadc86797330fc07ceaa5ba5224f584698adb2b1dddfcb9da3a3a44f7d7b55ab565f3dca92133ed8d", 0x34, 0x0) request_key(&(0x7f00000001c0)='trusted\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000240)='bdevem1wlan0\x00', 0xfffffffffffffffb) syz_open_procfs(0x0, &(0x7f0000000440)='coredum0_filter\x00') r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000040)=""/8, &(0x7f0000000080)=0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7e0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000340)=0x50) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000f59ffc)=0x5, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f00000000c0)=0x6, 0x4) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e24, 0x4, @ipv4={[], [], @dev}}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000380), 0x4) getpid() ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000300)) ioctl$PPPIOCSPASS(r2, 0x40107447, &(0x7f00000002c0)={0x3, &(0x7f0000000280)=[{0x6, 0x6, 0x0, 0xffffffffffff0001}, {0x400, 0x2, 0x6, 0x4}, {0x0, 0x3, 0x3, 0x200}]}) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6001, 0xffffffffffffffff) creat(&(0x7f00000007c0)='./file0\x00', 0x0) unlink(&(0x7f0000000000)='./file0\x00') sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x10) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) [ 2014.333389] binder: release 32029:32030 transaction 5435 out, still active [ 2014.358884] binder: undelivered TRANSACTION_COMPLETE 19:21:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}) [ 2014.404987] binder: send failed reply for transaction 5435, target dead [ 2014.470464] binder: 32064:32065 got reply transaction with bad transaction stack, transaction 5438 has target 32064:0 19:21:04 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0xfffffffffffffddd) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2014.559448] binder: 32064:32065 transaction failed 29201/-71, size 0-0 line 2816 [ 2014.590978] binder: 32064:32065 ioctl c0306201 20000600 returned -14 19:21:04 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x10000000000000) 19:21:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) 19:21:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2014.681316] binder: release 32064:32065 transaction 5438 out, still active [ 2014.702403] binder: undelivered TRANSACTION_COMPLETE [ 2014.732065] binder: send failed reply for transaction 5438, target dead [ 2014.770832] binder: 32091:32092 got reply transaction with bad transaction stack, transaction 5441 has target 32091:0 [ 2014.812445] binder: 32091:32092 transaction failed 29201/-71, size 0-0 line 2816 [ 2014.857071] binder: 32091:32092 ioctl c0306201 20000600 returned -14 [ 2014.929848] binder: release 32091:32092 transaction 5441 out, still active [ 2014.945090] binder: undelivered TRANSACTION_COMPLETE [ 2014.950296] binder: send failed reply for transaction 5441, target dead 19:21:04 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0xffffffffffffffff, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xfffffffffffffffc, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:04 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280)='/dev/zero\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000002c0)={0x0, 0x7}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000340)={0x10001, 0x6, 0x1, 0x5, r4}, &(0x7f0000000440)=0x10) r5 = socket$inet6(0xa, 0x3, 0xff) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x7fff}) sendto$inet6(r5, &(0x7f0000000100), 0x300, 0x0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x0, 0x5, @local, 0x2000000004}, 0xfffffffffffffe98) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000200)='irlan\x10\xfe\xff\xd1.1,\xa8]\xcbk') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000080)={@mcast1, 0x0, 0x0, 0x3}, 0x20) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r2, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000240)='yam0\x03\x03\x00') getsockname(r2, &(0x7f0000002840)=@hci={0x1f, 0x0}, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x3, 0x0, 0x6, 0x2, 0x0, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0xa44, 0xa86, 0x8, 0x1, 0x7, 0xed, 0x7ff, 0x7, 0xd540, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x2, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r7, 0x7, r1, 0x1) sendmmsg(r2, &(0x7f0000005900)=[{{&(0x7f0000004400)=@xdp={0x2c, 0x4, r8, 0x2f}, 0x80, &(0x7f0000005480)=[{&(0x7f0000004480)="f1e0ec6d94cc3debc79ead95f1414ab15fbec1a0ad4d842ffa8a8a49aaafe07445bcf7e824802e4c304087bde3b985c060e1a69dcc0e751b10ddca5efaafd45bd6977c832a3c6f71011bf98273323d438c5795e1447f710e6089832bac100cbf4f690ad086cb4fae36acdb5884a8dfa06024c411f56a4d5742f8c09c8b34a4cff421e238855380cb6894dae831d2edab52c32237093485742d1a17195d3c35b8fa6208faf1d2af0cc89947fb3b14a2ec7c88db2107d180595702374ba0273fa3f5ca5bd9abfc88c843b213aa0d7907a7ef574b1517e52f6d214aa02720183794657671bc69f6c97e074b485946ec916443b8fdbd3f0cbf0b4e22b98e77e69dc9ecf57995b5f66014378dce68cc6a087e679e1eec8ce5a89485fbe4b0a373a0c4de51e63c9021484bf58b715eb4d97345dadbe7e9b8b73d6e3a9b39b698b087d54366a5892b8bc1d4dce79a820fa2a0c870baf74cd578ef3365545c93df500faa38da88504015712669a623763ffc3f51e9cc8cac3226d64f5e4c58ac9d54369ed658ba144fdf0ac7209a3d742f0fe18fba6de43deccd66a6c202a8de1277b44dd1b6c7469b517ee9c34359e7841eb2819c3cbf1e9d4b0c1e306c90c7be8e5df51e54dae831019a2ed66ec3cda498a3a894173a028fbac0c992ba860435672c67f5a00c04136fe2b9fb52e7cf09bace0d2ead15b562bd37cb797174cd11f6ba80a704c7894d412ba460e9f132a7ebd8d3c879df79f210696b9e9b7da9e3a906b106f08f793ae7c7e96905b5729e7891cfbe24d94b52c213693ecc78ff983850a596ee62bac3918e5b9f72b83bf065b504eadba4a5bd0292d67294f7d08103d991a85d288c181364b6d212e94dd52a026f68fa7a359ec5446bb0f3efce262071850ee1b5b12d61730790e6093c652214967f7cf58722c5fb1aa4ebf83724036bb82737f10f795c3e67c2bc851b1150bb41a567970bc50c60df72466e05f790de02eba70c45e9edf943cb0cc4146f9d2ebe19e266cf527f59dc26960a4f01486898c9764fc0550f85295e6ca2b7d623127f2a18d7153899e40fd3126c450b3e73c86f36a7068712c90064c16db0e2b3e236098325ce5acd9a83a797359159e68fcd9d24528a757ad9ac1eb1458b23eb51f5085106a65f6a55e8340a2cd58bd60cf64530e143421c401bb58725beeb2a9d945d93aca1c7829ddc7d590130228d2fa1f964715a9b1d16c96440fdc43a8a814130c749b471c0a7eab2b7c28dc076eee0c14f360b57e71139f72252a4a799664b60f5ca6d686acfada3ca9ca1ececf758fd25062012e49ad7023f6d07dac5ccdc721e83c688698fa3bc1e4f646c21faf31b2db8d8203733c98596bdae0236e1c7cf78543e6bc03c588f23b86169a63c0516d4f6b6af5c467a77630b395ee3d82206aeb33c8dbcb6482b064bb42f8a70e436f15e7267b782a7522cfaf064bec010052e5445519431fa6cf4882b3e3fa8018be36b57d0f5fb71f16b65d92afd8e23e5d826e24536436b66a4b57bf250534695155519154123503a1bda36905ae33aa45ae543007ae7ba8c2a5536b5a6ab4598251df9e2f327fdc66e8ba81cfb61f81bd8dd636a0589b465e2eae06e413b8731bf41849b38aa11ef672961055245ad059a9b89cd6b514f056f21ebdcf73ffc39c3b08dfef7c66e205c058d07a2f0e133a1cac322a4bb0c6bfa10ef0bb45775399aaa9cd9ed1f62b6a56c258f6e9063ed9662569e65a2e4bc7564e4ce73bcefa98429819fdfc7cd3e99601d847d3cbc820c5b197bab77eb65709b303dc99bff5af7be2d98cc237904b0215d05eacb154bcdfd247fc796f5edc132f18042c0acb711743e324bd7fc063009f8c96dfec2e3f2b3bed629d22208fcba67219295589a35997cf2cb5fa2d8095b8c9e05cf7d5e6d2a8eb2fa51f663a761e675032353704b616d56ca7a4c7bf9da37ea97ddb4c8bdf378c67c76ce95fb00e58fabc9ff1c6d6353de44b2a766ab6d0dccc03644d93765a1eef121de1b1c3db53711488adde6dddea50d8606d72a2e0d15798c9c90e56477109bd443c7228c281a3744ea45a4fc66e1396e1f4c68be4b798cf5873c834f1c5c81d7d21978332d9b7d4f51b323a1ba3daf9f99060f190c7e35be1de573f192ec6e8c6b97db3a4d0a7bd539e1892d6efe15827a2bd37875f50aa50e1ddebe47962870df9754158d7effdde74203a61d5cb3911c8cab6f3428620a8f240c4fe0fe6fa4661fbe92729e05731596daa8631b1da349851336194af9b59b074e722638a8148aa824be8a160ee9056fbde0924535a1a3235d97c5a435132881c590b30187c4e64004251977939968983415c46dc2ee673afad42be21ecfaed84350a98922af194b1c26605d1f06cc592f517be311415cfaf652cd0f1b4cece5c22ade588dc813302c61e3b3c0be24c2adde476a37999ab253cba8237c2f5fc32308666b6aeed40237492d8cb51427467d07eb540793c73a43d9387fe02a54ec4ead6e258efea50927faf504bd31f8e09501f089b2ddadc79d6842effb5d09dbab4d5013b921ee743bc2832a4c7fdfa9c77a9834b68a26850479a4fc0e63cb7ea55a4483fe974e91f18f3ea7e452b3134d8defbfc63ce3ff7fdc16efdac2f621f2f3240e920809ba214374e2e5f81093c57c0bf35b21183bca81c375e22334d36ce25f5adb2b8f65554f180764e2ca39f603c3fed883ca174afcee8775557c5a4cf2ebed40e4f663f461f6be777669e471bf4274e8c48822a7a8c4652d9d653984bd04753408a5035bdcc8d0326ebc38472f80a8d2d9430d0b644c7b907586e2b626a5c4e0062e96b3385a53ed7b4ccd2776e6aa1d12547f704516edc2f9ee5eac1ff5dc76e5afe377f8114ac86b073bc92c527cac95d6d03734106f905ac1dd450d118c5df6a5cf53c6837933e6a3aed8112e8982d96e5733863b0f1fd3bb62f8e4d61a0b89a49eb83115214b6016ef1f5f98f322989d5daafd0d736601372605df795d4c32d3be3acce692c514a47f4f61f139910c34dc3297387e88f416ee510c1233633bb96d5058ffc252ca66387a8a3e12ebf8b73ad48a777a11f306d789d60232a33fa389aabc9af4fa8aec5603af0d0891896a099a0dacf073137db75697f7ea88736cace032bfd34e320d231a16033917d82b029a2080fee35af082c9fa31076db91a483324dbdf14f90ebbf77a9368b24840296bde1b78239b538f1dd0ff095a365e70a6d0a335f48e531db02802071ed2e0a53644082c96b551ca65a784e044c0c503311ae8d02db41c6fbc8c784825f8a9f89afcea00a993a9c7b73f7d997756dba6a16012f1244619396ae338deadd3c3e778f0b1f64c9f4c649c8e8527f2c7a2c557a002cba55ee2cd28f6692c3af9f971277cbce2f0cff050cc9f74aa5b7f816f9fb5c185fd689dde68ea41c9be89c0bde7f4540e251e480b92be0d3daa3989a8ca13315ccdc50754647895c86e863e2365c0ac75b7f1acdf4a27bea0119b448b4d0ef092e983a74333618b530ca1ae362da3a7a2f6820679057a71df65a63d8152b327e5e0ae94e6858cf9098b38d0654422ac513590545aade368d34da8ac358b619c92ef8c80c44f5f44e8cde35805196a35d0d259c8d7dbb49d360fc3d53b81fe153a9b53ee98fae65057ba88ced0677e957846b497d2966151594f548e5c31f550d77bf660d03d9dea9aacccd54becb74ed5ea12a5c6585fc0afc45cb63be0893b7a6154db1691ef0a32bcc997d9fa670f9225673c27db3982c623e0c84d37abf6efc8937ec861fb29f784cad6b4f6dac5e158b9ca95c23f044d53632879effc169f6e3c0d686b2ab22fd5479634a6d887975e05eb0c34ded6e1fb424479ef4c53728a5b70fb403b614fad46777622868c7986ff72f9504695ee8fc50efe8e2d66fa6c5cbb8004438c5cd71ce1110bc92e39d8e7851dbc88bf9c482ec17b21df17a7db22e7570abbebf95db7b24643375110a66d44d65c464acd5b3a903937d83d8303df7ce3eedeeeb50e3bc6705c02fcf9958bd5b7922beebd10d5d001f5435da972546f8e4c29ca04a18f7df93b4c6e7373cf857ea13da744d10a3d7c1c8fed42643e3056ee5a67de81a402ed7fe8b5d12fb21e40bd16cf4ff381ccc8f4e2383c4742d7f8b45382a8bfccd8634921aba083715a3507df95a14d5f71781508cbe92772f23479fb1db220164ba06aa1f2623fbba0a9f6f051a5f7770deed4a8a32cf640d213039d0b11daf4b36cf6ac2e43427bab3d9ab5e6bcce2eb5162be40b89e123dddae3911054785083f6f3e33b8c18b5684d3f1280369661c5ab253d26fbfee03bea9552512d228751263cce54ce988802317ec85bfd95a243ff5533c93a944db07738e79a566e0a70bddcdf7b34060a59825d60bd535b4bbd182384e7dda829725b448c3579f5e13a1524a194933ac6af1d71b4fd17ac4ec5095bd8df5dfff394d5dde52574282a1056e65160c09c2c150b0a8c9177a256df84ec952250241e4b19270d6d89d7c1523346895b7ff1de146d5a05acd1fc4d290a5999f82796e34298d3f179416d23ab5d2f64ddb6fccd384b9439aae10ed7522b2aa51c54b61ad1329801230e6e8e510756e43bc9933267ad4d85642ef1a342ea17ec9cf6d7c0440d38c4ac6a87a5e3abf1f1c56443abb9a01ae7de63b8a1c973f20982aac8251dd378f241567e2d956b83acd58400eaed70c86c334c70670041728f40df2a0983436cdf1708430c186686e1ad503a064601beced6291c7d09ffea42d9e791c18a5ec5e9bd95703d5dc8e251bdc0c42d462ee303287da7b65c5cf43b4970b6211db9d85dae5bcf5f950840ade885ca43caf01b27b381afb863482f24d563a0190f04eaf941a0b368c73b86e98eb7dcfad6dd4515cb7e5fa8c34877a433cdd4606d619724094d607a476456c70d6bf61c61e3d57a364b4baa9fc7ec1da641f42c2326a6fb182b8611c4d213df764c07d55b8f48685017903b5745e98f21830b6a2b1b01cf2e23fbca078b0cc38d1f6832f54cecce65facaf81ef9b4bddbedd635e0339b3899fe7a03413315e56bc16669ce13c3ca9838ce8b1c6a1327d8cbc4d3fef00ed47d0e4124d3f7eda1d2825bd6461ef8539ce637f923444a916b8e7318e12a92ce234e79a074fce226cef19df90fca70462053f635e88305084dbca00018dc8134314b05f8dd982a4909e1f9b8529c82345b44fd125fea3c0ae87cd37bbb03d8b67e228b20763f27aa59dc6df99b6d64a74d9dec7081eabf6ec636e14e551a6a7a8fc05f99bde7ea0c386e93837ede16953cb69c2683a23c35240c5e8af13fc9faef5f755b0186194cdd436e0a372eb33773ba826595b16736309b6a52ef829db5f228d8e26e9ecf440e12621fd78521ada02b7124d4602504ea2403abcac83e660fd31d76554e5d9274d7ba0f81746d451aa8d5cc2e6bd8313922dc389b6714e7d807c71f92724e4ff06bfe2b814b7673026eb2830febe48998aa429fe37fe2a5bd248c1ba515350ff5ae3a2db8fc117032dbf04314670565d09717bacc87bdb29d9f808ba06c2fdb8c4da78d70e148b481a2b2063a50286b2834ea7cfbbf7c993d9f501679e5cbe95a22831a7c7ad1aee09ba0951f60820092ea9ef8586156213cbdda4a39633c7d2e8a64287d391e92f83677bcf5b122337dee90b13c563cc5f10b16312ec45025bbef50287b0d677d7c9e17d8a330abeeb07d5c7e0f2227f4d8262349a11c9af6ee0d9540303498683351d09c2be6430211e273cf80", 0x1000}], 0x1, &(0x7f00000054c0), 0x0, 0x24000010}, 0x5}], 0x1, 0x0) keyctl$restrict_keyring(0x1d, 0x0, &(0x7f0000000100)='rxr\xb3u\x00', &(0x7f0000000040)='\x06\x00\x00\x00c ') setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0xa) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}) 19:21:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:04 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x40030000000000) [ 2015.243269] binder: 32114:32117 got reply transaction with bad transaction stack, transaction 5444 has target 32114:0 19:21:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}) [ 2015.322299] binder: 32114:32117 transaction failed 29201/-71, size 0-0 line 2816 [ 2015.359499] binder: 32114:32117 ioctl c0306201 20000600 returned -14 19:21:05 executing program 2: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) mbind(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, &(0x7f0000000040), 0x48, 0x1) 19:21:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:05 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf0ffffffffffff) 19:21:05 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x201000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") getsockname$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000080)=0x1c) sendmsg(r0, &(0x7f00000000c0)={&(0x7f0000000180)=@pptp={0x18, 0x2, {0x3, @remote}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000200)="665ee6e5172f6aad602de4697f8d6a729a1483fd944319988df9eb56aab21b4fb2e79f4fe8f56d4c639fba6a2af02e004b23e9405775a5af6517b6b789e499a9de66cb2d7863344bdd487b", 0x4b}, {&(0x7f0000000280)="96134084ecc592684903f63ce05f807271db4f4a8ffffcbee504bab6e6b6119739c992e0af6b48263f271a05d3bcc1dbe03c5e3d511bdab05cacc5741ab0e6c19cc57e9b5fa11eda5fa90a83307856c442421c84f2b591586c0cf88a6aa685e8577a", 0x62}, {&(0x7f0000000300)="92d0089f1377b96b576931c28707ef9e1afca591b196bc01422674b0aedb7a6ac52f3de2f55d7f3c6615767b1767939078a3fc3ef9e839d5d3a21db926b1b8318365dcf7398e113710cff8c17b11b496ed6eabbd7d90f1dc9bbc24a679f3b3afe3fed9291130f0fda5b092b20c873f171e651d2b0d50ba26e5e537badb0300eb2b0e4a062f721128ea6b356a9e3185a06fe62e104fab1a38efce1cfb12e1ecd9c25e4fdb877dbbe19b9579bad0bd9a1615fbf9b8203fb757258c2c5657f5faf4f9f0e73c933bd673fd2dd30eda913e1d997b07892f037613aa91897f57362081c661", 0xe2}, {&(0x7f0000000400)="2281638eeabf458ad2c75218dd0ef3cddfcfe3082e736a53095770f241d6308341c49290f5de279a65f1d04160429fcba22ec3e6127686a0b77c02264287020367056df8efc9bbee999b5d28c21ceafd1aca8902608175b22d6d0ea0076fef437f2b2c96527915b15c59a8765ade731ea8cc757e0ce1c28d339f80f854078e33df6f57dbf29f8d06476c717ee7acaff6aa50b33de497f4f40f2c34158436e720f398704515956c73ebdf4d3497d706de3826df697576233761f8e11718961a129a34517516fd686170c7d2f1f1c8fd3cb562246029ffec55e54197aa581592451a2a0d01d8a77b093e954addef5d33a033f6419dee5cd359fd7b7f74", 0xfc}, {&(0x7f0000000500)="ee47b92d9d8f2b335ebd014ef92a962456449d150ef081d2860fbe8de4802711ea0ac02f647a9f4eba9d98566cb126daeb3a287ba4272ea8b97b155c1968a06abad176ea84c1f3b3e4dd0897ddd79f33c77781b553b98b8e398af83d7c0222c6f5814a42e0c6a3c491362022a0f8747be7cee9d1b17fa9f3658b3eeb787efaf1ead71424dfb0ce68c97dd2b97d9ee6b925efe1b27e4fa34d6980b232a0bcc9a20c76e7b6c9b35fae5b88a0a5d811c230cf5ac96c1362", 0xb6}, {&(0x7f0000000000)="2b1d62b3118e1195f07037af6136f235ecf7e64fc2d614ab0376d00e99bc", 0x1e}], 0x6, &(0x7f0000000640)=[{0xe8, 0xff, 0x10001, "f3db0c7394fc60fcc78422e2ff4110f33992827e092ac05828f58da6b15ce0acd259fa05de9dea65a21f7061097fa9fcba8a3d144b97c4ac49061ea1112638ab87ab52902025d488de394851a162e5bb90d1f744b492924754edba16c2ad25a87735093af899afd820f2cf6e30e5217c0d414ae9045fcff9b64f9b5649db0fa013fe166001dc111b8af5efa5c46453715330f6cde9a712637629f7bdac607ac690a64459565c7f4cbb1dc694189afb3656366f1f4580f8fc04a0e9202a5cd9a1470b92e705dddaf5bda7c7bdd600e9164b2911dc"}, {0xa0, 0x0, 0xe590, "787f1777d393bd9184adba6166ef439024c425d56cf03b575009f31a5b52c3ad27c2bec7879e927d7911847ee1f0ec6ce8d01ba0c911e433afa5167b70862588a5056e5e565e57302ed3c6cd91c65522f6905cfdc0b503fcbd310a965bf4bff922ecaddb1d88b6744743d304368761ab730037d1b8d02c9e707f627baf64be620cda35d9ff6f81a5888eee0c"}, {0x88, 0x112, 0x3, "0dbef9d7e117285d83b1a7419f08eb5359fa8fdaa6e0f45fe90021e685251f8fc192429be0fa65f3c9ce11a1ea94664013c48a501431e62705a1f53860c06fb375e8ec25d7970b031fbd2a091a4d28dd5ecf9b386861a2dfb0922cd5451ddf425add17839c480719e0afb90fba48fceb373920c3e8d499"}, {0x98, 0x102, 0x1b76, "6f84cf85459f12f8ed42f78fea8e211075f9d4ccd9a266fb904270f9275b5b1f86886b34aba44c1b4358bc46a122a7637fffdfe783e9f444c4318bc10970e642c3c4360440278c142c7c54e40f77da10683581666a8e7c6f7e02ce86ed53d14e7571860c0b7b3db7e7953331b598b0c0537ea38ca29d50e58ae45f9a589777322e404a"}, {0x80, 0x13f, 0x8, "39ea96d15a3d3ce555eaa0b0ffa200ae7cb7072c0a70ab7376a64bf3189fcb8bec825c4baf599f08e69f26f88768b24566d6de0bd07dd7ff7358591e8c96dabc94087c2c7f2dfe75f31facf7d6141f378fb13cb17fc391423646f9f15ee4d3062961ad5b8b33e0b0dd"}, {0x28, 0x117, 0x2, "93c986acd93467d5af082f7e18871fcabc9cd6"}, {0x110, 0x11f, 0x1, "e296204beee40322dd5d88544bf6cd5ef70cf0fcf2e923ad127a8640a50f61745c3b051e7e9bf593fc252a2648d04c503902e9441f67c8e4038391d42917b63e2e468a6d186acde3d3f35277f977630dd3885f4515e84856d6ceef2ab22b435654e93bbef288c54bf8fbd11042d213fd5c4e2e5aa4d96d0f74cf468b91536029933107296673e9448180ed8f8eb6e4acaa485e1b1fb60f4aed6832c00912657a3ebf9f957a2df0403373da2920d5c9670628d066dd856dbbd3bc6600dd276e9d7ddf7205f166efc518831126b2a1a9166855d6ba83a180b3018e5476299cd5cb4443e403d3daff764a66bb3bb58802e76c49e8dcbd9b2e0716"}], 0x460}, 0x4010) [ 2015.499251] binder: send failed reply for transaction 5444 to 32114:32117 [ 2015.531994] binder: undelivered TRANSACTION_COMPLETE 19:21:05 executing program 2: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid\x00', 0x2, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000100)={0x0, @aes256}) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000000)=0x0) ptrace$poke(0x5, r1, &(0x7f0000000040), 0x5) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000002800)="39000000100009e369001b00810800000700fd9816020000450001070000001419001a0004000a000f000200000809c99183a8a50002000000", 0x39}], 0x1) [ 2015.625503] binder: 32143:32150 transaction failed 29201/-71, size 0-0 line 2816 [ 2015.633953] binder: 32143:32150 ioctl c0306201 20000600 returned -14 [ 2015.678925] netlink: 11 bytes leftover after parsing attributes in process `syz-executor2'. 19:21:05 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x63, 0x0) getsockopt$bt_BT_FLUSHABLE(r3, 0x112, 0x8, &(0x7f0000000100)=0x7, &(0x7f0000000140)=0x4) ioctl$KVM_GET_IRQCHIP(r2, 0xc208ae62, &(0x7f0000000180)) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000004000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 19:21:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}}) 19:21:05 executing program 3: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) ptrace$setopts(0x4206, r0, 0x1000, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000280)={'veth1_to_bridge\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="2b0100000000040000000000000000001238cee6407ab0323ed17eead644f636b0190dc3de2b61b7f57c38c25eb5088df90acb6ecc42de7913b4d07662c991f5d45e5af7f05e9d5af72cf15f1e807d6089468dd51ad5abc9ad16baefa7a5698ec03d190cc3881e8f71a8f2146b7d20b01b975e1420bcb348ee594f2c6c355dda04cfc8a4bb6b6a3b6c6b8620664d29728cb88c887540c56875729758c210934f0a6c855c98107c37e735df60b749aa84ffcbd1dd2c3910b3375efc0c91001840019de4b5e32c950348d5982c2d9fb8bfda88a7ba6973e7884e5a60b636ec3896670c9cdce16c55201ec303"]}) close(r4) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r4, 0x29, 0x32, &(0x7f0000000080)={@remote, r5}, 0x14) close(r3) 19:21:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:05 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000080)='/dev/udmabuf\x00', 0x2) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2015.815009] binder: send failed reply for transaction 5447 to 32143:32150 19:21:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}}) 19:21:05 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x100000000000000) [ 2015.884333] binder: 32172:32173 ioctl c0306201 20000600 returned -14 19:21:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:05 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000280)='/dev/zero\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000002c0)={0x0, 0x7}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000340)={0x10001, 0x6, 0x1, 0x5, r4}, &(0x7f0000000440)=0x10) r5 = socket$inet6(0xa, 0x3, 0xff) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x7fff}) sendto$inet6(r5, &(0x7f0000000100), 0x300, 0x0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x0, 0x5, @local, 0x2000000004}, 0xfffffffffffffe98) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000200)='irlan\x10\xfe\xff\xd1.1,\xa8]\xcbk') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f0000000080)={@mcast1, 0x0, 0x0, 0x3}, 0x20) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) fcntl$getownex(r2, 0x10, &(0x7f0000000380)={0x0, 0x0}) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000240)='yam0\x03\x03\x00') getsockname(r2, &(0x7f0000002840)=@hci={0x1f, 0x0}, &(0x7f00000000c0)=0x80) perf_event_open(&(0x7f00000003c0)={0x7, 0x70, 0x20, 0x8, 0x6c4e, 0x3, 0x0, 0x6, 0x2, 0x0, 0x56, 0x0, 0x7fff, 0x6, 0x800, 0x1ff, 0x0, 0x1, 0x4, 0x9, 0x3662, 0x2, 0xa44, 0xa86, 0x8, 0x1, 0x7, 0xed, 0x7ff, 0x7, 0xd540, 0xffffffffffffe169, 0x96a, 0x1, 0xa432, 0x2, 0x20, 0x8, 0x0, 0x401, 0x1, @perf_config_ext={0x74f, 0xfffffffffffffffd}, 0x0, 0x2, 0x2, 0x0, 0x0, 0x2, 0x6}, r7, 0x7, r1, 0x1) sendmmsg(r2, &(0x7f0000005900)=[{{&(0x7f0000004400)=@xdp={0x2c, 0x4, r8, 0x2f}, 0x80, &(0x7f0000005480)=[{&(0x7f0000004480)="f1e0ec6d94cc3debc79ead95f1414ab15fbec1a0ad4d842ffa8a8a49aaafe07445bcf7e824802e4c304087bde3b985c060e1a69dcc0e751b10ddca5efaafd45bd6977c832a3c6f71011bf98273323d438c5795e1447f710e6089832bac100cbf4f690ad086cb4fae36acdb5884a8dfa06024c411f56a4d5742f8c09c8b34a4cff421e238855380cb6894dae831d2edab52c32237093485742d1a17195d3c35b8fa6208faf1d2af0cc89947fb3b14a2ec7c88db2107d180595702374ba0273fa3f5ca5bd9abfc88c843b213aa0d7907a7ef574b1517e52f6d214aa02720183794657671bc69f6c97e074b485946ec916443b8fdbd3f0cbf0b4e22b98e77e69dc9ecf57995b5f66014378dce68cc6a087e679e1eec8ce5a89485fbe4b0a373a0c4de51e63c9021484bf58b715eb4d97345dadbe7e9b8b73d6e3a9b39b698b087d54366a5892b8bc1d4dce79a820fa2a0c870baf74cd578ef3365545c93df500faa38da88504015712669a623763ffc3f51e9cc8cac3226d64f5e4c58ac9d54369ed658ba144fdf0ac7209a3d742f0fe18fba6de43deccd66a6c202a8de1277b44dd1b6c7469b517ee9c34359e7841eb2819c3cbf1e9d4b0c1e306c90c7be8e5df51e54dae831019a2ed66ec3cda498a3a894173a028fbac0c992ba860435672c67f5a00c04136fe2b9fb52e7cf09bace0d2ead15b562bd37cb797174cd11f6ba80a704c7894d412ba460e9f132a7ebd8d3c879df79f210696b9e9b7da9e3a906b106f08f793ae7c7e96905b5729e7891cfbe24d94b52c213693ecc78ff983850a596ee62bac3918e5b9f72b83bf065b504eadba4a5bd0292d67294f7d08103d991a85d288c181364b6d212e94dd52a026f68fa7a359ec5446bb0f3efce262071850ee1b5b12d61730790e6093c652214967f7cf58722c5fb1aa4ebf83724036bb82737f10f795c3e67c2bc851b1150bb41a567970bc50c60df72466e05f790de02eba70c45e9edf943cb0cc4146f9d2ebe19e266cf527f59dc26960a4f01486898c9764fc0550f85295e6ca2b7d623127f2a18d7153899e40fd3126c450b3e73c86f36a7068712c90064c16db0e2b3e236098325ce5acd9a83a797359159e68fcd9d24528a757ad9ac1eb1458b23eb51f5085106a65f6a55e8340a2cd58bd60cf64530e143421c401bb58725beeb2a9d945d93aca1c7829ddc7d590130228d2fa1f964715a9b1d16c96440fdc43a8a814130c749b471c0a7eab2b7c28dc076eee0c14f360b57e71139f72252a4a799664b60f5ca6d686acfada3ca9ca1ececf758fd25062012e49ad7023f6d07dac5ccdc721e83c688698fa3bc1e4f646c21faf31b2db8d8203733c98596bdae0236e1c7cf78543e6bc03c588f23b86169a63c0516d4f6b6af5c467a77630b395ee3d82206aeb33c8dbcb6482b064bb42f8a70e436f15e7267b782a7522cfaf064bec010052e5445519431fa6cf4882b3e3fa8018be36b57d0f5fb71f16b65d92afd8e23e5d826e24536436b66a4b57bf250534695155519154123503a1bda36905ae33aa45ae543007ae7ba8c2a5536b5a6ab4598251df9e2f327fdc66e8ba81cfb61f81bd8dd636a0589b465e2eae06e413b8731bf41849b38aa11ef672961055245ad059a9b89cd6b514f056f21ebdcf73ffc39c3b08dfef7c66e205c058d07a2f0e133a1cac322a4bb0c6bfa10ef0bb45775399aaa9cd9ed1f62b6a56c258f6e9063ed9662569e65a2e4bc7564e4ce73bcefa98429819fdfc7cd3e99601d847d3cbc820c5b197bab77eb65709b303dc99bff5af7be2d98cc237904b0215d05eacb154bcdfd247fc796f5edc132f18042c0acb711743e324bd7fc063009f8c96dfec2e3f2b3bed629d22208fcba67219295589a35997cf2cb5fa2d8095b8c9e05cf7d5e6d2a8eb2fa51f663a761e675032353704b616d56ca7a4c7bf9da37ea97ddb4c8bdf378c67c76ce95fb00e58fabc9ff1c6d6353de44b2a766ab6d0dccc03644d93765a1eef121de1b1c3db53711488adde6dddea50d8606d72a2e0d15798c9c90e56477109bd443c7228c281a3744ea45a4fc66e1396e1f4c68be4b798cf5873c834f1c5c81d7d21978332d9b7d4f51b323a1ba3daf9f99060f190c7e35be1de573f192ec6e8c6b97db3a4d0a7bd539e1892d6efe15827a2bd37875f50aa50e1ddebe47962870df9754158d7effdde74203a61d5cb3911c8cab6f3428620a8f240c4fe0fe6fa4661fbe92729e05731596daa8631b1da349851336194af9b59b074e722638a8148aa824be8a160ee9056fbde0924535a1a3235d97c5a435132881c590b30187c4e64004251977939968983415c46dc2ee673afad42be21ecfaed84350a98922af194b1c26605d1f06cc592f517be311415cfaf652cd0f1b4cece5c22ade588dc813302c61e3b3c0be24c2adde476a37999ab253cba8237c2f5fc32308666b6aeed40237492d8cb51427467d07eb540793c73a43d9387fe02a54ec4ead6e258efea50927faf504bd31f8e09501f089b2ddadc79d6842effb5d09dbab4d5013b921ee743bc2832a4c7fdfa9c77a9834b68a26850479a4fc0e63cb7ea55a4483fe974e91f18f3ea7e452b3134d8defbfc63ce3ff7fdc16efdac2f621f2f3240e920809ba214374e2e5f81093c57c0bf35b21183bca81c375e22334d36ce25f5adb2b8f65554f180764e2ca39f603c3fed883ca174afcee8775557c5a4cf2ebed40e4f663f461f6be777669e471bf4274e8c48822a7a8c4652d9d653984bd04753408a5035bdcc8d0326ebc38472f80a8d2d9430d0b644c7b907586e2b626a5c4e0062e96b3385a53ed7b4ccd2776e6aa1d12547f704516edc2f9ee5eac1ff5dc76e5afe377f8114ac86b073bc92c527cac95d6d03734106f905ac1dd450d118c5df6a5cf53c6837933e6a3aed8112e8982d96e5733863b0f1fd3bb62f8e4d61a0b89a49eb83115214b6016ef1f5f98f322989d5daafd0d736601372605df795d4c32d3be3acce692c514a47f4f61f139910c34dc3297387e88f416ee510c1233633bb96d5058ffc252ca66387a8a3e12ebf8b73ad48a777a11f306d789d60232a33fa389aabc9af4fa8aec5603af0d0891896a099a0dacf073137db75697f7ea88736cace032bfd34e320d231a16033917d82b029a2080fee35af082c9fa31076db91a483324dbdf14f90ebbf77a9368b24840296bde1b78239b538f1dd0ff095a365e70a6d0a335f48e531db02802071ed2e0a53644082c96b551ca65a784e044c0c503311ae8d02db41c6fbc8c784825f8a9f89afcea00a993a9c7b73f7d997756dba6a16012f1244619396ae338deadd3c3e778f0b1f64c9f4c649c8e8527f2c7a2c557a002cba55ee2cd28f6692c3af9f971277cbce2f0cff050cc9f74aa5b7f816f9fb5c185fd689dde68ea41c9be89c0bde7f4540e251e480b92be0d3daa3989a8ca13315ccdc50754647895c86e863e2365c0ac75b7f1acdf4a27bea0119b448b4d0ef092e983a74333618b530ca1ae362da3a7a2f6820679057a71df65a63d8152b327e5e0ae94e6858cf9098b38d0654422ac513590545aade368d34da8ac358b619c92ef8c80c44f5f44e8cde35805196a35d0d259c8d7dbb49d360fc3d53b81fe153a9b53ee98fae65057ba88ced0677e957846b497d2966151594f548e5c31f550d77bf660d03d9dea9aacccd54becb74ed5ea12a5c6585fc0afc45cb63be0893b7a6154db1691ef0a32bcc997d9fa670f9225673c27db3982c623e0c84d37abf6efc8937ec861fb29f784cad6b4f6dac5e158b9ca95c23f044d53632879effc169f6e3c0d686b2ab22fd5479634a6d887975e05eb0c34ded6e1fb424479ef4c53728a5b70fb403b614fad46777622868c7986ff72f9504695ee8fc50efe8e2d66fa6c5cbb8004438c5cd71ce1110bc92e39d8e7851dbc88bf9c482ec17b21df17a7db22e7570abbebf95db7b24643375110a66d44d65c464acd5b3a903937d83d8303df7ce3eedeeeb50e3bc6705c02fcf9958bd5b7922beebd10d5d001f5435da972546f8e4c29ca04a18f7df93b4c6e7373cf857ea13da744d10a3d7c1c8fed42643e3056ee5a67de81a402ed7fe8b5d12fb21e40bd16cf4ff381ccc8f4e2383c4742d7f8b45382a8bfccd8634921aba083715a3507df95a14d5f71781508cbe92772f23479fb1db220164ba06aa1f2623fbba0a9f6f051a5f7770deed4a8a32cf640d213039d0b11daf4b36cf6ac2e43427bab3d9ab5e6bcce2eb5162be40b89e123dddae3911054785083f6f3e33b8c18b5684d3f1280369661c5ab253d26fbfee03bea9552512d228751263cce54ce988802317ec85bfd95a243ff5533c93a944db07738e79a566e0a70bddcdf7b34060a59825d60bd535b4bbd182384e7dda829725b448c3579f5e13a1524a194933ac6af1d71b4fd17ac4ec5095bd8df5dfff394d5dde52574282a1056e65160c09c2c150b0a8c9177a256df84ec952250241e4b19270d6d89d7c1523346895b7ff1de146d5a05acd1fc4d290a5999f82796e34298d3f179416d23ab5d2f64ddb6fccd384b9439aae10ed7522b2aa51c54b61ad1329801230e6e8e510756e43bc9933267ad4d85642ef1a342ea17ec9cf6d7c0440d38c4ac6a87a5e3abf1f1c56443abb9a01ae7de63b8a1c973f20982aac8251dd378f241567e2d956b83acd58400eaed70c86c334c70670041728f40df2a0983436cdf1708430c186686e1ad503a064601beced6291c7d09ffea42d9e791c18a5ec5e9bd95703d5dc8e251bdc0c42d462ee303287da7b65c5cf43b4970b6211db9d85dae5bcf5f950840ade885ca43caf01b27b381afb863482f24d563a0190f04eaf941a0b368c73b86e98eb7dcfad6dd4515cb7e5fa8c34877a433cdd4606d619724094d607a476456c70d6bf61c61e3d57a364b4baa9fc7ec1da641f42c2326a6fb182b8611c4d213df764c07d55b8f48685017903b5745e98f21830b6a2b1b01cf2e23fbca078b0cc38d1f6832f54cecce65facaf81ef9b4bddbedd635e0339b3899fe7a03413315e56bc16669ce13c3ca9838ce8b1c6a1327d8cbc4d3fef00ed47d0e4124d3f7eda1d2825bd6461ef8539ce637f923444a916b8e7318e12a92ce234e79a074fce226cef19df90fca70462053f635e88305084dbca00018dc8134314b05f8dd982a4909e1f9b8529c82345b44fd125fea3c0ae87cd37bbb03d8b67e228b20763f27aa59dc6df99b6d64a74d9dec7081eabf6ec636e14e551a6a7a8fc05f99bde7ea0c386e93837ede16953cb69c2683a23c35240c5e8af13fc9faef5f755b0186194cdd436e0a372eb33773ba826595b16736309b6a52ef829db5f228d8e26e9ecf440e12621fd78521ada02b7124d4602504ea2403abcac83e660fd31d76554e5d9274d7ba0f81746d451aa8d5cc2e6bd8313922dc389b6714e7d807c71f92724e4ff06bfe2b814b7673026eb2830febe48998aa429fe37fe2a5bd248c1ba515350ff5ae3a2db8fc117032dbf04314670565d09717bacc87bdb29d9f808ba06c2fdb8c4da78d70e148b481a2b2063a50286b2834ea7cfbbf7c993d9f501679e5cbe95a22831a7c7ad1aee09ba0951f60820092ea9ef8586156213cbdda4a39633c7d2e8a64287d391e92f83677bcf5b122337dee90b13c563cc5f10b16312ec45025bbef50287b0d677d7c9e17d8a330abeeb07d5c7e0f2227f4d8262349a11c9af6ee0d9540303498683351d09c2be6430211e273cf80", 0x1000}], 0x1, &(0x7f00000054c0), 0x0, 0x24000010}, 0x5}], 0x1, 0x0) keyctl$restrict_keyring(0x1d, 0x0, &(0x7f0000000100)='rxr\xb3u\x00', &(0x7f0000000040)='\x06\x00\x00\x00c ') setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0xa) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:05 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x400003, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x6}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f00000000c0)={r2, 0x1}, 0x8) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:05 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x20, 0x8000) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000180), 0x4) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f023c123f3188a070") r2 = socket$inet(0x10, 0x2, 0x0) sendmsg(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="24000000560007031dfffd946f6105005e0000001f00000000000000421ba3a20428ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 2016.036690] binder: release 32172:32173 transaction 5450 out, still active [ 2016.046153] binder: send failed reply for transaction 5450, target dead 19:21:05 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00}}) [ 2016.164672] netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. 19:21:05 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) uselib(&(0x7f00000001c0)='./file0\x00') connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x2694a77a) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x90}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="00000000040000ec96fa0001000000", @ANYRES16=r2, @ANYBLOB="00032cbd7000fbdbdf2501000000000000000841000000140018000000047564703a73797a3200000000"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x40) 19:21:05 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x200000000000000) [ 2016.238482] binder: 32201:32210 ioctl c0306201 20000600 returned -14 19:21:06 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x9b3d4d9af30a5633, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={0x0, 0x7}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000200)={r2, 0x3a3}, &(0x7f0000000240)=0x8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000d40)={'bond_slave_0\x00', r3}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000d80)={@rand_addr="95e18a88fcbf0390cf2469edb1b1405f", @ipv4={[], [], @multicast1}, @mcast2, 0x800, 0xbd, 0x8, 0x500, 0x7, 0x200, r4}) 19:21:06 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x300000000000000) 19:21:06 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x400000000000000) 19:21:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2016.911532] binder: release 32201:32210 transaction 5453 out, still active [ 2016.926916] binder_release_work: 2 callbacks suppressed [ 2016.926922] binder: undelivered TRANSACTION_COMPLETE 19:21:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}}) 19:21:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000400)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000980)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec\xad\x1b\xa2\xf4x\x1d\x9f\xf5\xda\x9a\"\xf97\xf4i\x91e\xd5f\xbf7N\x13\xbe\xbe\ve\x82\xa1\xd2b\x06\xb5\xebt\xb1b\xefd\xb0\xecbf\x96\xd4\x88\x99\xeeh\xc5$\xc3\xf4D\xac\xc4P\xe3\x98R\xef\xf4\xdb\x017\xef\x90\'n/\x88\xae\x93\vx\'\xdf]A\x97\x99\xadr\xdcvw\xbf\xac\x9e=\xe1\xd8P\xea\x10}\xdbC\xab\xae\xf9\xcfS|\x9ce\x12\x8eV\xa8\xd2\xc7\x9bJ', 0x0, 0x0) syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x11, 0x2340) fcntl$notify(r0, 0x402, 0x4) fcntl$notify(r1, 0x402, 0xa) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) rt_sigqueueinfo(r3, 0x18, &(0x7f0000000040)={0x8, 0x4, 0x9fc4}) [ 2016.971117] binder: BINDER_SET_CONTEXT_MGR already set [ 2016.993144] binder_release_work: 8 callbacks suppressed [ 2016.993151] binder: undelivered TRANSACTION_ERROR: 29201 [ 2017.014839] binder: 32245:32248 ioctl 40046207 0 returned -16 [ 2017.025690] binder: send failed reply for transaction 5453, target dead 19:21:06 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'eql\x00', 0x10000803}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x2, 0x1) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) ioctl$sock_ifreq(r0, 0x8923, &(0x7f00000000c0)={'eql\x00\x00\x00\xa9[\x00\x00\x00 \x00\x00\x9e\x00', @ifru_mtu=0x1}) 19:21:06 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x20000, 0x0) getsockopt$inet_dccp_int(r1, 0x21, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2017.059351] binder: 32245:32248 ioctl c0306201 20000600 returned -14 19:21:06 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x500000000000000) 19:21:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f023c123f3188a070") syz_execute_func(&(0x7f0000000080)="c4437916028e3ef3456f65f3470faed445da8700000000c44271059b60a1463c3e3e660f1b1e2647df612846d89845000000c481d96ac8c06c42d007") r1 = socket$inet(0x10, 0x3, 0xc) r2 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) ioctl$RTC_WIE_OFF(r2, 0x7010) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000020607031dfffd946fa2830020200a0009000100061d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 19:21:06 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}) 19:21:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2017.231268] : renamed from eql [ 2017.249501] binder: undelivered TRANSACTION_ERROR: 29189 [ 2017.331558] binder_transaction: 3 callbacks suppressed [ 2017.331572] binder: 32278:32279 got reply transaction with bad transaction stack, transaction 5457 has target 32278:0 [ 2017.355249] binder: 32278:32279 ioctl c0306201 20000600 returned -14 19:21:07 executing program 3: socket$inet6(0xa, 0x1000000000002, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000740)=""/254, 0xfe) syz_open_procfs(0x0, &(0x7f0000000040)='gid_map\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xf, 0x3, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x20}, 0x2c) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000480)='\xc1\x00\x00\x00\x00\x00\xe9\xff\a\x00\x16\xd2\xdau\xaf\xe7\v5\xa0\xfdh\x1f\x02\x00\xf5\xab&\xd7\xa0q\xfb53\x1c\xe3\x9cZeh`\x10\x15\xd7\xc0 M\x01\x04R>m=\xeb\xa3\xcd\x91@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xad\xbd\x14?\xd1\"\xa2\x8cLG\xc4|\x02\xe7+\xcfOo\xa98+\x84\xdf\x8c%J{K\x87\x1ad\xc6pB\x9a\x05\xe1\x9bB\xd7\xecqZ\x0eZ\xad\x9c\x0e-\xd8|n\x01\xac\x85\xc3.\xa8\xf1\xec\x9eyd\xba\n@GM\x9e\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00') getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000400)={0x0, 0x8}, &(0x7f0000000440)=0x8) r3 = shmget(0xffffffffffffffff, 0x3000, 0x24, &(0x7f0000ffb000/0x3000)=nil) shmat(r3, &(0x7f0000ffb000/0x3000)=nil, 0x5000) fcntl$setstatus(r2, 0x4, 0x4800) r4 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) sendfile(r4, r2, &(0x7f0000000180)=0x1c00, 0x10000011c) 19:21:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}) 19:21:07 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) ioctl$sock_netdev_private(r0, 0x89f7, &(0x7f00000000c0)="b389e90131e09945bd03a819e8623c52e16b671531c1732cc2120dbb266a462710fe32d70a50ce092994") r1 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x40004) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f00000002c0), &(0x7f0000000300)=0x110) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) ioctl$IMGETCOUNT(r1, 0x80044943, &(0x7f0000000280)) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x8005}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f00000001c0)={r2, 0xb, "2c5e56ccb144928be49a06"}, &(0x7f0000000240)=0x13) sendmmsg(r0, &(0x7f00000002c0), 0x0, 0x0) 19:21:07 executing program 2: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x0) write$vhci(r0, &(0x7f0000000040)=@HCI_VENDOR_PKT, 0x2) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000100)={0x7, @sdr}) 19:21:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xffefffffff7f0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2017.528222] binder: release 32278:32279 transaction 5457 out, still active [ 2017.550196] binder: undelivered TRANSACTION_COMPLETE 19:21:07 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x600000000000000) [ 2017.589735] binder: undelivered TRANSACTION_ERROR: 29201 [ 2017.608594] binder: BINDER_SET_CONTEXT_MGR already set 19:21:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}) 19:21:07 executing program 2: pkey_alloc(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@broadcast, @random="f44337778cba", [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0xffffff2f, 0x0, @remote, @local, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000000)) 19:21:07 executing program 3: socket$inet6(0xa, 0x1000000000002, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000740)=""/254, 0xfe) syz_open_procfs(0x0, &(0x7f0000000040)='gid_map\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xf, 0x3, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x20}, 0x2c) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000480)='\xc1\x00\x00\x00\x00\x00\xe9\xff\a\x00\x16\xd2\xdau\xaf\xe7\v5\xa0\xfdh\x1f\x02\x00\xf5\xab&\xd7\xa0q\xfb53\x1c\xe3\x9cZeh`\x10\x15\xd7\xc0 M\x01\x04R>m=\xeb\xa3\xcd\x91@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xad\xbd\x14?\xd1\"\xa2\x8cLG\xc4|\x02\xe7+\xcfOo\xa98+\x84\xdf\x8c%J{K\x87\x1ad\xc6pB\x9a\x05\xe1\x9bB\xd7\xecqZ\x0eZ\xad\x9c\x0e-\xd8|n\x01\xac\x85\xc3.\xa8\xf1\xec\x9eyd\xba\n@GM\x9e\xe1\x00\x00\x00\x00\x00\x00\x00\x00\x00') getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000400)={0x0, 0x8}, &(0x7f0000000440)=0x8) r3 = shmget(0xffffffffffffffff, 0x3000, 0x24, &(0x7f0000ffb000/0x3000)=nil) shmat(r3, &(0x7f0000ffb000/0x3000)=nil, 0x5000) fcntl$setstatus(r2, 0x4, 0x4800) r4 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) sendfile(r4, r2, &(0x7f0000000180)=0x1c00, 0x10000011c) [ 2017.656365] binder: 32306:32307 ioctl 40046207 0 returned -16 [ 2017.656673] binder: send failed reply for transaction 5457, target dead 19:21:07 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) [ 2017.755049] binder_transaction: 4 callbacks suppressed [ 2017.755064] binder: 32306:32309 transaction failed 29189/-22, size 0-0 line 2896 19:21:07 executing program 2: pkey_alloc(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x8000000000, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@broadcast, @random="f44337778cba", [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0xffffff2f, 0x0, @remote, @local, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000000)) 19:21:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}}) [ 2017.963216] binder: 32306:32307 got reply transaction with no transaction stack 19:21:07 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x9, &(0x7f0000000840)="0ab7d9a0525d839c5bf45c46260c000000000000") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000a80)={0x0, @in={{0x2, 0x4e20, @multicast2}}, [0x8001, 0x7f, 0x400, 0x8, 0x1, 0x100000000, 0xce1b, 0x7, 0x1f, 0x0, 0x2ff, 0x5, 0x9, 0x100, 0x6]}, &(0x7f0000000200)=0x100) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000040)={r3, 0x3}, &(0x7f0000000900)=0xa8) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000780)={0x0, 0x8001, 0x1ff}, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0xfb) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x40086602, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) gettid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) getpeername$unix(0xffffffffffffffff, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) bind$alg(0xffffffffffffffff, 0x0, 0x0) accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x0) connect$unix(r2, &(0x7f0000000080)=@abs, 0x6e) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e21, @local}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000700)={0x0, 0x40000008803, 0x10000080000003}, 0x14) shutdown(r2, 0x1) 19:21:07 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000)=0x3, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) sendmmsg(r0, &(0x7f0000000180)=[{{&(0x7f0000000080)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000240)="b664a39d3ada4365a867ad930c3e11e6c13470696926f059ca29c1a8b53844b40829ca21cb2010316f3b7867018e224d8b2e118a0d0cb2787589e437657d57539a57c7cbf5857eff995aab1476345d5a0546c401c999aae7641c1fcbfd683b15420aa493461e711cd8c11d1ef7f58424ae7a32d6c024840aff850bfe3229122815b2ce1ea0c033bc486961776ffa4c1c36acf79db53de08958ecac989b54fd2463ba9b4f39234149356d449d34ad20458c885a3be7f3130b4e91f180f5dfd76d43b76513d981afa063e228c9babfe8d4cf6d8757c473298d", 0xd8}], 0x1}, 0x280000000000000}], 0x1, 0x4) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0xa080, 0x0) accept4$alg(r1, 0x0, 0x0, 0x80800) 19:21:07 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x700000000000000) [ 2018.021732] binder: 32306:32307 transaction failed 29201/-71, size 0-0 line 2801 [ 2018.056164] binder: 32306:32307 ioctl c0306201 20000600 returned -14 19:21:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}) 19:21:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0xffffffffff600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:07 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x100, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r2 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x4200, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0xec, r3, 0xffd4652e3dcd8baf, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7ff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xed9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x101}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1000}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xbc}]}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x6}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}]}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000000}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000000) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) fsetxattr$security_smack_transmute(r1, &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000180)='TRUE', 0x4, 0x1) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) close(r4) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xfffffffffffffe1a, 0x0, 0x0, 0x0) 19:21:07 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}}) [ 2018.236426] binder: undelivered TRANSACTION_ERROR: 29201 [ 2018.242012] binder: undelivered TRANSACTION_ERROR: 29189 19:21:07 executing program 3: seccomp(0x2, 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) ioctl$NBD_SET_BLKSIZE(r0, 0xab01, 0x8) 19:21:08 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:08 executing program 3: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='msdos\x00', 0x0, 0x0) setxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x3) sysfs$3(0x3) 19:21:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}}) [ 2018.436940] binder: 32366:32370 got reply transaction with bad transaction stack, transaction 5462 has target 32366:0 [ 2018.484565] binder: 32366:32370 transaction failed 29201/-71, size 0-0 line 2816 19:21:08 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x800000000000000) [ 2018.550025] binder: 32366:32370 ioctl c0306201 20000600 returned -14 19:21:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f0000000000)={'team_slave_0\x00', 0x101}) rt_sigprocmask(0x0, &(0x7f0000000100)={0xfffffffffffffffe}, 0x0, 0x8) close(r1) write(r2, &(0x7f0000000440)="f0", 0x1) 19:21:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}}) 19:21:08 executing program 2: sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$sg(&(0x7f00000c5ff7)='/dev/sg#\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000280)=""/193) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vga_arbiter\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/dlm_plock\x00', 0xf6ad008cf06d2544, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x4601000000000000}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) pipe(&(0x7f00000003c0)) bind$alg(r3, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000100)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) sendto$packet(r1, &(0x7f0000000440)="c8c43f80bd58edc2bbab3903c9f3accf8779db1ee40f31d18aee23978ea284b049243e18c7517f1fbaf7f64e9ffd79618c3170880fdb8bce4d8e6f84f4c068e2c01de57bc2d53f76b2f3702ee595e159e1e414ea42c6fb8ec67a67", 0x5b, 0x8000, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008a00)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000000)=""/48, 0x20000030}], 0x1}}], 0x1, 0x0, 0x0) 19:21:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:08 executing program 3: socketpair$unix(0x1, 0x6, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) timer_create(0x3, &(0x7f0000044000)={0x0, 0x0, 0x1}, &(0x7f0000000040)) openat$userio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio\x00', 0x4402, 0x0) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000d43000)) [ 2018.821606] binder: release 32366:32370 transaction 5462 out, still active [ 2018.835974] binder: undelivered TRANSACTION_COMPLETE [ 2018.881165] binder: undelivered TRANSACTION_ERROR: 29201 19:21:08 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff}}) [ 2018.935131] binder: send failed reply for transaction 5462, target dead [ 2018.999402] binder: 32408:32416 got reply transaction with bad transaction stack, transaction 5465 has target 32408:0 19:21:08 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f023c123f3188a070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userio\x00', 0x201, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x0, 0x3, 0x0, 0x21000000, &(0x7f0000fff000/0x1000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000c00000/0x400000)=nil}) [ 2019.082959] binder: 32408:32416 transaction failed 29201/-71, size 0-0 line 2816 [ 2019.093159] binder: 32408:32416 ioctl c0306201 20000600 returned -14 19:21:08 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x900000000000000) [ 2019.222913] binder: release 32408:32416 transaction 5465 out, still active [ 2019.275555] binder: undelivered TRANSACTION_COMPLETE [ 2019.295251] binder: undelivered TRANSACTION_ERROR: 29201 [ 2019.314503] binder: send failed reply for transaction 5465, target dead [ 2019.494448] net_ratelimit: 26 callbacks suppressed [ 2019.494456] protocol 88fb is buggy, dev hsr_slave_0 [ 2019.494695] protocol 88fb is buggy, dev hsr_slave_0 [ 2019.499496] protocol 88fb is buggy, dev hsr_slave_1 [ 2019.504505] protocol 88fb is buggy, dev hsr_slave_1 19:21:09 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}}) 19:21:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:09 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xa00000000000000) [ 2019.612156] binder: 32439:32440 got reply transaction with bad transaction stack, transaction 5468 has target 32439:0 [ 2019.655357] binder: 32439:32440 transaction failed 29201/-71, size 0-0 line 2816 [ 2019.673596] binder: 32439:32440 ioctl c0306201 20000600 returned -14 19:21:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}) 19:21:09 executing program 3: r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000001b40)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') r1 = open(&(0x7f00000000c0)='./file0\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000200)={0x16, 0x98, 0xfa00, {&(0x7f00000008c0), 0x0, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x0, 0x0, {"3f459685c607675cee950f0533fbd197"}}}}, 0xffffffe8) getdents64(r0, &(0x7f0000000900)=""/4096, 0x1000) [ 2019.814923] binder: release 32439:32440 transaction 5468 out, still active [ 2019.833916] binder: undelivered TRANSACTION_COMPLETE 19:21:09 executing program 2: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x140, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x101000, 0x0) syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x2b7, 0x40) openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x12040, 0x0) syz_open_dev$usbmon(&(0x7f0000000240)='/dev/usbmon#\x00', 0x3ff, 0x1) syz_open_dev$vbi(&(0x7f0000000280)='/dev/vbi#\x00', 0x0, 0x2) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$KVM_SET_IRQCHIP(r0, 0x8208ae63, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) inotify_init1(0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) socket$vsock_dgram(0x28, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000480)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:21:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:09 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xd2ef69469010000) [ 2019.860344] binder: undelivered TRANSACTION_ERROR: 29201 [ 2019.873857] binder: send failed reply for transaction 5468, target dead [ 2019.894457] protocol 88fb is buggy, dev hsr_slave_0 [ 2019.899545] protocol 88fb is buggy, dev hsr_slave_1 19:21:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}}) [ 2019.937247] binder: 32466:32468 got reply transaction with bad transaction stack, transaction 5471 has target 32466:0 [ 2019.975492] protocol 88fb is buggy, dev hsr_slave_0 [ 2019.981590] protocol 88fb is buggy, dev hsr_slave_1 [ 2019.988258] protocol 88fb is buggy, dev hsr_slave_0 [ 2019.993961] protocol 88fb is buggy, dev hsr_slave_1 19:21:09 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x295) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = fcntl$dupfd(r0, 0x0, r0) write$P9_RVERSION(r1, &(0x7f00000000c0)={0x13, 0x65, 0xffff, 0x8, 0x6, '9P2000'}, 0x13) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0x7) [ 2020.071711] binder: 32466:32468 transaction failed 29201/-71, size 0-0 line 2816 [ 2020.085879] binder: 32466:32468 ioctl c0306201 20000600 returned -14 19:21:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc3}}) 19:21:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2020.221966] binder: release 32466:32468 transaction 5471 out, still active [ 2020.236879] binder: undelivered TRANSACTION_COMPLETE 19:21:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}) 19:21:10 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x541000, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], 0x4}) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0xffffffffffffffff}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x2, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0xffffffffffffff28) chmod(&(0x7f0000000080)='./file0\x00', 0x40) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x80, 0x0) connect$l2tp(r2, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @rand_addr=0x2}, 0x1, 0x2, 0x4, 0x4}}, 0x2e) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f00000001c0)=@buf={0x1000, &(0x7f0000000240)="77661fc784f2a1f41189377d2ebbb25b7a0559fcec3ecf14e5151b3bbef87322f7938ec973b8cedb104a15305900dd92a95d2a919daf46f7c3ac08f4a8f5cc7dbc0b48243a7a198696a1d60386b68449d2fe86ebbd3f7758bd860892681c9b5adbaca136d3630c9593c83407a445f52a0154e7dfd24e6fa34d2d6ecb850539a06b21e589d738375904d1e21caec8f3790e93b2bc06d39def275cfd5005c6334666707c906ccca7793ec9ab1e1eafe594d0be93af4d6667755f60935eb0404ff778e1733e35859b95c66d36a5772d9b500bf59e3425bb73233615c58dfe0585c15050df1db32a02580e3f7c1dddf272ee19ff3b6830f39cee1d5671b162642ec529bafc12263fb9d34ae25cced853f727adbc8c9f532855a2f17aa0e4bbb6afa13e830c91b6650b1ad8e75cd69d5e824fb996fccdc68a9451e1bd160b6f09b98defce150aa37be1eab94bc062ab043eb1660eb91eaf251efba01fa2785a77aad38a0a0c4787b3038f2e14fccfc74460db249506702cf810b30d8947f0808e88a6c186b4854008ddab43d8af733d38988240da231bef55a40d0f3c38887088607998f8c1cfe6d362126dabb86773ea18fbb037c688496708a8e250e77215af568f683a5c84c4eb6dd0e2604deeb0ec8f5111045070604c7fc8e39cfd8d7c177b10e4cf06edad65689e4ac6f608b644e6ea3eae93989c17b5fde58d9df8462959d00b585256b36fa606e4c6c9d07701f064a0cd9b8389584b8bbab6364820f3f0a729ad3327cdebd5112d9785915d2e740e0066575e26cbbce5821c439fa9299459c267070795e43a646acfac50ad9585a0949f315ba1482ea5409f901f993381b51886d53d1150193084d79cd1330dd325d8e306f98556c8e8a44a4fbac83a67576fb25e7929fad321fe23baa1f05e213203eb1851358600a1574bcd586809b6548e89ff5d9608dc3baee53fbf3ff5d232771ee37f0e5e2b1f99753d21840e45f4a7526d99ec56fd9c7016588cb80bd958e4501a2ed2348fbafe512bd2f3e98dfa72f68e28a897a6849ac6b9ac566f9189a4978c0dc14b558ffb4717fccfe98a4c5bbb3eff644490f4c690acbba82cbe2a8f9f08a0bc1be5056777247a10c7f86946130bd00824ed11f8f05bad76bb44fb9dc8e259e3410f0c26f3248496e3efc45edf830b882824cb24ff3920921b18ad58fecf37fa32d257badb810eb5dc5baf5b90b1579a5b1b78889c6d6972905a2e71a426296567f30aab24bc5887e3ae11a8e475bd5e9171a0cf0121ed184a8a20ee6c802503bd4cb5de142f2aaaaaec100119f6bbcd1671baec18ae795ca6bb1c6347a8ae82b5047d5b515e9a37e9c95c3c84656a3211ed5a3396440566e5ea6a89adc29992fc0a0a26b807d81b40b19bde98d55a37afdfd293aec4690b8c6ccdd595127d7d4da5b6c0d24e2934b6e82982656672e0235ec23bb4af8ae6e8e53b84224488666dec7344ae03c26bffbb2765eb23cc8b29ebc866b465d5679f18096e97836c1d88ecd1aef57dd7c5f1cc29cba4b690bf4be059d31dfcdbc87ccd2e72f1771f223e260a59c1f7804aecec2306ab5483a7a039b61d84acf90fa641fb7cf6133ab0e5e6d52fbee48e5d633884dca5cbf3143b7820a230b61986fbf1ae7800439c891b77f3bd12a1ca16ada34d87f57316093d21b6858a65dcc0304a80af32749804fbbcb1597c3747acdd5bd3a33885b9ff9be58855f72292a70a0fa140437debc1fafa92a483500c40cd3d591de827eb94661d092ee15af7373c73b587f7ea0ae13851361e60062c73c2e0fa57d4f2a9865a88549cff928d1f07e8604765e575d10c42f83779d634982cdc8c8df2bc30df630a5d899d3bbbcd45579f777f1af6011be4ea19928759bef49a8b00fdbf2b03c40c879767a1d346567a70c057b177db14dbdca1ea19cbc553c928e9b1f1dc64b332ed9b057d9fac09177bc30e4b119e8ca6a02e42ffbdc10710870e88c71c5f9df7dfc58a6b5a49a15ed64cbeffae3523489f13c7b54cfd75bf508efb0cccc4ade69bf3f73233e62f5bfc4b572d6e49dc95dc9206991ab81be0a51060890ef31f74444ec6e6aad8070ccd78c961eb21f2a690ad114fa975561cb786b501dc7d329bc994c5706957caed2bc59e0d2ba9e01cfc1d5d0b05a1234c74ce7eb3b72152f23d4fccd962d32fdf4441ff83755e8bd8e3a5fa9ac977e86425e4add01787be66768e7c7e3c198296663a508b4e2de96e3116907656fc7fe036384dda52a6e0ed7798ddfb92e52ac17021127b3d78a97acd5ae691d68a2e7ffcd527ca929a3ad61690507500b4aa8e4e4b2e3a57495026779c9ec7e89e68307c67e6dbd73b89550c559317665cd9117e1e91f4e5a54b6fa5d44361304b15cb2a7a024ebefa167d1cbc0fa27dc9caa33242061b2f0bebb8405dea777d20d25262a8a0dad50f8293b2613f00a8c1fa165d9c249b39f3daf4a3033355430e118be87343bd7627991249c1642bd6a5670594b8ca518af7f42659dc358f8617fa18752139b41769cb97a1868339cb35eca3fba64216b7b2dd044bba871486402f02827dc7b9821044132ddbc78c41d3868aa4696299911281510afadf89be0956dcb44e613b20b44bf29c127088ad926f35672d2258bb8af7170cd79f0a6f54c624184413bb019701fd16cdec74b0de728fc762ba9c9b9fdd320d9067840d2c90361c40075f19bb54aeb015d75a952df608a7fc82dddcf21f746e9edcedd65af765117cddbdf8a9b1d3070c7616a886c6858c812c7a2ad2d6f21e07d6db67d193f38de433e27fe33ed95345da8a2486374e1671f4b17961b523c1f560fcc1b0d18125e56341fad7eab9ba2d6e8e9ee56ce7d8a772f2f2997038261076b0284b64b7938fc4961638de9019500f6976b672f663cd4fa8fef4fea82aa81f9ef2e71691b35c30510ad627225212a031ed8d4dfc7b4bdeb2da75b7d4c13e2b710197f03e115a6a3e17c4ad4ae5d06a48e089f782a2525c8de501d04710fa1e752ad0dee403e5e0da790d7d3466d9b101dd9e330a6618c8891a8d70e5a21067b5ec994298737532d2235a0553c08a0fa39e90c3f7706ccc558c032985c4418b2d56150e2c40f4d7d483bde0960c4c9a6fd2001c678623f71b36a2237f2ded9e4da0d706c35bb34cbe1464a8ed836f7cd68f125fe13ebc1e8b2cd00ab675f10dc3298db6b4b6fc4dcbec03b7c178550cc6599bc150a0b6da48e64647908efd8f9fd9b4b09761dbf631ed08168cf535b3f47af3ef97fa99aaf4a202f01eed04c88c8a4809d59e03a824b78088b1096aa8c85fecfd732dd8f86a45e4cbca258567e43ffe193670be0955da73880096256a0116699c84f6dbacf5360beb06261b60f160daa16da4db0773f6b09872cd9334eaaa1674da8a46fc978c5712c9eeeded38420ca1b6872ed14b9a5ea09dc06a9da8897223e602d60fc4e4a4ab104d9f13cdadf56c7745d2a8ec0ad8f5c69734c939bfc64a755a634c925f7ad5ec6eab5609c4992534ac9adff9b3389f3a4c19624f2b1366ce261650e75df196b67deaf4890320497c21451b3746817ebacb4c4ca3f01f955eb038da29be0b7725605443e2205000d2cc7e74d3f198194e9d05143826a03a3c188d552003c4fb3593cb111bc50de67d7b2d7c2ad7e0db4464c88eed12c1971f4692b521866ca44aa66a666a78316e22599119f242309e85f8941406c9ace5f2dde3b1fbee4aacae110cd6924d7b203014bb72c32d149b04573585d6a7d3d1053bf3830568f458c31bed3126d1c1a72837bb97066eb37a65db8f1fdac68f091c0266e1abc0513362dcecdb9f407ab134416c15268992ef91e1b8e8f357a5770ecaa1608deddb1f06c0b5a9f30a9eab4e5b3a3dc6a0dcae3bc620ad34a7f8a38c4d7423f986231d424ab3cf4ee86dacda4358e97342634556418c8d9219c718bae8ed9ba83a6f0642fb5779a2b8ff4cd652880c5de79fa28372fac315e33cb887f6c499ab751517473c3b52b40f2d6495f0654c6a84acb17ea410a1a12d25ee25399ab8a9fae1965035718bb87ac9764d1c935ea1243d2e1c9fb331c0053a810ed933d9ff3989c02c828734edbb7a4346cdd3149f0405d7a1e4c40151853d121acabfaf14c51e3389081fc20f1fb0a86f09e3173b86f0a6622dc3b59113cf34d5002f25dceb397ea0eb43735fd8e0c579db0bbbbb1f4852ca8846eef108ddfea810ed624c31749816ad41a948cef9121bead115563e864ded9af49f54097e78359457d2ca1eb2a59d29b358ef4048ae2bba1ebfbd5827c0deace85c59c00b54aeb1531dcd18ee7493f6545a3a87863f5d8c90d9a58030369d77c59039690374a6399f1a6bd7bc8c112fc90388ae09716421d6be4ce3144f63619e8a7ec875fb8aac404caa5b1b632f689899a5c276a10f6b55d1ff2a789b629d81157cd810272785f6bd1dad9c628f71e2965211050d4e8d4e06cb9752d85d3196c05a8ef5b75cd423f41763ff3b6b6cf5dfc75e6cbb8e4846e987f5a1629751970dd5d0b6cfef02be059da82a3a4ccc942d2dc282f18d661922670c89be7634ff4a3d0cbed2a35d8d06aa06cbf763d75fd93b6c290e136482b08f60cd78ef4c3218511b9fff4e0f6ed67d4b974968dbcb1b7115b1a6b0f12c5e407e9817812d498e1f7f4a64b0929bc9800f8c8a9dca88879dd37240951bc679a65f087f554bde48b2e0ff9409ffec1ec780a037f65320b99ad71451d0e17666bb4886f85231dcfdab805296bed945d0446f00579a1630ec73ec75503fe395b48f0da172a4bbf62bb36cda308afd06fd0c6f30bb97b91624ce7b24e77aaf9153a5bc501fd58935f87a8ec98d031326f97be1ae991498844bcf87f38ba7c1208d79c4157ee07b0e970cec4d92f42801efe3688cf29808dd4f879e4703eb8261602adad746da00fe5433684390cbc140195bf1cdb541fe69ed05b75004a076712c0bb0dd6cdb27d8b05f797f44d8d2139776ae9357810f0e413701c40f083126a95c6df1f9772c905c2f404a86a7df16084979fc3803c5a0a867ff44c33fbb4e57e8c9615612e3b97a907bd21a50837d12ab1af81e2c97f52716acf21b7eda14435d4dcd8ed1ebf375c319504ae528b340846dee2422068acc3ef32e7e51dd9902286c30de0382738aad7f402401920063cc7d813468f81631b339ab37bd1bd7ab7d3da5ce325d49508ed1f0ca2019c9fd2b6148614f9e8dbda783002eaed9d173dc903012fab323031445837d37e70ecbe9942744e67915b359838e5dfd49fa001a5b04ee8f1a1d5a2798c56e89e1407e0ec63d66b7bd9650663975921e1ac70cb1aec92ae7d7bec37bfa6eadd9c46b89900bec48d8d1079f0ecb340d8c1ebb9b8d17112aa8191ce412edd1b312c737c35186a73ec60b5abe1eb132d8edc0027e15d338726d020fdeb525d1e721ccc2f95db4c0c42d72bdf4e7b989e57ed3340d737993e86b5faf4643b5ab402aecb0928ef49736699c06648a74c0003b1286f4be1c8570516b94a94b8858df11eca71911b4f6cda98c0a105e20bfd63fc80ba7c2d5fdd7804740c911b2cdb537aa399e2c1d749c225216e427a322c0ac977f8446b15a9a932c9c383dfa1abf07f3a915e2dce7cb282ba096ef8996c260cd9c9dd88b06cb00dca4c82033b4185a0347076f4a169ca7a63eebd64c7f3f1d1a35e53a5ee612efedb510df2fc679a5441343ed5f48dec36c238e4b6e86166efa52e44da589ccc4e768148c5b5e29368e0e9e031909a9338668a48259f1bc3673"}) 19:21:10 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe00000000000000) [ 2020.288156] binder: undelivered TRANSACTION_ERROR: 29201 [ 2020.325794] binder: send failed reply for transaction 5471, target dead [ 2020.374895] binder: 32499:32500 got reply transaction with bad transaction stack, transaction 5474 has target 32499:0 19:21:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}) [ 2020.457727] binder: 32499:32500 transaction failed 29201/-71, size 0-0 line 2816 [ 2020.499650] binder: 32499:32500 ioctl c0306201 20000600 returned -14 [ 2020.634854] binder: release 32499:32500 transaction 5474 out, still active [ 2020.641929] binder: undelivered TRANSACTION_COMPLETE [ 2020.664593] binder: undelivered TRANSACTION_ERROR: 29201 [ 2020.694788] binder: send failed reply for transaction 5474, target dead 19:21:10 executing program 3: setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0), 0x8) r0 = socket(0xd, 0x3, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x0, 0x0) write(r0, &(0x7f00000001c0)="240000004e00ff00ff01009e2d4633fdaad727080400000000000000ec00000016f678cd", 0x24) 19:21:10 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f00004c1000)='/dev/autofs\x00', 0x10000004) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x20000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000040)=[@in={0x2, 0x4e24, @broadcast}], 0x10) 19:21:10 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) fstat(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, r1}, {0x1}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}) 19:21:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:10 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1000000000000000) 19:21:10 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x805, 0x0) r1 = memfd_create(&(0x7f0000000140)='#em1#+\x00', 0x0) write(r1, &(0x7f00000003c0)='\x00', 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x7}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000880)=ANY=[@ANYRES32=r2, @ANYBLOB="ae000000bfb192112a86dd63484a8f62dc68d6eee8714e60b4e4250e65df7acaa024cf7de60d493e43f51effd527e4819befc2712a805f67fd1c67733c1eee5a003bdd22811ee35193995fdc0df4ab6805ce40d545c7c94effe58a2c4b6f89de933c3ffddbbd52f87c8e482948e3a175fdc0c932a28e201e214d8ade6f947425aa256318165e24971485f49a492ef67a9dde1861cb17316dc9eef3d7b4c0c684c321ab82b1d1641fdd3d3535ff7b7e7d305f0f69452cb0a67c5238e6669a3e13b011c24d7c1c87ab8a8fc8fdcedfa074d90168f3f8ba0d751420b823afa4b090f30faec0f705b8cfa6590fbf3b18a58430f906f50840b3b09fa08204498f265e2567ff40f6475b058b67c3d1a9d013befabaccd93c2452be924fbe7144dc6ae54736c2abc82685851a6947cb9a2fd9aefe264c4f8fb049a01117c1b621"], &(0x7f00000000c0)=0xb6) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r1, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff6]}, 0x45c) [ 2020.945307] binder: 32538:32539 got reply transaction with bad transaction stack, transaction 5477 has target 32538:0 19:21:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}}) [ 2020.986693] binder: 32538:32539 transaction failed 29201/-71, size 0-0 line 2816 [ 2021.011420] binder: 32538:32539 ioctl c0306201 20000600 returned -14 19:21:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:10 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xfffffffffffffffe, 0x400) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x3f, @local, 0x183b}, 0x1c) r1 = socket$inet6(0xa, 0x6, 0x401) ioctl$KIOCSOUND(r0, 0x4b2f, 0x8) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) [ 2021.116476] binder: release 32538:32539 transaction 5477 out, still active [ 2021.137290] binder: undelivered TRANSACTION_COMPLETE 19:21:10 executing program 3: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000100)={0xf}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) setsockopt$IP_VS_SO_SET_EDIT(r1, 0x0, 0x483, &(0x7f0000000080)={0x32, @rand_addr, 0x4e24, 0x2, 'lc\x00', 0x28, 0x6, 0x14}, 0x2c) 19:21:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1) move_pages(0x0, 0x2, &(0x7f0000000180)=[&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil], 0x0, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x8100, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f00000001c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2842, 0x0) preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/47, 0x2f}], 0xf, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, 0x0) [ 2021.161117] binder: send failed reply for transaction 5477, target dead 19:21:10 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}}) [ 2021.196030] binder: 32562:32563 got reply transaction with bad transaction stack, transaction 5480 has target 32562:0 [ 2021.213717] binder: 32562:32563 transaction failed 29201/-71, size 0-0 line 2816 19:21:10 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1100000000000000) 19:21:11 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x503400, 0x0) ioctl$IOC_PR_RESERVE(r1, 0x401070c9, &(0x7f0000000040)={0x1409, 0x5}) [ 2021.286223] binder: 32562:32563 ioctl c0306201 20000600 returned -14 19:21:11 executing program 3: openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x80, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', r1}) bind$can_raw(r0, &(0x7f0000000140)={0x1d, r2}, 0x10) setsockopt(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000000080), 0x1d0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000480)={0x0, 0x0, 0x100}, &(0x7f00000004c0)=0x8) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@remote}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xaf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\x06\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r3, &(0x7f0000000180)=@known='user.syz\x00', &(0x7f00000002c0)='\x00', 0x1, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self/net/pfkey\x00', 0x0, 0x0) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000680)=ANY=[], 0x0) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000100)=0x1) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x0, 0x0) fremovexattr(r3, &(0x7f00000000c0)=@known='user.syz\x00') close(r0) 19:21:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000}}) 19:21:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2021.405470] binder: release 32562:32563 transaction 5480 out, still active [ 2021.421358] binder: undelivered TRANSACTION_COMPLETE 19:21:11 executing program 2: r0 = syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r0, 0xc008561c, &(0x7f0000000180)={0xf0f000, 0x15000000}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x48000, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) [ 2021.476035] binder: send failed reply for transaction 5480, target dead [ 2021.484251] binder: 32593:32594 got reply transaction with bad transaction stack, transaction 5483 has target 32593:0 [ 2021.535075] binder: 32593:32594 transaction failed 29201/-71, size 0-0 line 2816 [ 2021.543332] Unknown ioctl 30468 [ 2021.554009] binder: 32593:32594 ioctl c0306201 20000600 returned -14 19:21:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}}) 19:21:11 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1c00000000000000) 19:21:11 executing program 3: openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x80, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', r1}) bind$can_raw(r0, &(0x7f0000000140)={0x1d, r2}, 0x10) setsockopt(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000000080), 0x1d0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000480)={0x0, 0x0, 0x100}, &(0x7f00000004c0)=0x8) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@remote}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xaf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\x06\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r3, &(0x7f0000000180)=@known='user.syz\x00', &(0x7f00000002c0)='\x00', 0x1, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self/net/pfkey\x00', 0x0, 0x0) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000680)=ANY=[], 0x0) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000100)=0x1) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x0, 0x0) fremovexattr(r3, &(0x7f00000000c0)=@known='user.syz\x00') close(r0) 19:21:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2021.703696] binder: release 32593:32594 transaction 5483 out, still active [ 2021.713695] binder: undelivered TRANSACTION_COMPLETE 19:21:11 executing program 2: openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x80, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vcan0\x00', r1}) bind$can_raw(r0, &(0x7f0000000140)={0x1d, r2}, 0x10) setsockopt(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000000080), 0x1d0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000000480)={0x0, 0x0, 0x100}, &(0x7f00000004c0)=0x8) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={@remote}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xaf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\x06\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r3, &(0x7f0000000180)=@known='user.syz\x00', &(0x7f00000002c0)='\x00', 0x1, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self/net/pfkey\x00', 0x0, 0x0) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000680)=ANY=[], 0x0) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000100)=0x1) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x0, 0x0) fremovexattr(r3, &(0x7f00000000c0)=@known='user.syz\x00') close(r0) 19:21:11 executing program 1: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x200, 0x0) write$P9_RSTATFS(r0, &(0x7f0000000040)={0x43, 0x9, 0x1, {0x2da, 0x0, 0x8, 0x6, 0x8, 0x7, 0x40, 0x68, 0x3}}, 0x43) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) [ 2021.752234] binder: send failed reply for transaction 5483, target dead [ 2021.773878] binder: 32621:32622 got reply transaction with bad transaction stack, transaction 5486 has target 32621:0 [ 2021.785149] binder: 32621:32622 ioctl c0306201 20000600 returned -14 19:21:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}}) 19:21:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:11 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105511, &(0x7f0000000100)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) r1 = syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0xe463, 0x800) ioctl$VIDIOC_SUBDEV_S_EDID(r1, 0xc0285629, &(0x7f00000000c0)={0x0, 0x1000, 0x2, [], &(0x7f00000002c0)=0x400000}) r2 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0xfffffffffffffffc, 0x8000) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000300)) r3 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x8001, 0x10002) setsockopt$IP_VS_SO_SET_TIMEOUT(r3, 0x0, 0x48a, &(0x7f0000000280)={0xc3b0000000000000, 0x3ff, 0x3}, 0xc) 19:21:11 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1d09000000000000) [ 2021.922029] binder: release 32621:32622 transaction 5486 out, still active [ 2021.944672] binder: undelivered TRANSACTION_COMPLETE [ 2021.994483] binder_release_work: 3 callbacks suppressed [ 2021.994489] binder: undelivered TRANSACTION_ERROR: 29201 19:21:11 executing program 2: r0 = memfd_create(&(0x7f0000000140)='\x00', 0x5) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) setgid(r1) fcntl$addseals(r0, 0x409, 0x2) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgid(r2) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000180)=""/222) ftruncate(r0, 0x800000) 19:21:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff00000000}}) [ 2022.036116] binder: BINDER_SET_CONTEXT_MGR already set [ 2022.053430] binder: send failed reply for transaction 5486, target dead [ 2022.062261] binder: 32640:32641 ioctl 40046207 0 returned -16 [ 2022.103880] binder: 32640:32641 ioctl c0306201 20000600 returned -14 19:21:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x5, 0x20800000007fc) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000100)=0x5) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={{r1, r2/1000+30000}, {0x0, 0x7530}}) ioctl$BLKTRACETEARDOWN(r0, 0x2276, 0x7fffffffefff) 19:21:11 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xffffffffffff0001, 0x115000) ioctl$VIDIOC_TRY_ENCODER_CMD(r1, 0xc028564e, &(0x7f0000000040)={0x3, 0x1, [0x7fff, 0x7, 0x8001, 0x7, 0x7ff, 0x0, 0x20, 0x6]}) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:11 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}}) [ 2022.230762] binder: undelivered TRANSACTION_ERROR: 29189 19:21:11 executing program 2: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000080)=0x7fff, 0x4) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000100)={0x0, @in={{0x2, 0x0, @dev}}}, &(0x7f0000000000)=0x98) 19:21:12 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x1fdd010000000000) [ 2022.311649] binder: 32666:32668 ioctl c0306201 20000600 returned -14 19:21:12 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vga_arbiter\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:21:12 executing program 2: connect$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x80000003, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x45f) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x48, 0x0, 0x0) r4 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000040)={0x0, @bt={0x4, 0x6, 0x1, 0x2, 0x2, 0x5, 0x1, 0x0, 0x7, 0x101, 0x60000000000, 0x80000001, 0x3, 0x969, 0x0, 0x20}}) ioctl$KVM_SET_NESTED_STATE(r3, 0x4080aebf, &(0x7f0000004680)={0x0, 0x0, 0xffffffda, {}, [], "362a825b2d0075351cb23bb0f5847463e1f4fbc2ea7a232b0bcfc32b9f587e67b39c894bebc71030fb137e18a74d6172e293b5455c8184c930b65dfa93354d82ac08c1ccb1a42ce4523915f1c3c9f17ac2f00466c3f456003c91c3734d9739ea114b5603e03dd26b02f9b4ee430e39b203d77fdea30c27da40fc2751e84f64590f4a2ed192dfdae06c7a61134a1db5203332f59de8fb4a66aad26891040e00178ba48e1dcc99b53c6e902dfb9036e85d777d09201ef67098ed93c4b9045649d4dfa614def17e654a67be7cf6103bff00db0219d2012437761225851c52fabd652d24043444b026dc085a41ad656675d338d73b3b5433979a2e7bfb329cac8c8bd5b5bd922de3ac41e4690766945833bc7fb1d7692ac2eebcc79afc97f91b42a55c7e89cf0c1da9ae4f4fdfe964d75cb590f66d85006252b0688f1889ea4ca62c7325ec85326595bcbfa0144f3492482baf7244efc1ba1c051286edfde6247347c904faba9c19a6b292270d73bab81d40e82210354f3b6b828a01f3665e6945a4e4aca86a53b1cbc3d8931e2a78ac7e78cb397d75a6d5da24cfb464eac664f4ef355cc3cf354f6312191c519d34294cad30cfb901ed0823fee3083a4ca68e6a394bbefeb0986dd2207972649c994097029360eb9372ee80ece92a00c84006cd607a2beab5af63aa84177bed2585b7bfd35c27ba520f7fa4bfae7d98c01b505dafcf317dc8f7b31ce07e781bfe36a99cb9e11bf8bcbb14b1442f6ca6757c7e87a5a9f17b64b523e69b7332f4e669299ced7e5e286f395c2e0ad1f3e8d95cab38cc208bfa2a354f25980d182c7702d0cef1beeef8389ff185f117d4bfb45ade2c7e5531ce71f037ef38b84e36e2825b87553bc5c7e535bf45b2815653accc3920d0dd716efcfd606c679608199bb4c0db28389af205ebd87bfc7a368db15fc62f2b808d062f19d3b92c5de5a627b3b7deb7e03ac387c38b4f9fa3dc909f356d145df986d3993ebf7326f797f77d5ae0406e10ca9da1bdc048121ca1c44decfd9aa74dc1327e724dcfec664b3d4ae5f526009370c8d3b0f9ca55577f0cf13485cf4b78ea4586ebc4bc1350db7928f704add52cd8519cbe684c097443322055807d7c5ff6fae93a205e1902ab62b6b07b7f62a8c2c47d89ed9af9c1f94f46e0268fca1283936d1f6038366512a04d40d27f71a45cc64f5dcdea5413094ac8238f5ca3a67b81261b4c33695a1f3b530d8e9aac302c9af834def4b7d2b5e530fdc500e4d4c594d303de6e94016040b78328eeb0c74af76f5e4f10d4f6ae9204e75aec4f4d241f246b80943a9c8e85c144a8f1de9dc47cc8e935d9ccb24ae38c4c27ffa8bcdaf45fa16a3de2c6b0504a5852aefc8009bc23d5aa42fe27ebfe55e6a084241ab935f152888321a63bcb3cfa6a7665e1ca37d8534c719ea1ca3503aedae55b5d5740fe22130be371a91d401b8033ff1a31ec328f0ec29f1b8a2820b7623df9932a89ea0a9188c67cd9e0cb61ed8211dd4b8a6dd8bb0c48430374a3bc7ddcfa8d937874e03372b174ae1fd4fea0faebf1ccd5a2edc41fe7b4fdd3bc9e9d814ea22124be027aad68cd2f078072c0483ebf9e373d3acd9062d50194b7d29434439eac91501b1b7a68e9c69b4f5a9ab27f43fc35cd3031e93f87ea3a9c62bbf50f3cc1752cbe84e71eec222695d5b64baa3e465cbe16f071ac0e5c43e09f7026460f6b366d00d86e911ae92d65e8d47c3a6d83c02a1ee61cbf38195c1c8478238c6dee05b9834211d8064186b216c2c9bcbe0cbf20c9cd84fe5733ec2a022995f7f2e8f951ac0d79cf8347f2e9bb8d91c59620de038a71b3afc0014952ae2fdd2c86eecb2bf20335ba3712088301f7d04ec431cc46aa53a3a5674026ccc9fb94cfd30fc9fcbaa7a87293814d5999e27e706b5666286daa88c93181a0535acdeb73d53653c067a9d76fc22e26cbc14b72ad27f4bee2264f8322ac004f5d00ef3da835ba88725d99e6930e38b7443351f7dd0663291a3db6143b61380d7c76e964c402d76a542d69684e5228377a6fe22c996b0211d3faa9d8fb2737eb4924315af125c06c780b495acccb4aaf516e391d5773aa636b4bf4904046001a2a2ae9b850000157c4088c7b1e1f78d0e0457229ead7645e64099416088799456e0d021216e1dd312aa05d08218ddcf530d3f30733bb6fb0e38785d92c1a67d43e11ba354da08a7f806dc7547960104ca1a55d2b5d354212a1d535015da63568ef24851beb08f9221ecf2e7449e0327d20373f61769a0ae81d492c45493dc985fc337e3edbc7ab54893c798efa734ec2bbd38dcd06a5c269e2cf2a48f2faeb4edd2dff4506d8b0dfc973af15fffb8ccbb14a83011af4bf27602d6ae1299682dc73c20f4c84707ed70a4eaf6788ea810d0b1c70d45691d87a57194d501d4c25e5d518f030cfbb90c1134ea811a62a2fb85d0a6d7019905dfda7459cac30cd600182e5a27dbc0405fb7f86c55d7a07e24f74c5dd68fc4d35cf87f6f2cc03085a15339b3a8265ac4c911de8f1b3032aad2e1a2458ad505c3e9c471b1209177dd1bc95a1f93a179ef2dcb0bcf517f41547ccbc128ef5a3d060b59e668a878c93bd2dd01ac9e9994c3bfc96e3e70d079e2de87eb1ed42daf7c719ecec542dcc7dcd5d8049cd36535e945b942ac3fbc99130b3418ac544d4fba6afdefbef294efbbca171ebb1b953f570ed5be504e58004026e4fd5fe4e0938a4f78a1c17547c40215995acdf52d429bebce107d5dd75abe4dc7555407fb7dbd7a745b5d679980a8bd468d908e3aa8de498e100f0bd124b73f1a7218b9e58c47973e763d1cabea67a8cb84d4715a5d318cf5b412c30ba6884a534d4dd7f831f2d1f38359a01beb3145ec55e2aa26bd3b78afdf05e411e2b3fd48415c8d3ed68bd208bc6c1ecda3a16f7534c7e4ad311c9b7a89175ded5612d222bcfbf51adc1025d28a54c365ef43072f7a6cbdff5a42725be2be1a8a605649d724344b3c0feaa9f052afaef95a1e49bf581c40324b829f2ba4af475baa973fe30745101f2c30f77e21a04ef1530656fc4fcbf12e45f7b261ca64f69895f485e46ce160eef960712c390e6628bb56df293d5f1e956035bc3c7b8916135afbd4291d50d55eddf12db060d4d1f1b3f30e110f4931c47632f60e3bf43d1ede7cc46a7f5a60e886cf6c7670c49e3b8fe99511fa766917609a342e69678d1c54b722bd63b4e610a65fa79fdc52356c63d45f867442062f001f7386ee89d23ec40c0207b36338033434d0fa34a407c8e441115ec7446988e7e29d16e33d867160af27301c0bc98db300e70fd443da5ac3662b008cd4c7b55b2bc82e4ed02c63d4043a538d40ec72c2a73ae1bb0f8e4b1011a9839adc5aa5f0d90c888f6ddfe1a42d0ffc04d2e15606355700dcc530bf38b6508a02aae689fe59fbf33d831f9055dfd228252f162e24514198da72ddcfd478d19790fb7b05b2b929df5aa9eee00b99eeba38018cbe11d1c47af1be65ddf030d3d8b5f0c61b4813aa706c90916b04bf2716bd5386817ed120e5cd3e892ccaa883e3159affa04f95a52ac6cf1c9e7bb6ce9261df570ca1a002d5ffeebf512e7a508d7b68e238bc821dc80d2a29801ab19ba4da8c3d73dc7a83ced4562362d771428fa831ade0e18db2f0f930853c70136b93678139e5c08f1113440fe960e9096abc148d6626cf30069b22974f80e31db9784e54dd09a83d2f5b77eefc07a529f09036277799be4b4709f79f21710f1d59fae0181b3121d2e1c8e49e2b839303a234b3f980126291afd0283ab296c21ae90d75f7c5c2aa243c764800e8fed35cff4c84d31e7070a6ad2456e50d4e161e4005cbdc378ae06cb98c8f09a338fe455936c68843c830a0fd691a490a00752013db1dd60fe24c3f91dc10bb81e4715bab66e2ae71cc792142fb4ab3c72f11508cf0c48679e900c0b1de393ce7d7f55ad00be17074b7325ddc8e6f16020a4cf2936dde50c7c029da428eacdf2bdd8328c29aee1c40b3b6d278cfc30164f1dfabebc1ea192a34b04df433b5976c151615255609d0a89a8004bd8a7ac12c3e181bb6de710aae1c7676dfd2ed57f3b35532943dca4473dd191bc41de55a2db013a731a3f37e3aabde8f358bbdff5805c2206c214f59a10313cee9d5066b1f9c22ca43be408d77332349a17413f295760cfd1b65e24dad10fe72427b566474cd031da08c9d7155e127bb885833d5301d5fbf91dad226823863fce538fa6eeb5765fe315e19b7de59fd87b1da3e5af842c6c5ba1685f4500e4c4832cf5f304bd7c44383d095f8dca62dcaca1d6e2873ab97e2e82dec4f9c3ca22aa01c88182cf361d405180d6e3e869906d8de3cc4f3f24b10cb595e947c0fd3d45aaf1f3e4a209caa4f7ffe64adcf94d7b8360e5c2e3f9a539f015cd9b979ca5578cb02d235e7cbe4a7973550ed4a4a82daad693a224ab87899324763335a9e943edd0d16e81e64f0e76ec9f7c85047acea986408bd05315636d9e5915f1c2981703ecc432bd8292db3d3a2793f618224d23dd4efcc08959d86684bb6a4367329d4c41b63838883b67559cacf47555e1dcdca6a427c19f6f3bde6a4051b043c7ec57ff755463f2aa9aa81f2fd67a40b45b5c9d725e28e6b0832f54799da30ebad67da14e0f1ca5dbfd3300e4bc70a2278ce7ad0482f2f34c39018a3b4795d4ccaef21026b6689b9e7e8a40a23ca7c995bb72f263b511b48bb1adb9051366f37967ff31746d569225efbd92f5e86c84f75b06b6aa122cb8c4811222e703116f0d7c302f9d57b4f8027445387d6c2ba3a8c33a1f7faaa3b329be09917aa182fa8271149b37b446f3d4bd677930f236d34e112ebbc28f46b37378bc58b1abb7f22c07cada9c8fa8cb11d1820e31fc60f6a2dc535d6285831ed5e73bdb44b03cf664faf5cff012de4145c7bf762e9c32aad42fcc22c1f26d8cb17f43fae4eac6061122bb32488028fc128a7a154eeb0e99361fa837f5f6b086f96daf9db93f08b72e51abc24f6b21548aec67372ceccfd7a9d218bdcaa56fec76925c57dbb6cb57c74f424ef4505324ce5402d8a09a59108d52322f63288b6495bb2cada8c5c2e698e94a18e1182b7198a1924936eab33f6e960ae5e1f89ac3edc6571dd8f6cc30072350faba688e71f0018b72afb165ed1caf5212b7d71133268453093140374e4daa8cbca14ee1c1f47b3fdf74630a12680f54e1eb76d8f8008a5350c0f1f07418f80321a0649811586a78a3a28da4046db067af9c7f894e0401e750aac899054d2e8c8080c10142684e5a91e91955e5240fd1887114bd65cbd8eb36aa63461beec2ff9d9042d9bc9a286be3766aef41d5bba9fbbd18d33d608028d32a3fada7b0390b6c69b278436136a7d631b0582b04522ff9bf0ff57a2cf07023a270540275f613cef5032eab53cc2e094c500cad34a4f5e775b5efc25facbe432951dd20fde551a884c71a36ff3ddb5b8322057742f487bc7709fedcf5c7f60be6daf96d16ec3758f4fd9d75c021c73cd94898f4bdefd1547cad5bdaabf28cc6b94586329c0ebf79c91f72afb1b1c4f546d90acc09c09cef72b3036d72a23444f3db5683796740c84f4109fde7be1c49392c76e7cf1fafad34cc1d5c936a8c5fa7b4fcb2819ee0040751778bc2493a64bdd56c41c9874d0c2b24752b0072dfd5326b13d75639aa083cb808922332511c29e037942d1c7dc12cd6f64c3557811c8e2e5c1b499f95458b66e3e40fe28e59d08b354f8404966ef2edd14e2a9d11ec876da7bc", "1f0b9e513a42ec679ebfd41b28324118d4c1628fe02a97c613f313571dd0efd63d679eb1024ddac20c2e38ea1340a51c479e354d14a4aeda959b8cda34c8edb7d627985d89c85dff22f8b6b1a33f2ea902fe64ea14071d78a2f2a59f5f43ff3dc5a5d0d1292fadca2c6112561485ce3e23a15484086bde5e6cba08c0a2b653d97d089e259b0e04eb6b2fa61bc51a834d22c0e904f7c43fdbf53f055d7d0b1f196915c23e0e5d1edc3c110ca21961d4b097db18849e1016536ca5f424baec5543ef5b0ce56aa63f5253383d7d7be6aa1b967f14b0081c7683120d19544f8d303e1d26c5e84eb6aefa23aa3333caccb04f32c514b4e7e6f73239226990827e11851730f32f3a9c852efb05dc52cccbf7829333c9041c122d22110206ef09ea31dfa8169a1f2909967a3d7de2542cd879eb93563adc118275aded4cdbe09b4d4b1286fa1778af4a4c850b45f3b7de86f8e677e51c13897a3880a1924cb8279952fd9e052d0f3ee13626c5f3fe52d30338e6b37a959331d6edf0f47d3e3353f9d776c2eabc8b84454639e28fc08002973d0f5187077a1a630410d245291331b152db41205e5fc5188c7bb53dd7f91a6ddc749616719de900e9e59681983f3e27214d79b74ec8364fd40b9946b0c12d7b8844b5a35e79580ddb84452f8fc1f7e327726ad7881198c639c0bc3e8300246e3cde72ea43227bb8430da2d7a7e5b468acb556833da07731205cf00e8eaa5a0acb1db03ca51f30ac7c5a616719b3a8057600be4c3b5b284e644a4bf2399a1d2668f30c7f0de655808ab3096bdafd9dcc6ebf76fa3a1febf311cf7d78812b649fe4ba0473cb65a34c5c380c78ecb0ddd8a817f21637575575e1d74075ad74ea68b226be01950d3ad5a84a19d84a1c23c3da764e512b97e00b99fa1e2c675273f9151e15f838d1303320dbd46e69f549f04f1337e9e490427863270888f7cc525f5a55daa60a7367e2912f6e5add373d1aaaa11a66e89bcc97ca1646a8d8acc40d6644efce3b563314ae41c6a20653788154064c53c8f9885cf847b3eb4a54dc7a304a3354db7fd6d7a22effc19b010c4488a5f33529527f9a957f1fae7ac046881943906f07dbb08e848c01e4324996af4ebb78bd2110c66ffed0939fe5949a52200c7fd3fc44789fd17657654688274d65851ad1685b9d037bad5d3c9fa4ca4e1ba0848bae2205e3264af2e60904a97524fceaf8a30502287b583ee8cab97bd45b3c4abc1b53698398f3d94665b75f1c485b3d5820be16d14fe5c8fb2d76f59cae6dcd892d3d1956b9860100000000000000182c70e71c7cb82c21c825487c41d7c7f954fd6e0b7bf804b954411e66a55cf95a07b648559e0956226dadb03b76015d1caff91a71ba88bf9385dc2ca59b84292eac5ac09c7a4e90d1872209ebb590a68d54cee35d8d6ccb8dddff7b062e56726a92b3a1986252586cd7bbb56ee8b81ebc65d21252697f2b01b7eeb9e767d692fadf373e2a859a1dd2b1a660c41ff3035ed637791da2f343ff2260dc78c2c58be408e5940bb25f8eb4db666bf7632bd7705ef3e314e0111d850421530d76037123c12b2653263f16588191630e7592d5389017d3b17e83ddbf579c73bff2d51a88861743a2cecde3e512e082de000000004a3f753fa0845851a2f9cb42635c256707a919312a2637ffc82671a285790f0fe392133378b5c4a50e7802212458c9dd30ab52e4ed52397a67c92c8718cc1bfaef14f11dfde8222f6c89d07415ec4fae4846da250bb5a7ebfbd84f25bbba9921667d8af3bd5622ff3b7d6bf93ac9c89072e4115bc0b4755485a952da6183311874051b832991c1b3490ff9cf198ad385a5009faa1d7fc6d4d963b3c64eacc56136356b52d9c661bfd9051ee11926405726d0bfd616eaa72f49773d57a80cf8dfc088bb6cade15f4f50dc72af7f091f0c9ab0737eaa6030cc00c567db26b994e12b9ddbb4d8b340fb8bca28125c300b925aa0dd43af4e167ca4ec37c5dfff55ed85cb90e3744525492c9b08d0434d2a2643a6dc79bb4ee295f047c3195e03e0b01629affc5774181d09cdd0e6c6816307b3e8943cafd1f3ac6fc7f4d77d61a386f98415d67ce02b80e01f2849cf740a731aae2bc26de3b11e5ce37f6d2283bad9db855f30de91fca2f8fe780f3056d2c6924e9907ace977eb2483f9acd101c21c8de0f08d54c56eca96a410f7375ade38cfbd5ab98c7fb32e60fa4b6fd077a7827fbf725a32dc134cb006084f4b77db72bcf6d2e5a06998e8e2e3f0d372bfb494260a2e4c43e177842ec47d6bad1b778b9361201dbf054d360b054b5b689ec684dfac02ddfed561e7bbb9adcfb1b9b4731869c8604ef586f2a1ec8e4806608fe1c9d4bd8037f34e38dd8064fa8b6be35dd21ad6424202fa00af97936bfc1bbd881927bbbd8ad9d4e7b644543a1cd027a2db3d7dd53b6ecd99af6cdb46789bbaf31f869a12bf8c904b49e286e7ad97ea2a9d3d27e3a360c53e6163fdf059234f54b390eecc47c63453172726e2c947ebc182f4b68a571591c4c869a1fd884066b659a68112bc708e856427a51e049bdff3c7e0c4dddf8e40d693c22b29c35254ce4dc0da58a2afaf20b8316e615c20bffe261de57d0fd9c80f24002bc309e59841ef46ea8f3cc369d3654ddd2a9d3b4f26793766ef01b835fd2e809fdeefdf34eb90aee44aaf80b8964604d565e63b236b857f571f5cc4aa3b4b6e7ffb7b771beaa883bca127b0b55ff7c0cea76e47b8b6b289aad36ade2297af1ad70d06834aa4e68e878423a1524add214612751c2858398da5651dbaa6d4ac1e1f7bf4b0b1533fb7f255887c6a5964d87f3877842e1594fdc94a61d509343780a866e602846ff52e209b28c8a9f1d96934413d844993fb900aaa1b2a5b259adb4184e6aaf802eb31f10efe6f339a929950677fec48199fede230e3b01dfe4d58ff227fa821d978dcb641be0b0e21f5bc0cfb9dcdc66f7d7883483b53cd0b04389e91e516f90175288ac30f0b7bc00e9c0f5c1adbac2a8f894e9678b4ae8e565efaae2c6057dc066ac4bbb56f82cca13e78d638cd1703a8eb6871ca63af19919174a6dc8dbda22bf7d989fc70115b4153bdcb7256ead7e17b695d0bbf989743e794406622dcdec0e0d6eeb5e263515b2c8685287d0fde0507ac468971d85e50297caeb13ba108053c6aa33b7ea2618e59eed135a824c9bd0818414b0e6e0c46f22086980665f8e9517d003daf0ee6b59c7a33d1ca60578acc71639e23c958896cd5305cfb0d63bab64d9483f0111269ef165d540e4cd44068062c7dcc09e3066de0c9033ae067a03900a2bd73fb67e1d340adb969d2be169fc059a1834a6f85f3ac651fed2279006b45ca0e6fa7e5332a1a68d8d0d77bf62cb2e1d9a0d0442aaf9a989d819205d0119b0a07073a13b6fc7cff490c531fbccb48a449f545168ecd673c288c9c64c483430b207984684afff2d0c6027c86fc1074e963c480355b6d17c6b00a98d91ecc0aa6207492fee52012317cb648561627cfd7a6ebdf92d2fb0b75645d699f8dea515bc742081e63268e62e9d4a726875c5cc768e5baedd00d546a495093cc4d79a940f1006e66cc14998ece51bc18819425e7df6047bd018da981b71c6e47e511509504f06da67acf7f4a4c845346f1601c6a4f29c4bd30896b0a0e06618c8b32bd8fa8e8256dbb86a6574d324f75646a836177c6a833e78a3926af3ed9c8ed363ae9224b7523d8b934eae969801e090a1560f46a9542c174af0112d1d3c2ace73ab1510d3a62de7a171a85e59b31f2b3427fbb2505876bb51efca76ae5cbfc730c06b058173ad39bc80509eefc19dd47cb7e5fee8488a0e990d8e6c004f1af86d483f5de858ed26bca32a25c3528636c62835acf02e95ddfce3f91d3924fc1dbe2844629b780d14ad143437c60128bf55b1bbf765b99b0d7cc6befa777d31d61e558387941fc418ed9c6c133287548b7d7b5008a98b14e615500b1ab2f7df85782daca43b2a3ea8712d2ffc6fa734e9158da06dd4fbed0f67d3086ed8c58825b0457e9f28b53171e5ba0b332d01f94a474089d17f46b60db0d3e5eb22a38c6e26bc11186ad5dcf62bd0bf10f9664945e99d90ceba3fe90aee991e5f7cc3bd5569f9950067cff31d7d2040f5fa5132bb314b87d5bf041d0be431b54664d3c6af255fff3b68ce75bab62d8667929fc6abccdae8afac89c2e8000e7f22c68fc852212daee06d3b7b2bb5169a8be3bfb1d6168ad23c523af3d6d0467b43561053afe776a8a94e2b8e5dade184be5f34f1b097f2c7a8b40464e3886f9d0e0e12596cf017c9443dea699a3a8936d6c2d73e4924a481cb8af9c69595589d15a0d4641525df72993887dd16192d1b6fa0146a4c82f28c5a9d5849ef5fd772f6966875ea0ed1f1c0efcb2e45e5967052e1414b4de236c3da4e05c616b88a5f147ff1d993ee465090c7ec180fa6adb8f1acbacccebca4a215843aeea79e4752760577b75e5f39eca7a921ece10f83615393dbe9cf1c1efc215c4ac889de1e10a71ec3146e942bda0a3c9abc87616914da3dbb1a6ee54cdc59bea747194d212163f421633a5a6eff9ff1da055626aea50734b71069a8306448449942c62bc643a7c81e8e35813b9ba5e28012a55878a4c4f6653b97c7d328f901c4e6e04d6858231b0efc3280f2f8592c613e1163d90e8ccf9bf6c624d606b19cb7e8f297b8f53725edcfab8153f27a1478108338cf8e5068270b3a4d6b8c72c7ce55da0a023a54949c221874d75527c2aa6cf6f3941f4907bf17dbabcac9577a8ac8ab0ca490e7d0131759a365be67ea022ea3a324ad819bc48d570f3e5efa2bdcc22d5fb1b86bf97c3034ec6948ed4fb2e36fd4be43c22d4a50dcdbffa7c193863154b417f24a291bf19a049abe14e68dbcbe33d9514da9181d5baf1e0d4950f2986d5b5744478dca29411af665372f9b9d62ea0c422aca3d675cc09b3db9dfeae4f3ff450e11daf20c8a533d30dc0837b6cfe66ccc3e08fac9cf7119114ab9ff9c06e70dbf09a8bd1460e7c71e91b7777fad1dc3cffab2d1bac90d6992a4d2ef493e1fd30bd50c97ee17e3c3c673ed17e39e093244d8f6d7c3e626639054a5185ef0c9b402d470cbd6f2b0e614daae562c03bb8ec08989965cca1b4c80192c278df55690a21d5b512c07e3650f0741d414f324437b63cf0e5c4c0e35313961b0a7c3fc303a4e660fd9a33681d78781f8f2db5a6b11588063c8c33778b3d64589a2433757b4da2aa3245fbecdb0978cc1cc26eb346ad38b7469e3c0d874fc1aac94654882edc13f82abfba20fbec53578f24f1b1458e0f24a88e5e5cd1be9721e332bba4c724792819bb696b492d6ebbccbe48760a891fdb4b118a94f6e8d16d0b184edf713eaf11d595deb5b234dd566770d6ffbd7fcc4c32c09bdb420cd38fe80ccce3f37c41c260c1527fd09947ee8457fecc4da308c2cf19648581c1b0d3fde0f645cea0cf7850d5511b21982e4c7cda7696e890949ac53aed5e9ef16af8536697c13b1db9875c8ddbd1395ac7a6a48e1de652d71a9422740edea16abbf2ad6bcbc198aa1418eb9eda000af55a17243e0837a909275613a171eb2f49f45e7c2fced84bfb5f4b28c3daa8ca08680b27095e74690cc99427ec01a88253b12456cd8cb8c2c4af6a2ce0d597f406efe49503799e6148985cce9ab39f0f9da91f79651f0c380526d228f754f2eaa5bac557e17e9fe0eaf81e36e77b63e76265d1d018ffc79aac1bdff5ec5b35764551ac38ef56e3f34ccf30"}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 19:21:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}) 19:21:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:12 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = fcntl$getown(r0, 0x9) ptrace(0x11, r1) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x101, 0x8000) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r2, 0xc008551b, &(0x7f0000000040)={0x1ff, 0x10, [0x4, 0x58, 0x0, 0x372]}) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2022.491537] binder: release 32666:32668 transaction 5490 out, still active [ 2022.501433] binder: undelivered TRANSACTION_COMPLETE [ 2022.522709] binder: undelivered TRANSACTION_ERROR: 29201 19:21:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}) [ 2022.669608] binder_transaction: 1 callbacks suppressed [ 2022.669621] binder: 32691:32692 got reply transaction with bad transaction stack, transaction 5493 has target 32691:0 [ 2022.697539] binder: 32691:32692 ioctl c0306201 20000600 returned -14 19:21:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2022.805234] binder: send failed reply for transaction 5493 to 32691:32692 [ 2022.850569] binder: undelivered TRANSACTION_COMPLETE 19:21:12 executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000001380)='/dev/usbmon#\x00', 0x7, 0x1) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f00000014c0)={{0xa, 0x4e24, 0x3, @local, 0xe82}, {0xa, 0x4e22, 0x2, @mcast2, 0x7fffffff}, 0x2, [0x0, 0x5, 0xfff, 0x7fff, 0x1, 0x3, 0xfffffffffffffffc]}, 0x5c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0xffffffff, 0x0, 0x100, 0x0, 0x800000000000000}, {0x0, 0x3}, 0x0, 0x0, 0x3}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x17) sendmmsg(r1, &(0x7f0000000240), 0x0, 0x40000) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x102, 0x0) ioctl$ASHMEM_GET_NAME(r2, 0x81007702, &(0x7f0000001340)=""/53) ioctl$TUNSETLINK(r2, 0x400454cd, 0x103) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x40000, 0x0) write$UHID_INPUT(r4, &(0x7f0000000240)={0x8, "dbe2b9b13b9b10d61e70e088c337d96b5e11a11e54614db5e858ae9f6669fd8c9accbae99a6e327d5ec26a914d8b9a1b9ec6803fe94deaa2bcf54c32135fba38fe7411a4af3f023db7dcbc88e495d45c2c950ded7e72f5e6f4f68d159aa42ba427eb5317d0dc74bde6d9961a21fe88ae692e636247e0d507318d46ccab188f113112cc7665ff96b9e10bc5d6f04aa40bb1106129fe7a7b4bde7b29d44715023f40132c1f9e987a5a66cf4cecd6005f2c03db643f243e9e8bc5545276cd4b4f398755006a9bd9290403bad1d5b749ce4ddefd7992940fdcc31f284926587b353fc1517501da1afc3270d4ae1ee7eb9bd49d7b928293c77ef33844a8e561ab3a17caaf3142a0b5275b5623d91c11ef0903bcd68efe385163ead4955ee871230fdd5e93e71ebf725a27e255d11a3c075fcf0ead88a537372580938e7001e5aebc0336f886f003005a42a48861bd66440f7e7c138d5a9ea035d0fa7ef35de1cbae34a3b056439efc1d527ad4540268105c1b77455d97a9b74cad91b5c654189fc3c427de18d4a8207c979f4b46a23fdca7b80c391a653ab7e027f629d24075673cdb328c9fe669d38f42127a708aeca84f8e4b79209c70cd32e56b6a825022a01ce8069a5e5eac18e3cf7368c9dcf6407848fc54877998b038dbd91c74a852615eb5e185bc2ead51c7f4abf6d6314e3a4c65e3677f388c20ebc654ea4b1c8345443c1841b3cbfe021e6c484d5a61c9ef778948205291cbbe70d9677768d25551cd868f4007a3e1c6cbb539930e8703e077a6fed7380f06f53a9e8a67a15d7181c26857878eec1d90e439ef68955e6146b7af404e2ac6a707e1794d750a04d9d314eb6135c4c9f5af765340da06b794bb370d4645ceaaa5ebb205ab2973ba6c659df6e8312ef706dc34aa6ffb4613dfb2ba618ba71e012192c2388deb7e5901f914a62c1ddec9a53cf49804b2b1b7d549c36971407a1e595eb98338a0900a2e184d76799f91f179e48a19bf0185a44faa4e85176afca63e8220155dba3474f58652aa5ac8cbed792e6919e79ef265f2f66c0fc642afbaa8299da670d4ca1d47517a8c790f861dd0077b5196a1d7221ce37248187d80d8099c8de4c19ac427ac1829fede488aee6af4c37493384d201c239eab8308d39bb2bd8aebde82ba6603382039f874d8132a0227aa72398688480d5560e3e90921b49b831c7e974df70a9b5e825e7291cb7bcf63379d26921bf4e3d7d0c1ef34fd1a59994be99ec377daa49895a02e638d1dff13945a7d43b0c1cb34aba470d7662f2b5cc739dffc2cc19bb6f15a119822027cd567c0efa9e49e107891baba787c69da0cef17f80f9382847e6719c884191a76b134578ca3f81b8b34c4bbd6363ba8c5921bce85559d44136e76642f3ea5c6bb1ac061a35c74509d3e5ee3742e05a55a565f42b9df68cc2ed29f9c6529188e376bb021e05eb7c696e0c50699acf6ea03ece6bc18f2f9c238cb78e277db2df1ed6c014d8a76bb682561255366c2229ea3d09c9108e19f817ad97f31403680ed79b235e1b4b408a0509e03a177ac653316c97b95be5509ce8d4a6ea197b40723d208cc6ad8f917e78125a6a2b1035c8aeca8caae05f9e76cc16a6611c89216c3e60fd3dff726c658524a976cd93e6982579e9dfcfbdab53284348b33335df4f613644b2fcf3e5e72794bf63f85d83f29e3f522dccbf483b8b3fbd9c77e836e2ce02e4dca1dafa44eb991c4ace7722905cc7c5c5dcb470f5db8821cf6eace3c17dc70011714983550fe74f91e82315f3889f3a8abdffd5e6e65436b7cc23dd34299f25a12f470b5b18f9743e01783837747bba350b1ea8dd0130c5965978a26db751cabe741bd41a310bee3e2df1d1ab01102c9bb81fe6b41bacfbcee1f543b5108bcb73b846dd395ee8aa0c2e0fadfaa8a20220aacd1fb5a1bdc181227947d6cae685f1c6ce071ec40d563ec2270bea3b1b7c9662e00a630108003ef2ca06e514d603c03fb25150b0b6cee6ee46345d34ed1ed55995e2aff788b420c45ec696caa0211d6828422c388e418753c5511907a30e2e37dc648fad0fbaa69d151530e8d1a93496fe6e8678f84bdc9fc7c9ec7c62b18ec8d958a48e74f32f3107590291860d6d9a17c09db9264278dce50fd6773a4aae114405ad106f0cf0bb6a433db0df0b49755c49c6ee6f7fd26f53fa7ae4f8909522287f3392ff7b00b64309ef9287c1230f3a9051904d8c82f9bd233eb6d91ea313ddf0154128722132085e3d5cad1636d18f64f088019b3301d24f995a768ff711aec3a02688d2705ecf98916153a4103686398923ae0e3b1be1e7f80599424780f66a3aab8b8b8dac74f61ac10b20454dce968cc9136d46ab14f3f1122e9f144e49ba790e58a9e2ea56550bf8684b2a10aa2fe7a9e7b2cb9b8ab207f352698cf2c8c53af0ef786b02a4479e499469abbdd94adca1f779d5c6d2ddb3fb757c998425653a9d1f695855b123f84d6990b101354eddc927ebc0b327af8e7c7b65dd2b356ae8d0f1d975aebc34710ccbfd4792072b2d31cfd2f55e3f6ce17d130cd7f8cd87c4f6ac0be7ca9636b87dd9d532702c7d5adcaf4a3987e8e356a7684dade770206bd9b21ceb3fed8e90f5c6fa8fec9723000c90ca5a54480bd6dc8737d436b7664b54cec96766ef0679388027af3e2cf9dc99aab6e3e896f70d1d1b88af2edf634ab9f94457a3ce5faf59d057c6636500ab3689c9b98f7e2ff72afda6e8653482a239c4d25f3bfeca147ced92475b2b831951a854d7f29840fdbdfa98e5f7306fd1957b68e544e3617cee7954205b09e79938571e3a820e9e82b9c63acc8bb84c4be4b2366cafcdb7f299ff45bc5be58625e16bf6579e9a1e68e56c3efa46e3d546668d58a01f89be6a2ead88de057d61a37712793d3b0fd54c140afa35140696c83cec76600a636055b32647a3c66743f0cd32889baf8472a31b3f589e0bd8c0fbcfcfce8b40e0eb84ecb4d5d7b5a81dd9921c2ae9c04fb405db40651bc3f234336f099175b49785bcb5d7d0bd20807e54aac49128bb5169fb71c91549d7ad509cdc14bb7d26e2769984de4e97e9bf30f388368c4e14d6fd168868836b94537a51c3b8aafbc1ddbb8ca441347877ca351ab3c507e4218b88249afcd4b3f61ecba9923418b3978b29b241520acf7c30b9837fa3b684d73ceb771630b0e526b5348324c3e4babf88295f8dda1b889b2245056f41f8e17193beda11391393f6065e948e9b4ed0adf3a606c120965f9466db8f2e2948e43ac181a1cc882a8b96caa85282ef7d7bd1729e2ed08da6b81e6ed338cfb6b23d42e8276bcb3fbfcbd93b91e100369ade5cd38cc01cabe059c35ab68a23bb8081a2e06f67f05281f11d2090eecb6b81d9a604b0c0c1d8880712ff2f6603420eefb51188f2cfb2bfc97aa8557500b6ac6bbee209d7c546fb956645082d4c164e33661a492df1d27c26180a2b0ab59521bc2b9367f2dd82f86ff2b76386e29e030f33cdb48803dc156b2fee0589d97d3c6ed33804c0a4b2ac12d0fffb65445928015a8e9836ddda01299edf7b737cc40b5a4326dc35476e07244a27507b0cee8d6438df7f444d24c270bd1dd47eca319124d04bb83bc7b3707ebf791fb03cd3633168fee153f15a068d8ff438710a970e9dd79c4e701b10b875957e53e0b9911a0f8a600557e51b4a32705abac7eaf613620afadab16b10ec1bb15f51835d068e39786b3c622c5b96274da8911d077c5ba00b514a9e158920977e7ec4180144a8ccd97b40d4cbcc1dac0da9c76c5279b2195325774c2917668620cea912b789425be0319515072de5076e3740c7fd1aa19f14519f35d2c7ba21de25d3bd26e08ef20bdf994333429ebc6236fac2808403c7a6c98a6a6fd48935ebae32b04e7a95e7b03d237689ca0c73b0318cc779ffc65ef3d1182d051c71eae8cfd2f3b9f9021021403d649dcac99b77b4891423b7da4f41f45c239571ad3a4ae2388843c225c2b068704328ac67769d8b22b1f45596facc92a132b5fc1972be4987b814b11be5cab30354b0cbf5df3ac9f188b49e5bc987a3cf8321f093e564b5501a09e3d79505b9d4fbea8ea4d2120ff3d01eabd73c2d1e61fd92b2ab3a9e1937bf36506096619cf317164014b75216d146f78eb08a4f779a116272742c0ad0d2871314b6f4f17a81327bd8e33fb1c2afb95942679f2f6cf1a1b0f787b85214c174738d9c447f83b99f8864c8c7427f14af28b8ba24f6bc906b2bcb49a1ab81acfe148f63c8e92fcc5a2d2fadf3ee31134376fad654d9ba04f8cd856f72c8c86ec8edc8333c694cff09ff714289f503da9898dbb52db399331ae7863abc52db4b7ba236b71e1cf68c6fffaaeccd28507c11f58020f8fab5292505c4bf386688f0670b1c56e18964c98f1cc715b85229bcf47c101b6f0c96e85ab2b7e040068b450e67320284a906f80cb7f471410339342a5bab08b7e0bde5acaf6afd645b31c020b381ed403b1e62534799303b3ed68a325644ee3822a00d1e27deb5aa35b6078ad8118e4aea44cf8f2cacb4e476c598cd8d2676b1ffdc3bfc4357e4949f13460cbfe77bdffa5bdf2dfd571ec550e331c8e0df2da7a5ca11df28a90c3746068725e3c185939037916c373967474b72edff77c6a8b6ee506be56183a5cec28753cadcb946c6866edf1c16a29ccdaa09805bd38f57578df872d1d1a9a320bfd8c1017917ddb10d4cec765d76429cf34dadcbffb5fe5dd79750ec4488e0c86b6b10ba9c8b67d1261e2bb2ef02487f69f3507a66d16b5ac29181ce9b8ea20e88352d76fd8e303caf4a0b86257c5368048faf78c631715488f52a8d7e553ebc333bb187ec716db91060f11e4906e18aef7de3b4865a8ca9d2dc41184f611bfe84b68eaef3622ab8fb3604bdea2dade074273ebc2923db15eea9d7f18fc09219a9d6dfa2a164cb7c7bc4c8267af83a06a482f364a88713a8ee6c5961d0a881bcde98a2782951658f34a8d1381f3d605e5e175d8ea4a44bc50b3a58f3eeab6572282df9f1042ecbaa317f92e7ce44c367916230bd0d34587633881090039e6aeee26b7e03d97fd3d6db47980b469a70e59fc477e9ca233cd47dadb808319717fe2e904bc25b637ed78d93e18e0bf28cdf098eae87a572e0419b3b16f9484e750137c8bc4e329a0dc497c1ab714fee18a70262cdb652b2bbe3d5e254e31c5038b6434ffb41af7d4f8e4b05652a385b12571caf5da7081d6a686e4985f6e2f83f4813dfe4eec0ed4c060e9c5b6def65297e2841bb0acf0ed1375fd390b775da6db47bc935a5ee2bb8841cd6b68ff5f1119542edf12b5dba1cbc2a51617791685c953864b3b6f695d74eb750bfa10b10d3c08368daf8cd1799983f41b70906d4e7961455a2259032ef3619dab985a0939fdc37c0fb77277ae0bb767d6be64fb2e9527ad77ef094890452c202a60de72263bbd224346ed2f7177990fd16b0a442c1b6fc26ea6bbb4fb6dd0c1f09ef31a8ee63610c8fb388f42a6d27f9794301b1b14f666d497b40fc3966a06a472dabd51c2f1ab8249fdd99e18bcd0aa38d2ae30ec87fc36436ce2063b930b258a2595efd2c03f10beb079ddb2725abe1b9a329238db22d69ea327ffe90869a0c75092b67a94b644a4bb03c380ea7906af6ec8163a1a345b8b898ff4b80715b69b633c93272341b31fbd76f703179375434d524bd44c10465ed9ccb733d1d2b6fba7e72f33c132c193a01734faa2b08790f02171f68771207ce6af7c084de33ff9126b4b56bcd5301cb597b48d", 0x1000}, 0x1006) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x204000, 0x0) setsockopt$inet_sctp6_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000001540)=0x88c0, 0x4) ioctl$GIO_SCRNMAP(r5, 0x4b40, &(0x7f0000001580)=""/165) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r3, 0xc0505510, &(0x7f0000000180)={0x1000, 0x3, 0x20, 0x100000001, &(0x7f0000001280)=[{}, {}, {}]}) 19:21:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}) [ 2022.877445] binder: undelivered TRANSACTION_ERROR: 29201 [ 2022.902580] binder: 32714:32715 got reply transaction with bad transaction stack, transaction 5496 has target 32714:0 [ 2022.921920] binder: undelivered TRANSACTION_ERROR: 29189 19:21:12 executing program 3: syz_emit_ethernet(0xfffffffffffffff9, 0x0, 0x0) socketpair(0xf, 0x5, 0x6, &(0x7f00000013c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r0, &(0x7f0000000740)=[{{&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x0, 0x2, 0x2, 0x3, {0xa, 0x4e24, 0xa88, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xff}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000080)="a10c9c984401ad4c91275e941ea0b13470bef5754330a3d308032783ab5c3fedd28f98bd8accb1b27c4da50957b3d7c796823e53b3475dc6859db5463ef8e14f95aa0dd63386cdaf86fa2f193c23bb421bd72bcf5bfdb52f3bd13e264349ee278aebba27040614e918ae4d6fe0f6503a", 0x70}, {&(0x7f0000000100)="dff6b24ea0f42afc6f703453b9f6483675b4554cbf1329ff0f05d9083fe3ec89b9091dfb45846b2c823b16658a2f46076915d47bf209fbfcaeb8d09205e4374e142afc6544d03e41aaf48fb95e8375f4698f09c8518ece619ec0ac648bc0532d73c8d1a3b0fcd30437395ad11f2932e1219db093515e23b0fd096bf70d26908c85a35edcf366dde24e58a31d0e744608c3500d88f02c486053457f3053ff9b96acaf1b", 0xa3}, {&(0x7f00000001c0)="78a03282aabc61f2", 0x8}, {&(0x7f0000000200)="36366558c8d02d408d723b153eeb5d63e2e26ce3114273afe112055b6a3e30e1b3204b26f0c8211b2e0e87d62a77cc37dad2955bb3f72dd7eb30d2760b0d6c1cdb3912b6223652ab51512c2f548a1b030fcbf85a73a44beb9f276543b9b86b7fd26f005d9aba9f349cba", 0x6a}, {&(0x7f0000000280)="17dc933f8db582d03a06b04e7cde09cc9fe600b770a530b8f59e52f96843af1d8da567c353d121176e3ea9718c18a6f067c937486b7649ff8c025bc76132856a9c1ad77214abd667e31f5851f58527039bd40070d0e4583586124dcfd2f112868aba7aa2621c", 0x66}, {&(0x7f0000000300)="0be8f57ee5c5df81d3a39f6c3a04663e945380f728b118b7e05eb4d3566ea04384da70aa9dea13119a684bed50a0b2c4a00f4ecb3c6577749287b10be794c88a72947deaf7ac3b4d76700b7120544b33b362df3f53714854b278b4ed3b4d15675b3433617e29e3c60f1139871f2683118c4c779d", 0x74}, {&(0x7f0000000380)="0083af4d7e0c1ab949bafd08903ffebfec48a5cfc17d75a718aea39f76effbc5f70c1fc72f3685fa5000dd2c7e0ac24d73ee1019", 0x34}], 0x7, &(0x7f0000001400)=[{0x1010, 0x117, 0x9, "f86f42fd6da0e001f61ce29be78fce9ad8b5aa6dd73deacf65de1e9fc2c68d369346bfe9960b6b73fcfb738f1b1a28cea111cf2dbfd3bf0066f32532593569148d54dd1e6c1568c461094e64355d20588df4cf4f1d5526b6cb23c3b98784c9fc2e95fea004b00b43a8e888e33a56ab260c216f687d24e53d02e14586d5365d3d4185633aee9e4d73b7fcda6a20eb659759963038455d45b878887bff74f81e3dc8d319cfe76486322d820c05fd4dc8b8501702863ddd679676bba0b464b47ec47972bf2cf804289f23440ff734fe575b026bbae5b2d6d5ebe789487043a67de91c502a883ba48fb71bc78fb6a4d2593af5d9bf401256264e1c6c2eecb45435391aabc8e3af68f034abd63f73a580ca084e154a7b1023c21754a26d34c717e359b5dbc5756632b18e1b507e4604057f46a213192eeaf3a6251230982ebcbe8040aa34515ce341a4f9061741a210630209fb8d0c4ec39ccd5e62b302b6a8e47aaefdf5b723203f6d94f474944fd12e7430c666dd69164eb0974603afea15bfc04841e4938414538cc95d5a333b0cfc3af81142f5331e46d4d48605ccad5b3371ef52d4389255ff2bbac3617dfae43ad89f106b738509eccbc5c68003042eae668099afccd6ddac7eaa1a512b4b514ec88f5fe2bead7d98b7ed403393da339976ccee8a1dc5cd479f5f5d7b063367f0e2cb608d5b9ba88ff0c36b7da7cf09161aaeec6e8dad7b606c8eaa509f906bdd38fb492be55002d6ec01c0f74eddd8e8b5cb8bfe62c8872bdd0bd151aafe73c6d6d0a15bab86f3dbdac93dbeeff53500ca7652c2db496470eef625f05d16387e0bf42fbb4d5e991fbfa34d4aea4a610b45fb783d8b79eea39ec47a454fea45777f5363a8628e610b0fd273131456165e650877854f747582c1ac93b992cb043e8d615910125258d353f3bc828c8d717611c74def606148860b35ddd469010a7c8bffe4212356e87bb5f7dd871a057eae3607350f0c7736153073ae4f643d5ad9d473a1081849fbc2e9808c60d80081ae8c0914c21cad4bca0c6ee91a9db3c69931cf621ec3622212ff17e8d97b7b2c862daa9e7a5d43002fc21d457783a41dd2ce6bc5eff4cb8be2f6e3494a050444e9a2b16e0858de542b750f45cfef82db3044b83645e3159f5d16c59419c2eea5f0b0f321cbe3e62b8392f591cc7494c78f3ac0501202ee9f8bbe0a6354dd116b6eb826a0f89efdc689536a7a8dbd90cb2b139310c2b89c9db0baf266e779170229d0342f281dc9c1129a2a23f15a195c95a5071b90b43a671ca7d4dc2ce74e89857f3896ab6cf594fccd5a0afe249df1737f0c55593d23fe16e56de9e08a12e6852a89f49b4444955610aa6c71d7eb34f3dffc6d137823c6e6ac76775d3979fc1b211558358d2c9d878c46dbc09be5fdbca79e4b0af53af41f9e9273b5c8f9e6388983a49bb118614eccc37865d360b504253e1611006730ccf4889e487bb1538352671b92c5d277098d1134759656520d7901942cb6d5760b18b643d8aa231b51fc3242530bb15c3ebc74419b4d2ade87bb10817d678c761b46fe73389c7eaae23e262edebf7d4e0b1a685b02e448efa36a02518548a1d3b28a1462c86a967880f79f91728b40c77bbb8c4411e6ecddd9fa718fdaaf11a59bdbd7e912e69019270cf7c9f6d919aa5512ccc53a4220cd9579aef4e3090514539f1aa4f54985a9366ef74ae0d32bc79cda5fb338cbd08965d98e31572aa550a42983be80c8ed4a99fb5682bc87eea58892403009293eb88a7d7b266a88e5fff07a49c9674d0c5b0f83f48dac6c3ec1ff557c67dcb7d27672376da4c8f199941746aa4a936b520eec0b5b4e2389377c613fa2d80285d68b27f6f37033dcc095608a19710d761805de168ec4b0da02a0837902d1e08c70bc4c215f5006b52ec35b56a54dbc1679b00c325a8bdec168bb39398b75f6ddb950794d031523a94a5f45ee63b3600628319155d80baa649dcc49c2d0e3514a46c6bd382de475872a9dde4050a606ff8cdd8dcc1b3d73c1db9438906da45da6ad1f54e75c09cbe478a5695f7620a24bae8e86bb19a692e1d08f67be1aa8628514b1bcca7eba037d70db818e41472c50cdfa599908b64f21ebb8eacf4c75189a2582efa016e637f7ef0a4d5c6f6d1758b2c337c31326925f1ce1cc4a8547ed053e7fda1cd94ecbcf6a55a66d3f5cf2ef9d58a0fb2c08e90d86f0a4c2b21c227e9f45ede9786ec6464f1d29d7b600117c82f1ad3d4e29fe5f794821a765da0cf274d4ac7d6298baebce223e15ecb799da73a846d0c5fa011f177d901ecf0b201ccb7dd64a496c8c45f134b0c2d7d4f1a8303da2e16996dbf52054ec5623d94ab65935ab93e905c17fdaa9e5ff05a88e746597c2ef7b81ef27e3695a5282ebf330de14999e4e98a4ff38f7db3603a640dc51905e7a163ac8483384bfd2bb7905ea3a52f8880d9fef34b483197b20e213f8fe94a85b5cf1454344ec970dd2532d192da6f4cb29e36660c68694c2b85f5ca8b34c8fe66a0dc050a1441d1922a9af3826473ce5b7f72f98737081e7ee7a9073ae75eed266b921f696062f05207827c27902312f2d84328f5d2b19288033e40fc93940436b35f6b5ecd7b06908c0294f340d6e2863b9b1e35f69c36a70cd27194d8358a10a0e04f9accd77ba7cc96f6b50e5e0b3758deb9bb32fc33a696276722ab78931996cf5c3c15274539ad95ac734583396529c729c8a80df06c8304f62bb384c39579adfc31f5d23e7d0e634ff31b2b9214081371dea3fbfff9f3e026ce1ea46f32a2d590cba713067abfa83fa2ccadd61903ae413a8787323861b802d1ccca8d193b7038c00fe45e95f722c59bfbbccd640d27970e1232ce7b4d952baf6bb730f089ca441f5fe16016616050ac80834ebf036f239f50aa4933ac5f55ec6ac03568c4ad8ff27db2e9b9051ffa4246b3f6d8d693792d21895714c4cc8f4bdd39c39e67ca51e4748fa659e98cd0a92b8da572aa22ce5bf393420d71f18dc136cd0814ff618cdc52bb448b25dd2659928a031efd5de6f4e533ab6176eb90cc4f1e10dbc5e9b728c58f176568be116b818a0029f5fb345e0eb2a2a54ac55dcb9e19582bf50fcebe4ac2845e0d422c43768b5afd21185ade55e730f9f6ac0a8a777837e1c42a04f9b7b5e8e0ac05bcdeab735905fb6724b416b33073b9da3b437cfac47f86b2f046894cf96fcd0d1d963c75f92d75437de35e5fd4b92eee792f081ab485830f95dda3b75aed3a70a31ce8f59c1a8ad9bdd38d0341aa7a7f2579a26824a26b97f25bdb5dc5f0c3faf30b0bf3411f67b7e8c8241574e7ea349fe39cdc69c5fd3ad7b7e6a2668c47a66f59bb19ec51d4cdc6ca4db0ab2c4fa418156229f4464eaf3ce29dc5357ca87583e244f5288787f8f8c3e4713a3c242d180da87fb06eb10cc75757e585a2f3f31320ff5200e91efeef89da58172aa3b9baa4ff85b0c3795159f1d915532eb7efc8aea270af93c71335b55a717981307ee70488f09c0bed60a317a5d19f0d90ed5118d882bf80c08de547e5eb6c8f08133858573e8cefc5579349eb5becde09665d70c6b66fee36a07ba85489b97c74c338d12b001b72cb618573c59cdce32c7ed1845aaa3ecc98f4ee49d993b15edd514eb1b148384ee01ba564e6837e0152ba21f22778812840acd279d31d8627a8c6dccfd5890c8c9f9087f8ac82bb7c1aafc09b906a4076ed8438e9fab52da4117345cb00ec1a762c18dd26abbdd71c9ca0409898a0d907b5623e8d8ce708d1cc0e51eeb28a6ded2507fb6686ce2a3f4c2e7f5eb1af5887022a39f8d0aefa5a7f733ef05ab2f068a370d3640980b1f0b78462e63294f85ae647ad4d852b22c52045a0ff6baa95af0543ff98709f0c9f6e56d8799e8c0f8959c455985b514315f931a9a026e95e757a87a6aac70d40d54d297eb9d2675882eb09a5a1fc8e0127a36731eb8a2ee264ee056eb67ad8d7c6ce9116af6c75fd3c9b164fdb6b0696c38f36f958fc828c02f6adee960fb2845d548a3fea351a5e33a614cfbc1816f737eb8dfd9efcebf807eb40f35bc6cc7d5334c66d1935dea681c00d83d648814bea5a83ded8a654efc3768361dc9145a26824b4802ec0acf6954fe9ec6a29fd58418bb229e2f0cd53449fa7be09db52e7dcdccf096de1f399c5a50dd02f8bfbb61473ec020c3b2b6545c1d9e210ab472b3200dedcfa0a4714c5367a3b1114b4bd0194cf99c50036eb36fa232a4b12ba97cb3aa427f5e494222d97fe17d409bacb20bc766480e94eeab096211bbd7dd0f437091c5298f237c27d646a018102de27f49ef7ce7e4f932ad1e434fb7ec74fbcb9176c05d46c39c2a97823bab937e46a0835a5a59f9ff871da9d4e3df5bcfa0427a0e04fd1dbac135c80dbe5d4716c319c609ce29728c20a138b496eab0804f5009e38fec4455cda2ea856f947d58048e2266da78819414171e345815973256468592c083972e52178b854cd3b7042a47fc96376417708ebd6a0f55ed2fda7febb0badb4416b71f5a3f162219117618a90a3a98eeee6fe7029662cf68cb24777c0b44477a2767ba252da0ab3dcc5c8eb4cb556a9ddd614bd30ee1390e6defbc149b1d5583275e93e90a928a0b7322b9c53c98c92ea704281573583649ea233fa174f3bd5262041d5fceac029fc6c683b63aa480cbd5be2a075ee37ce1b01b4cedf78f1ee010337fe111991828099ea04ecfeb85b718ef1d8c7fd67bc3b483473c86f1e1f341baf81dbaef2d68946f00ffd595a8076bb3a218dd42786ace1c2417eb5ef56c4fe8144e51d30eb5b39193c9867c01488e337c1b834071d6420bd4707833d0d040e167dec983320ec5009e8f3af527504bc0ee81826a6fadcedf4aff8f9f95dab6bc53c91fb70a166f9e4efda39094ca13d5389d0e4e4cdf86d94b4cf6700b2c4bd9d704026ea034f0dfe21c244931d2e07563f18d63bd755126821100145857a8accaa0d2ada7dcad4374d5d0bdbb8590fc93dce4867328c1a19f86922d2ea74ee0a18266515b2e09a68486df351480051858797d6cce0c54387aa4c42773206f460b7d6f02958e2cfbeb653af12b6ee37fe7ee83443eca54b31a54f8126be3015a12f60b6053bb5e61365304ed39f08730660180ccab0446a4b270909bbe372ae8da785e7e5a8898b19b6d076745d96582963392a18afb2aaf5c243f47da470b2b5d139dbfec045588ab58cad28ccacfc8fe11b2ad628ddd6542189d3ef2450b0df6b68f40c8b6c392f911095ec90766d65e8c7db5a2bb97beef57e1337cd920e07823237ee3c9378a686db2d0e98cc15ff0f6395b833766472668afe5ccc901328def77da37757a7c6e7ea7377870c7376a35b0279ad6b72d2e248fab02d23db057d2f3079f859ed94ba9c12a1b1d1736e337e436b92652812390ca27af3be8bf3d861928a99b68e3ed45f92fc55082bb1a195ea910027de90f87838f7553cd7669f1810e4fb1ec0e7857ecc24012e82970864f41a93ede9e02ab46c23f9bf4a58f34ae826b71cbca5bed15106694f654f0395cdb600ba4e59f93fc2547560ce464a8ccabca9499cbfd2c10c4fff23728b7dce91982a0889cc53249acc5cd85c7e6b901e016f7fcde6518ad46465ef8ad25d4f907ab97d3e7a9e470feca19f07b25b05f8c6b554c2a8875d4e27b0b0c9dfcfb64945525d50bfae0a183a02a6e293dba796b69493705d7605dd7361889efb30f5ae6870655c47bfd1e3c122f2d1b0089edbb3e0975052bd1b4237615a7754d6521"}, {0x1010, 0x10f, 0x30ea, "a6846aaa06349e48d9fcf98fb04cb1cbead79efbc2ebf4ed5951866efd4d5becc70586bd45f1bee0443f15055060534e77f53710538b940a851b6a8ff38aabd6d7aa70b3e46224e2e05b4245b44d1e0ca17d8ebfaa456e1f148831d6da02d25f3bf2698d07904ad98428942bd6f4d3e8ec0b751e47b41ff53e7ba8004d4a1fc33c3dd4e102bef0ca1f829c4dfeecc96685ace45c9baf4ff6b46c7e7147d3268452548f44486f55b14cb5d72f9b86aeb852ea879605a94ec7bdae2a863669b09aba5099aaae8064c5b32d4e70f26c3bf067dcf946ae7a1d759f501d41257fa64250239d4b984ed6855be84479058ba77d3f8f76d5c8645d0c0431fc97f61f9871e405091eb0c758d811045918c6e7e574412abbd1f22c9d4d2da6c5fac23e3c29a5214d1877306a9b25d2c14ea568820c1362dc3dea74164d8b461152b5a7334755177bd6ea9f355635a13881c5d6c1900c91d1c23407f2ef0990962b05f1d438354b18f7a2978b684fdad8b391f41b30094bf5e6761717ce68f97b62a23fe555f63cbd622cc00b0cb87f8e9129bdd06e04e67cb37f046a368c5f1e91f28d2178e9f11eb027f69c64071b0075c6370c835fb25f3329e70251d6940ce414002e7b631c7f206102d55f8cbca161afee459ab33cf0224673b3ad7179fbd338d8263cd07dd4f5251393cbbbe6ae16ef4b549f4afcba713342324683260134f42b3c070aaae5c30050da31ee803c0934f21bfc05392ade2aaba8f95cb22ec74104a15edfaa73f2d6c98dfa2563be4fea764e96102c28a2ddf32e88d83701ee6aa5f270c7516c52421546ca71025cb9c8030d55863c3ddac010e04f228c072f7000bc6714773bd7f7d24fccec031f4777b7bdbe0fd347dbe29785e5bad648d601ede0e3368f093bd834f75b0d7efeccc3f58d5d4a2d4d10edc1cb9028220e821bd593a719749a6015a4e74a92cfa4d2de119ac2f677b1c8f69616b1ec38f1da7798974876c93f67c374c0867a6bbfe3d8e8e81b86d93bc6d481f714da35bdeeacceb182d8881ef3e1363ed2300ec6f9bf023fabe9b5da6fa5740a47373a57f5e916d0a6f4d94002e088f37ffb5b569dbaa3e38ff19140ea6c4f1898e018077372e58cd54d9fe3d95f8e705b27aa2321347cf4083bd8f1216cf43f2d4a42a5e4cf91b89ebaae78c0f0b3798a701cb0077a122331ff3d2634b7a0214afc6e9a53d96174f15a905aeda218e9f2547ca4ce175574fd91d0492e0494207d72b1fee285b4e062e05cecbf0c4c32aab77c25ed3e84f9f34513ccf3afee8283a21fd0b473f73ce375c50337af2317003161a3d458dd65a039eb37ce680893f0da28faa9c4b249d00e0f6f546081fe658bc5ec82cf93c9a0946bb0b67eda42297ff5cd6123be3ddf57433b6887e08eaf9469c7e6ab7c3db569543b9df84b6dca314f9fb887e17b289d0865016641d9116237af1d2df6993059540d69eae3daca13083f6a9de91e46ab71b1a2ec42aea555827ab661b88040123ec12a4d123be2d5227e5cfa5ab9c5860fce1635ffbffa13f958942f2331039b741fab0223f9fcb07251a532b7192ddbe501268592d210cb3877cf45f45d7a2b856e84984b1245a48344e5d3b9b453a805c320f7918f45e13101e958d34bf18f08ffc9b33ad50be2b96b8f9330f4c045b1650f09f5b9f486ffd998b8814cc31fb2a0c44890733a8d399013d415457a1774c22ea1b8d47ff4fa707260817158a355ea52ebe567b93cd39bed6faf76ff2f9da788eb753650a77ec29057b11c870da45429295271b6d2a2ebe3bc3f24572a03b55041df96ff99d5217eca21a371a04ed05c977df2c549531226b6c53e10f999bbd1ddaa695435d2eb18528604a51fe7378624e45689db12702685123b58c83031a2618be46cf19b1b3e5e3a06a27a607f738b3f47f7346aef42aa00ca25dddb770033f6a2f558060f0c4815460bbf1ccf6e759e2ab329d2abeab4d2caaa190f5ece1209a739f0c8a47961c7c2f02c9926301436bfda888615d07a1172059f07c9f07c2cc5462893c0e6a2b761f3fe6be61caf2b40b5632052b2f92c72a75479a043dd3182c7b73108a8694813d74a61a2c6c3c2364631f2dcf52641e451b59015f69f1e901e3561c1d97169a3bb12fc9157776df8d96f783335879494914d11dc044c4153a317757644c021e05d4261d21e58d5d07028947fe63113f1b1800fa331de96e37d8b36d6e1b97f65d27ca94f39ac20d4e94a02340fd690655ce95b4fbf66b394eaf2a2f91ca3c3c7a4ad03ce29eecf5616bb9054a21fda62a3abe061e6b56451aa2ee4881d3844302379ea4561e30dc0b6fd9771adf5675cf27c71bfbcb024447f35a4880ca33413dce8da39abe04eec7c5c6e249fd41b8c4800fbb05c30d431d2d3e11b45f3ab140d7abfb2cc13752976b97938f29dbce53dd800926cae813b0beedaf097a757a69e2dc2fe398ef076274afb16db611d9cbbdc0d819a585207177732db35c97133735ab459c831742973d8a1f154096529e86d780c9a4c30627ed84810ebb6d457b344eed52494bf7ce0dda8894b59059bf7d2059074d62d54c46b9807e067a26c95076a628e1745501f5127244691307f957023323baee3707c680c938bc0f31872003e847912d86a668dde85b55cc71af2a862540f0884cfefecdd0f1ec4c34b03f27b3cf963a82a9afd410a3ee277552abd34bc230c4c61f588e9afc433fa0d7cd9b4f7e3a007ad1f91a5ca0e1fde8ddb0d1a7d9b37c5bbdd1777ad83d9dabe07a87f6f3b9c77cb663dc323c545bdd1f1e9f1bfe6c2b66a817cc8868108e4c7a45aa86e080bd83464dd9ac5a46a7102c0ad8b911142362966efef7478a3240ec955033e96d1172c909d8d0256463c77d37b23a4d6f5f6bb52069887930c6b5928545494bcc58de6c59f2afb0a18297cab2de432b35617863312e551f3936cdde65974cb54360c7386b7488e2d224bf421251d6101ada7648681120095af35ec9192017aa9a8a7bce0f49c421b1f54846683dd43d1ba657b82dc042246d73c255d537b80ace4d9f4f7846bc34032b575cb1395ad1a904626b6d1d423c4be484ad1d30d6e6843e136acf8bcf886549856f6d729745e9635f2a0c28ac26ed1e6833adfdb436b6b8ddb766e6c1acc5d3c7e69e70a6624a0ed21fa4ac6e05c0a76e14adc2e53a2f4826d6819ee767be964d7441619641f2d4f586a0866a768d97d4eeb9be63771602fb285d5148e4894306c0ec4055f6e6b03e90072b8d2f6015a4af1922eefb84b1f6c74cb3f8b254ff1a83228e7c0433d0099d5a08fc2a262bfc7a96e2b1dc0a3cd3ed12e29c1b2113028b9f4da0f23a63e24ebb8927d589f56bf4fd67fe59275d71a3c2772670afbd91e590a9e9bc7da0b2694290587f8f07708c8545902d7903646582a664f7b4c7234f762e4ef57d9399d60908b4c2be29e4b7c367524c45fe06677ddf51bb5f43ddebaf505481d4bb45d9fb88c48b8796c0a57355ca28636009c7f7e47401e35ecd92b9d33eb4cef3a7dc8547d8bdf90a93f71e52303c9cdca881f3b5505c2d45fa09e7f985160ef5678f552c9b2a976f6e1b0f90dfd0527da6eea0fd375c64666595c0519826f371b0dcafd839867235237158d3340fce5366a27c3957e18b4d34c33e35114b26fb6a1e93d51c1930a179602da96f0cb1b7265776f65342c14647f7435003d60f6cc342ec0a3a264d71ff97dbc3271e03bd3cec278bbe8c49417293a727b55db88312921d4af057375550173ad9e5a6055c0d0c5be240f9f226c2335ad860c58ef176a583d7b59e3e829598d6c2e3826644dc054a91fb96f77d7c0709a9776d16cc367e78add8bcaeae0cf70bb70aff1c40895523bfaa7670dfed28e34782d5decb2827884a08d175a5b4a2ca71ee0d025e432013417bebd9405755206923e9410f38159f45f19c30b1f3174abee019541250270b24a500741cdecb9da6e6c933b197a3074d24246adcaa138384984edfc13927c36184ff6a4a1bb1e1ff458e1ea0731b5eda4f2898e961e286137f30935dc1ebad7b3cdaaf8e15cac1c3fb61d1a74dc6edd16ce0daa62501b5b6d719d8fa9520a424eeb3694432dbd821ca0dce425d3407b4ab2ea1ede08bb686233a1faf5a5f4615fd455641e872a5b6ee19861ee95715580c7725fea159261ca47af252de89882fe2e6b1310e34d687b52df64893878e7267759c5362696ef802aeca886ff8e59f1e886a4093ad90f573789fceb9cbe57c3f397de15c727e7364fbd94330aaddfd41bda8a8e52ad119676b90ac345c38d8043a05be082abc72b569d75766b5e4e0f140d00e9d9267af30b4d4a9fc5bafdfa03ca744c2421157cf4a394d799f978b5f0773386f63e6b239674287adbe6f9c2f7e09fe312a04223bd26ac72276d0af266c7e92f359dc0b397e25fadd270848a5c44a0da9256ba1945ddf8895eec4252dc147403bf5634dddca9b89d73508ddbb60e88cb58bbf1c31986134e4c97d6f96367bd6b12ec0c7d14a3579cdee34622f3de6cfa2162c04b39fd0bc76505d689addbd6de5e4b929e2a3e7c5a5ca93b2463058a0c8d9f80d95c8db2334bb134d0eb0c70ee709911455bb31dd1a8d43e5f645edba67ce7776ab88c4acdb15be367631504014a74aef38f3fd5fe8c482939b70403e31bbedb49bdda07ca17eee247f0ba771b501c433dfcc361dc5ef53cd9daffeecf5a959629e5d055dff100b4a46210c847db599942d9e15517501d9906cc4ad37db39d5c4bf4bb585a7c10feb77f8ce51436193380b7ce192dcc1bcc24b672e61aa3e08bc249d908621e85bbd4929e118d936cc426ad81f673bad3be84998adf163cf79fb8cbd9bc4b19aa68ddd15ab044ea78af4aa4038e45033a3bc983f1fddc9374230086497f7656b69614ccecc0c9a63ea277695471e836431ba497583d27f9bab8033bbae7ce649ef7275af749b8ca10bc21b640b28674c6fbe6bb0aea79aad9fb45e656a8c3c6093412b5c87d63d0d85659031a7adf3e06dcaad9c2ff1994ab3ff5a2b56cbe960e4758a4cb14e63183392d2821634043ff1559a1b5f09eb2409c6d29a549616bb8e624607e0828a86aecceb3e1bbf29e49c3a83c4125906ec290e9006e1460c530f2b5e056d9252ac434d305fe7e9d1d09914158db6c68c0fd458a1e2c44858b1b2ae032b65cc0401ed4970f9378cd1c1b80bf9e06eb35aea8e9b8ca4258906c3388affccc10d554a71a352df3539832136c5fbd713ec3e42c9b6d705076b5b20e2da2916c2032795428bae3e6f751e7db40f3586cc6521f6157e75461ded0d57995f8b90c5cfc7d2e9895adf4575b1ef179ae35e3c3a273bcd3d5a7ca8fff1e4bc05e4e7975fc65b75610e83ef286a60d2b28f122c39ec591238f560ee2e0e515908a85b0a15e64264a6a341e0fc867d232aa5e2fd8a286b15d96bbdb54aff177cf006511a46137c486f8204777f235a9174a833c24851020d5a45bfdae6c4d81b026bd404370041db51f28d66ca0a8ef69a9b9e439f5e3050ef1ad0dc9968cff5181fbd0f6bc84043b424d7f09a37ac7f504df2086b655d747b96764736aced1c0e2d0674ec68f48eac299205aa9ad053954facf4ac472b1f30ff1854ecfa830cbeceba28674dd17ac533b8a7e42d07e32e3147786c41305167194eb4815d6a3afd3926af959bfe38804694bd498a393fd2f82992298f41de6636e6a3f710686ce4b09e627ad1b230777d9360f923a591443504b55087189b7dd5a68b4493c3d22f714b2eb6adc67"}, {0xf8, 0x84, 0x2e, "c3d79b191d2a85241ced74675ff98da2a8e7a3b243d214d76e62c975ed5e8a0a508b4e3a320a6c4ec80a3efb6abccd13009ff55d6679d8bfd6dded73292b8ae8bd5ad71c441258d5959403afef470e75cdcb6b781d333713114d0c96a159f237ec6ea9fd217165e797e0745b61ec5583e8482e2142a6fb9b225611b39179fc23f6f7bc891f32eb31ae801fd99fbb1aabd3f47489a684f80d70236bd9397224c7570b467222a2ca807f10095efa5f649a7137c7e2e89d25050cb9643156624ed97ea0a802a89c5246c1db40cb2b43fafc936e773f0f531357c202728473e68bbc48aa"}, {0x110, 0x107, 0xb58, "a5af717ecf5c99439bc351ba9b247d317b64db040bcb344f5ceec298cc91b9f974343ec055c9b1b2d77a7c770b65e10e2f70654a5b5f85197adf666d8014354cac037f4df0069143f2aa414fb14c2792aeefd69f648681f6d0e7a1b6c20203b3b13a891cbffd66ae4777e45efcd5e29aa63e4d70521dd6b3ef1268c13e8466a1be04db4da66d831992ad5f89161e72ab6f92a86d594ef6e601f84a8fa49263b8373d6666fcd93f3e5bc19d4f290e434974ffe5c8d87a97983205d707af6b2bbb6ef4be148f4aae64ef4a89228ad153ff3e8420278d9f2aa2048978778736f13932b627452ff1ed6b3672a16b894605803dc94657e029331e4499a592"}, {0x98, 0x108, 0x0, "248609cb034692bb41d34b111d353691d5720ad8860b67913ed450c4e55d35c3ee5339b8a8c35a3c608fe87c0d57d7b473af152141baee7d92332d17159712657e67fdf3b0eef9a7da28789cf85887be79be6e9d5b5f8a8cef6e1ea760da417bcc8f0fda99deb9d9c3bc2c9675122435dc27ecd3636458c65bcf6f3c4e25f12296f0ea8a5d7431"}, {0x98, 0x0, 0x7, "d877f0675bb89d8480db3fbf6f319dcbbfc8cfa5d7d53702cdbeeea1f4973d8340ec9713f155a0fe185652bf42cb5041f6aeceab4452e39d50c41ef25a636712b0bc144c862afe7eecbda98226cd4e49cf45263d27e08a2a18b0ee5c29aee4ce4e24d89ce5f3c0452901202b11bebbe087ad2b2cb4bd116be415742629398930a9c6518a4b1350"}, {0x1010, 0x105, 0x0, "79729810e4407099e8a1232a438506376b8ba6807a83042667a389e40f7bce16c4c6c36ce3442c72f079bfe95fbfa4ec1c0fdfc6429cb19a0fd6ce280e7628e457bd5931ef15faaf0a21e9838265e50cb01cebfd9c32aa4b92bc3060d53668eee68ffe6750da70bea869fee0a1998151a7af6ac9f1cbf5456c788ff42a5c8030181c6a9aa9aa69e9ab12892f960e96244cb599b6478e9839068170282a11563aeaef330ff8505276e0b3fd900db21d6d17a99de11305916703f28322cda809d496c94ec1ab0f411df1972c3b2a94279d3fb6471e87b7841c8ed1e72bc390aabe0d8d7f9939341ccf8872761f10da9735781fe03103bc6d7c979f8468e43ec9d4de0eb59c136e9e2143b6dfbc06aae19c431c7622895bc7a78a21d4da5288b5f724d6c21921e60c4a2be8e1532b675cf749e20a5d1175efcfc2504bee2c1c47c87326dae20dd458f26d5be8eb5e4408fd576295e03d57a639845be5cfe0b828d460e9d493c1f66e0ada7b383eb8acebdb9efbb040213e5803f2d5811478b4fe00b8a5a31bb8ea73cf6ee515884db21afaee87bac5f934375958cab9ea09d78a63b35b8f339500675bf63218e53b4f463362d6c297745116ae4550ef4bb6fed4b45d0234fa56443cbd4af49d92b2f82fe24b8631a9794994c1f830579c6dc75fe6660e5c1ef4bfb952db7c72dcc20113ebaba5a171efda323526da32b8ea611b8de347ca2484e659be41b591decc4c507a90f35b3bc712ec8adeec38058a55f3b1e269599e021386e057797efd883757031cfc73a70ce12b354c4c13f212e648e3a5750ebf1b22e1d4e536777527b54cf18ec5b026f65dc50f92a4416a405b5d826fef727a20aef08edba8852954e7ef946006694f17c51dd6ae645f48b986c3afa1616893844db1497db1bee0d41ca01b0f986be5b76a8482a53d0d23fe759672b848b9a9dbf4e3417a414d3c4fefe33a7f9f592b65404bfa172793ed1ba33e2cc2603d1272e410be18443090e4374f7c64c8cc25c64b8aa835dae8c8ef332948feb621db54e33340d38160edab04ecac9c00c5a3ac8cf9c0d44ba49ded193bfddbdfb499c1415113e8236b3f6b08ce33378128de2a164e5db0c5d85f86d520e744dfb4064b082fdd220b28639ab1f333672988e155872f14b13ea4428d33f665919b96addb29b1b4a8c26b24cca91cc00386a7117c889f7873699f5cb4f1892b004362c394947e08c57161471422f8a19ee611fbd6e8557bb0af82d8b10adf146b221f8a36240f49be8fb78baf157e0d91acbf7a09731d7499c89febfd1ce41441ea7a78ba105cf1de8d296b680772eed44e28f601812e689c60102ef478c3432454321a22d34b267550654b99077fdc2873a05f50cae802949958a844e337082107e48510391af88d4b62367b0a2e18d0b97b1b0f8c3d8b0b8d6b69c435679f082c335ba314e8eff3ec30e0ed334d9dd49d7629ebd7f09663d76e213d3fbc2c366c7c7f2266d398514e588b57b6b86c6d75892e50dfc9270e79a7962bf9985942c3487da10fd90a90231b6743a01fa10b320c86870e5ed78fda7a5685e8360007ceab2bf8d546e12e05486ba8056b1a1e5b7f29d6811e5df5fe77eb9c08d3da0bf884140e5cc8acf52fac0a10090efb11dfca2c6c61595b95d282c971f8f92482a06cda9dea4702aa113ec7a14a0d72daf21070d57f1fef961ff869c6c589e2dd47c948a5f210091022896516e40d234a8da44adf3faaf98ad5981ed25cb6203d910724ad011465b4537a2dc4e5ff47a08cec9cef94bcc0359b6e61ac127ce66089635610f2cdb7cd58c9ba58a870e63e6257999bef0e001786d94c842b6010fe12b0e80efb9608db936853598dbc20f5039142caac0f09733a1647be81ffb7228e51dd1284209da86e66529a17a6345a0866f50a9ad0ae5635c008807f9efa80bfcccdc7d82247fbfa1ae55e541c6e8130acd5414732f7a60665ce41c8ecaff9d362ca31055f40691e61119d8f3b3b0493dada9b3e717aeb99713a3d066e9f97a78ca6551d16021d01f64f728db8fcaa2ab2e8623c63bb6b4a6df2b82a750db63cb6a5055488e461f7660d8cbf6727c8ee429f31fa6ec1b892fa3b6ff5f878466a17da6eef89688941604834506947cdfd0b1098ca75ae2e533e7849a9fa40311b05a7ac4c869a4e5f06d7681e005035888064d83e5a6918de87be331cec943b717d7a6de61683507cd27353030789839f7101b3f6fd2aa2333cad379195dd27d988a27ce4a59c55d5709251ed99cf709eaa60694f0f2b2b14d82b8801b6ae608d630a09f28ac39a8616ae3cce1c7297f7e9b7a5b86f851e6a1c57251b8052dafeafcf3b15df8345ff91bd85fa3559258202b2aafb2c6dba11b48d0b35e97efe4c107be97549029e0700b4da5ca779d1a32d13b4b4f5a5dd98577b37a98dc0cb5555abbea91e92c1b3b615f72345946835658c2723b27ee3d9e30215609a72204d0251fcf9a763f0659c0b447ef00a571096843bc84b1e3a0b0bd1412e75ece839d7a8fbdfcc20bf6c1bdfc2561bd433428bdb27cb3b1cb946c9cd9df100dd97fed12557e9486b8ca1439da2403f3622dfbb5dba17e0a059e99ba4cf0924451a8ac41e03c85cb27d1c61019336d8356a1475773638a5db38c3361ca4cdd3f958d3f4ba523706dd83f4cf31d3f9e7f510b827fefa18f2a14a74d39ad99dde1b8548dff7b33cc04a1987bd75e4e13b75556c407a7c4a1f53be5c46503e85b157e876601436ca99d5dc21644ea4b169438665411b15b9239f375f0f8133795628399d71f5ecd7fbf1a0f77eb6cf53180ff1772a97f2f0a1c4982682f8dee3d23e67ca00979186641b9c45eb8092519b9e06fa279e8f6e7493fd619fda11b31d88b2e4b6eca151cb691f305a7e5ff92b1f169a223ae55f9b386b2d5ed30a3864d210e9e89130afb09d142053558c0419c9ccda9e021fc5ab00fd87ddb3929bb885a03ab92a4c437f69e2b932d0f53851f142269b5ce878768a05bc94aaaa8d770a5070bb21c4bdd2f33a3e9b9f3ba41e0982d938cdf8ada11fbb0bb2024dbf8e22668d3294e4109c431e1ce7279de02761bbf64993edb167627e5634f4067abf634ede0ebc5f22e774282eee983dd75422f592d6ca6346f5c4e9b44cec4f5b60cad1e96f4b0da07dbd264d0d4c4f50ebee1f225417ad5c5c1a5bbc4fa3d150a6f20da14766add274e6c32ae308f2133cf8c06a7daa92bef41f2c50d2f6b57bcf99ea17751113d870129afd157a36b92dee2be0f86aa097f7a80176ac9227edbaf6756b45e0e403f15cec214355f74fcccd0775750fb4e22d9376f72269b526763916ce2b9bfcc7299b669a92223183a5109637bef5f29761ba75ee8b73fe6a253a2b19ce973cb59936f6209b5701c661aa4cdc4be2ec00da8c39030b38903b82b60754fe8fb740182dc1ffa855428df5b00222eaedabc5b1f52db9c0b631c12542ec7f154c5c4a63e57fdf58c72bdeaf2978c45645f504fd1f385f4b936611d1adf5ea4c29016a2479b8b9e61fe537507082f8e769630041c731f9e8e6ea2e6b7036ff1908546ea776a1193134850dc6fb5e4e1bc3b1cc2532430a7b228da36b256e217eb4752b93d140909e77a81fbf56fe2b328bcb3678a871aa7f49f38de2668b9dd5e4429c8897a07f2c7ce540fdac6ea00337d185c78a826f192138ca8e3497070d079519fdc9d86177b5ba51c47c333d6cbb09715a26fd0574a3d54f0b57f44c235f47bd0081ebd06cea6d298a3bd44e54b4f6d7ee056454f4a68f66987193346d7b929c9deeac8c59983caa054e90a5571e55624116b49eb33bf0fb1396eabb4c37302b2f93ae608ab5ef83b3676887dcfdc5d2d469a1138a0255a2e9009a34e51a02c7f7385ed3fe8638841a53862db845d7a389df846bbb33df745ab7feb58dcc7900445fe3182185c6118f27677f9307b9bbd025cdd60e38ae457015d96c0b7ae599404e6132a3b9fae2c561b745ebe2fa6aef7d868c7deed308e9903f6e763f2b48f49ef67ff6cf99df7c0289e0b583419fb6e353f023fecd8b320b4db506b009466b8bb566780c3575c24e9e14b29fc58a382a1aaa582d308aebae93a94f80937a83f424137fab5d023d3737edb7c4f73e6602f8976294d82820ffa71a2e38b7e833da27a7aaecf55b33a0e70843225dbf2f14e6cff60fbfb3e31b1dbc4154e57efea7b046c0e4bf950ca9cda8b03ecf92e5a4823ad4882014bdde81371f18b35f09ca8a3d6b8cc9b64c35dde517d21adc54313b6a0b8fc2ba3b22a885bd6f86f0d04ade2dc1fdc0d4245cd9e9a239912af57219a4cf5247eb537ca67cccef511ca04f05259e39175e6ee8d92fb1007fe3b978adacc509cacb8fbb4c046eed4c1ee4a8366cac632524786c8927d7da406c102698de65e1fd054fb302a3e809f2e81557fc8524a90b938790596979b87c2f78af96318905afa19b31701dc927cb585b78bab922004cf0e0e9dac6341bb60c22f59ea35c73393f69c9d50dd1f9607fd60782241448d4d5d48e9faa5200bd7f73b64a41c9e3b68390caa8f40fd93b5b8908765e84b060842f17598a774ac540a5fbad24ea9633caed01f5f108f8fcd013d175ee2441b2aa50922dd5eb15f0a1646d1f7ee3faf26228df6a4a60a96eb7ca00be9502483ac709ccc8ffa312d2c70685e99168b1f8d36b0f172620d364c1bea4d2a35abed5fa53bc04827a91c2268542639028f3db005e081cbf49b4c8771b174cac33fd8ee51f16e904494590d6fe6914f19f8bd780db772116f351da85ccf43eb9632cf28d2cb73295aaa2c5c20de22e0abdd3ee7ba861fd65e45f51bd7ddae139ea83e7750352765cffc392bbd6e10537a7f5093580205850065f64abaa18759573f552b541f2a98b911398166329f7a523e1d406e02244a65b5c46290b281cc24dff5978d22edf5b94d5647485a3b3ce8bb53b4b33c3c0a80a0bc44934c90e2dd04798710225eeacb5003662d20b69d783fd6ad2a9f7ac5c0ea2fe237c8b15ca6ad95625030fe8ae6dbe699ecbb1cfb4a4c2fb1ee2268809548991d06fb6cbaa762747047d38b8c864f0664a6540dea72c7ad393d9d4f4239b2df0ccf10f80ce1cf1a928363bee339164901ca85781573cf5b8c907c89ba674cf356121dd96d5ef6060fbdcb560c44f857ccff7e6980e0cab184609d333ff85fcbe66121308cc44d4315d648291af6563430b362a86a642b44f77304f57e4494ce277640d4db19bcd1982a10a472f2a46cc74d142f7da7670fba1684495929483fbae6e5fae1b4f2e755c973a8cbd5fd88bbfd9a159a6c7fca0f4a9434ba882602dbfed405cd5cfd7a51c350d89f5c3c117e73fd26d6aa00987023ad833bfa6157f0c6955307d2057d23f6049a2ff5ccc2271dac6ccdead215de6f0ab04f888a91af2a6410f546405462a353bb0005419c936cb1cdbb640aaf234057229c0c060c0791cda2f03e8de25232506aadf388bcf553a108e64c90f54d107a0864fdd001b5b1c66ed849f76bdc195cfc73eb946973ce60b6efe87e834cb0af4db8198b4463b74ca8af3cce1a56b030d55ae90482244a875a330bf20d490668141db632eda5f2282d7baa4d09a6f8d1a54a02ada23e1e079ffed3d724df4f9c3203b8104cc996810fc5b0769fd28599bda40345a4609909c6a6cef3daa1dbd959f701db1950899badb4429af72a3471f9f4b6c151b04a1f27704cad80d263c8d5e8f54286cc100b468e060f2bfc9f4e463c4d33e2ce23660fa535ff55eb361a4"}], 0x3368}, 0x7f}, {{&(0x7f0000000440)=@generic={0x8, "d00699cdec1d9f9659109a0aa05079eef6e4bb0c1962feffda4aacfdd81cf55af41fdec0f7c3938585b2b20053b1ce1ad262b98237af4be04fdbf93e1f3557e1ef4ff30e469ee70cec1a91469b949fe81ed91cc84b1706f3b2b5e526ceedb103c2bd3f71feffac7c5371b76e9f757f40f730f1dc811413532944c0226848"}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000004c0)="3ff44a83b6a4da13af5d9aa23728c0c870603b44be764eee4d9d6e2aaa5a8870c1fed4c380011e08061faf07fb8c9a5f3cf3c0581c9968af40209b0e9f4e4505d460bccb3220611ef97827a3f39e04e8974f8c8011eea413d2e35aae3083bd89d6219c3d04f78fde505c94270d8a77f848ceec9a42e57c4a82d451f6eded624ed5e662cfcef49d50167dfb4374617989f9fbac0adff32fe072afbc868778eba87c2300a2d16c45eab585db56cd8db3c5f440042ce8b603d30ad3921118bdd1bf85a4a88a11ad2d881a9c062503e6e8d79c28", 0xd2}], 0x1, &(0x7f0000000600)=[{0xf8, 0x105, 0x100, "23ce68f5901803f3242d837ea031771b87ac565a9593c39a86ebd7697dabd64e24e18d0dcf763a4fab52a492d25b4f67e9a4287a8a6c1e3072ff677a0f089c22502d74d6d78168781e85db20250839498e0af5eaeaac8bb314513a2ba75e3769cec0c927cf15b0018fe129a833afbfde4d0ada05ef93e8b4bd473f2ec3ba316df910dce18520d8547251bf3f8ea2ba054d005296474e84edc3e7caac528ed77d37ad516b882cf20f8b8d5e7fff6beefb89aa38c6ff8921426313ace59f15ff4dfd57f7f9b97fd6f813e60840d0e8e50156394ca5dd754ecf3b3152870420223b8de309"}, {0x10, 0x118, 0x20}], 0x108}}], 0x2, 0x804) fcntl$addseals(r1, 0x409, 0x8) [ 2022.971470] binder_transaction: 4 callbacks suppressed [ 2022.971506] binder: 32714:32715 transaction failed 29201/-71, size 0-0 line 2816 19:21:12 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x2000, 0x0) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x1}}, 0x30) umount2(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x50, r3, 0x401, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xae}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xa3}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x80) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000380)) 19:21:12 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x2000000000000000) 19:21:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}) 19:21:12 executing program 1: r0 = socket$inet6(0xa, 0x8, 0x1) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={r1, @in6={{0xa, 0x4e21, 0x0, @local, 0x9}}, 0x5}, 0x90) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2023.057182] binder: 32714:32715 ioctl c0306201 20000600 returned -14 19:21:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:12 executing program 3: socketpair$unix(0x1, 0x1000000002, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x3, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0xffffff7ffffffffc}) r2 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x0, 0x2) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f0000000180)) r3 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0xd) ioctl$RTC_WIE_OFF(r2, 0x7010) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0xffa8) [ 2023.187322] binder: release 32714:32715 transaction 5496 out, still active [ 2023.197163] binder: undelivered TRANSACTION_COMPLETE 19:21:12 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}) [ 2023.255379] binder: undelivered TRANSACTION_ERROR: 29201 [ 2023.281003] binder_send_failed_reply: 1 callbacks suppressed [ 2023.281011] binder: send failed reply for transaction 5496, target dead 19:21:13 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x2e, &(0x7f0000000300)={0x1, &(0x7f0000000040)=[{}]}, 0x10) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2023.302434] binder: 32751:32757 got reply transaction with bad transaction stack, transaction 5499 has target 32751:0 [ 2023.341573] binder: 32751:32757 transaction failed 29201/-71, size 0-0 line 2816 19:21:13 executing program 2: r0 = semget$private(0x0, 0x207, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x200]) clock_settime(0x6, &(0x7f00000003c0)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580)='/dev/mixer\x00', 0x20400, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, &(0x7f0000000600)={r2, 0x1}) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000100)=""/76, &(0x7f0000000000)=0x4c) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x4100, 0x0) r4 = accept$inet6(r3, 0x0, &(0x7f00000001c0)) ioctl$IMADDTIMER(r3, 0x80044940, &(0x7f0000000200)=0x32) r5 = openat$cgroup_ro(r3, &(0x7f0000000400)='m\x99\xb1\x98\xfd\xd6\rG?enx\x81\xa2L\xc1BOts\x00\xc6hN\xc1XO\t\x82\x91\xdf\x89\xd7\xea3\xef\xb7~\xb9N\x1f>\xb9\xfc\xa7\xb2U\xdc\xc1]\xb3QO\xfe\x12vf\xc1+\x03\xb9\xa0\xc7\xd34\x12\xa3\xd7\b\a\x00t\xe8W\xa8\x82_\xb4{\xfc\x1dQ\xf7+\xe6\xda\v\x04\xcbp4\x1a4&\xe4\t\xde\xd4\x872\n\x80\xaa\x91^@\xe3z\x81\xe5\x8c\xf9\xef9\xc1e\xd2,\xc4\xf0+\a\xff,\xbe\xa4\x18f_\xb33\x03\f\x9e\x90\xf2\x89\xcb\x94\x9d\xd9\xba\xaeu_\x94\xa9a\xad2\xe0U\xa2\xc8%yx{\x93k*\xca\xa1\'[,t\xaf\xe1w\x89\x8b\xb4\x11\x10F\xee\xdb\x16c\x11\xe6~\xb4\xb0\xe9\xee\xba\x8enoD\x15-\xdc\xe6I\xb3\x83\xfeTC6\xa4^a\xa3\xb6\xda\x83$\xd07\xca\xf7P\xf6WE\xb5\xc4?\x14L\x85\x12\x96\x1d\xada\xa9\xc3\xe2\x13.q*\xb6\xf3>(\xf3\x19\x18\x9a\xc4\xcd\xbf\xd7\xad\xff\xec=\x89\xae\xf2q\xda\xfd\xf3\xa5\xe5\x16,\xf8#\xed\xa2\xd61\x8f\x9f]\xd7.j\x89\xed\xf2\x86\x16K\xb95\xff\v~\x8a\'\x02%\xccD\xc5g\xa6\xddqf3\x0e\x87j\xbc<\x88$\xfb\x97T\xa2\xbc7\xec\x11wU]G\xbb|\x13\xc4y\xb1\x14\xf0\x1c\xf6\xcf\"\x83\xcf\xe4+T\xc7\x85i\x01\xcb\xda\xa2 \xb7\xef\xca\xd2\xb1\x02+2', 0x0, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000280)={0x0, 0x2}, &(0x7f00000002c0)=0x8) ioctl$FS_IOC_ENABLE_VERITY(r4, 0x6685) getsockopt$inet_sctp_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000300)={r6, 0x100}, &(0x7f0000000340)=0x8) semtimedop(r0, &(0x7f0000000040)=[{}, {}], 0x2, &(0x7f00000000c0)={0x77359400}) semctl$IPC_RMID(r0, 0x0, 0x10) ioctl$DRM_IOCTL_IRQ_BUSID(r3, 0xc0106403, &(0x7f0000000380)={0x2, 0x80, 0x9}) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000240)={0x7fffffff, 0x8, 0x1, 0x3, r7}, 0x10) 19:21:13 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x8200) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x6, 0x20200) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x95a8, 0x0, 0x0, 0x0, 0x0, 0x8800000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x1000000000c, 0x8}, 0x0, 0x0, r1, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000140)=0x100000008001) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000180)=""/216, 0xd8}], 0x300) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f000000d000), &(0x7f0000001000)=0xfea6) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000001000)) [ 2023.379307] binder: 32751:32757 ioctl c0306201 20000600 returned -14 19:21:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}}) 19:21:13 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x3f00000000000000) 19:21:13 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {}, 0x4, 0x0, 0x1, 0xfffffffffffffffd}, {{@in=@multicast2, 0x0, 0x32}, 0xfffffffffffffffd, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) prctl$PR_SET_SECCOMP(0x16, 0x3, &(0x7f0000000040)={0x7, &(0x7f0000000000)=[{0x401, 0xa00000000, 0x1, 0x1}, {0x9, 0x7, 0x2, 0x7}, {0x20, 0xa1, 0x5, 0x8001}, {0x80000000, 0x3ff, 0x6, 0x3}, {0x7, 0x6, 0x100000000, 0x7}, {0x0, 0x100, 0xc4, 0x2}, {0x400, 0x7, 0x4, 0x3}]}) sendmmsg(r0, &(0x7f0000000240), 0x8ba, 0x0) 19:21:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2023.523888] binder: release 32751:32757 transaction 5499 out, still active [ 2023.541229] binder: undelivered TRANSACTION_COMPLETE [ 2023.566014] binder: undelivered TRANSACTION_ERROR: 29201 [ 2023.600076] binder: send failed reply for transaction 5499, target dead [ 2023.611575] binder: 320:324 got reply transaction with bad transaction stack, transaction 5502 has target 320:0 [ 2023.623590] binder: 320:324 transaction failed 29201/-71, size 0-0 line 2816 [ 2023.631725] binder: 320:324 ioctl c0306201 20000600 returned -14 19:21:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x80000001, &(0x7f0000000140)="0adc1f023c123f3188a070") utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0xfffffffffffffff9}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f00000000c0)={0x39, 0x36, 0x10, 0x10, 0x7, 0x416, 0x5, 0xf6, 0xffffffffffffffff}) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x50040, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x4801, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000180)='memory.low\x00', 0x2, 0x0) write$binfmt_aout(r3, &(0x7f0000000200)=ANY=[@ANYRESOCT, @ANYRESOCT=0x0], 0x2e) 19:21:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:13 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) statx(r1, &(0x7f00000000c0)='./file0\x00', 0x2100, 0x10, &(0x7f0000000240)) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='user.syz\x00') sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}}) [ 2023.688290] binder: undelivered TRANSACTION_COMPLETE [ 2023.693516] binder: undelivered TRANSACTION_ERROR: 29201 19:21:13 executing program 2: r0 = semget$private(0x0, 0x207, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x200]) clock_settime(0x6, &(0x7f00000003c0)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580)='/dev/mixer\x00', 0x20400, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, &(0x7f0000000600)={r2, 0x1}) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000100)=""/76, &(0x7f0000000000)=0x4c) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x4100, 0x0) r4 = accept$inet6(r3, 0x0, &(0x7f00000001c0)) ioctl$IMADDTIMER(r3, 0x80044940, &(0x7f0000000200)=0x32) r5 = openat$cgroup_ro(r3, &(0x7f0000000400)='m\x99\xb1\x98\xfd\xd6\rG?enx\x81\xa2L\xc1BOts\x00\xc6hN\xc1XO\t\x82\x91\xdf\x89\xd7\xea3\xef\xb7~\xb9N\x1f>\xb9\xfc\xa7\xb2U\xdc\xc1]\xb3QO\xfe\x12vf\xc1+\x03\xb9\xa0\xc7\xd34\x12\xa3\xd7\b\a\x00t\xe8W\xa8\x82_\xb4{\xfc\x1dQ\xf7+\xe6\xda\v\x04\xcbp4\x1a4&\xe4\t\xde\xd4\x872\n\x80\xaa\x91^@\xe3z\x81\xe5\x8c\xf9\xef9\xc1e\xd2,\xc4\xf0+\a\xff,\xbe\xa4\x18f_\xb33\x03\f\x9e\x90\xf2\x89\xcb\x94\x9d\xd9\xba\xaeu_\x94\xa9a\xad2\xe0U\xa2\xc8%yx{\x93k*\xca\xa1\'[,t\xaf\xe1w\x89\x8b\xb4\x11\x10F\xee\xdb\x16c\x11\xe6~\xb4\xb0\xe9\xee\xba\x8enoD\x15-\xdc\xe6I\xb3\x83\xfeTC6\xa4^a\xa3\xb6\xda\x83$\xd07\xca\xf7P\xf6WE\xb5\xc4?\x14L\x85\x12\x96\x1d\xada\xa9\xc3\xe2\x13.q*\xb6\xf3>(\xf3\x19\x18\x9a\xc4\xcd\xbf\xd7\xad\xff\xec=\x89\xae\xf2q\xda\xfd\xf3\xa5\xe5\x16,\xf8#\xed\xa2\xd61\x8f\x9f]\xd7.j\x89\xed\xf2\x86\x16K\xb95\xff\v~\x8a\'\x02%\xccD\xc5g\xa6\xddqf3\x0e\x87j\xbc<\x88$\xfb\x97T\xa2\xbc7\xec\x11wU]G\xbb|\x13\xc4y\xb1\x14\xf0\x1c\xf6\xcf\"\x83\xcf\xe4+T\xc7\x85i\x01\xcb\xda\xa2 \xb7\xef\xca\xd2\xb1\x02+2', 0x0, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000280)={0x0, 0x2}, &(0x7f00000002c0)=0x8) ioctl$FS_IOC_ENABLE_VERITY(r4, 0x6685) getsockopt$inet_sctp_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000300)={r6, 0x100}, &(0x7f0000000340)=0x8) semtimedop(r0, &(0x7f0000000040)=[{}, {}], 0x2, &(0x7f00000000c0)={0x77359400}) semctl$IPC_RMID(r0, 0x0, 0x10) ioctl$DRM_IOCTL_IRQ_BUSID(r3, 0xc0106403, &(0x7f0000000380)={0x2, 0x80, 0x9}) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000240)={0x7fffffff, 0x8, 0x1, 0x3, r7}, 0x10) [ 2023.736561] binder: send failed reply for transaction 5502, target dead [ 2023.783149] binder: 331:334 got reply transaction with bad transaction stack, transaction 5505 has target 331:0 19:21:13 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x4000000000000000) [ 2023.840565] binder: 331:334 transaction failed 29201/-71, size 0-0 line 2816 [ 2023.869494] binder: 331:334 ioctl c0306201 20000600 returned -14 19:21:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00}}) 19:21:13 executing program 1: r0 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r2, 0x204, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x38}}, 0x8000) 19:21:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:13 executing program 2: r0 = semget$private(0x0, 0x207, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000080)=[0x200]) clock_settime(0x6, &(0x7f00000003c0)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000580)='/dev/mixer\x00', 0x20400, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000005c0)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, &(0x7f0000000600)={r2, 0x1}) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000100)=""/76, &(0x7f0000000000)=0x4c) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x4100, 0x0) r4 = accept$inet6(r3, 0x0, &(0x7f00000001c0)) ioctl$IMADDTIMER(r3, 0x80044940, &(0x7f0000000200)=0x32) r5 = openat$cgroup_ro(r3, &(0x7f0000000400)='m\x99\xb1\x98\xfd\xd6\rG?enx\x81\xa2L\xc1BOts\x00\xc6hN\xc1XO\t\x82\x91\xdf\x89\xd7\xea3\xef\xb7~\xb9N\x1f>\xb9\xfc\xa7\xb2U\xdc\xc1]\xb3QO\xfe\x12vf\xc1+\x03\xb9\xa0\xc7\xd34\x12\xa3\xd7\b\a\x00t\xe8W\xa8\x82_\xb4{\xfc\x1dQ\xf7+\xe6\xda\v\x04\xcbp4\x1a4&\xe4\t\xde\xd4\x872\n\x80\xaa\x91^@\xe3z\x81\xe5\x8c\xf9\xef9\xc1e\xd2,\xc4\xf0+\a\xff,\xbe\xa4\x18f_\xb33\x03\f\x9e\x90\xf2\x89\xcb\x94\x9d\xd9\xba\xaeu_\x94\xa9a\xad2\xe0U\xa2\xc8%yx{\x93k*\xca\xa1\'[,t\xaf\xe1w\x89\x8b\xb4\x11\x10F\xee\xdb\x16c\x11\xe6~\xb4\xb0\xe9\xee\xba\x8enoD\x15-\xdc\xe6I\xb3\x83\xfeTC6\xa4^a\xa3\xb6\xda\x83$\xd07\xca\xf7P\xf6WE\xb5\xc4?\x14L\x85\x12\x96\x1d\xada\xa9\xc3\xe2\x13.q*\xb6\xf3>(\xf3\x19\x18\x9a\xc4\xcd\xbf\xd7\xad\xff\xec=\x89\xae\xf2q\xda\xfd\xf3\xa5\xe5\x16,\xf8#\xed\xa2\xd61\x8f\x9f]\xd7.j\x89\xed\xf2\x86\x16K\xb95\xff\v~\x8a\'\x02%\xccD\xc5g\xa6\xddqf3\x0e\x87j\xbc<\x88$\xfb\x97T\xa2\xbc7\xec\x11wU]G\xbb|\x13\xc4y\xb1\x14\xf0\x1c\xf6\xcf\"\x83\xcf\xe4+T\xc7\x85i\x01\xcb\xda\xa2 \xb7\xef\xca\xd2\xb1\x02+2', 0x0, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000280)={0x0, 0x2}, &(0x7f00000002c0)=0x8) ioctl$FS_IOC_ENABLE_VERITY(r4, 0x6685) getsockopt$inet_sctp_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000300)={r6, 0x100}, &(0x7f0000000340)=0x8) semtimedop(r0, &(0x7f0000000040)=[{}, {}], 0x2, &(0x7f00000000c0)={0x77359400}) semctl$IPC_RMID(r0, 0x0, 0x10) ioctl$DRM_IOCTL_IRQ_BUSID(r3, 0xc0106403, &(0x7f0000000380)={0x2, 0x80, 0x9}) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000240)={0x7fffffff, 0x8, 0x1, 0x3, r7}, 0x10) [ 2024.009921] binder: undelivered TRANSACTION_COMPLETE [ 2024.015214] binder: undelivered TRANSACTION_ERROR: 29201 [ 2024.029874] binder: send failed reply for transaction 5505, target dead 19:21:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}}) [ 2024.098533] binder: 361:363 got reply transaction with bad transaction stack, transaction 5508 has target 361:0 19:21:13 executing program 3: r0 = socket(0x1e, 0x2, 0x5) r1 = socket(0x800000000000001e, 0x200000000000002, 0x0) bind(r1, &(0x7f0000d80f80)=@generic={0x1e, "0103000000000000000000000000000009a979f321b30c7bc8790405c7bad62e0a43a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb31f1314a8ef151622ca5bdb9c8ead2000077aeb81c90001d6d7c980ee590c8b9f70dc136cb184a"}, 0x80) bind(r0, &(0x7f0000afb000)=@generic={0x1e, "01030000000000b9000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001d6d7c980400000000f70dc136cb184a"}, 0x80) sendmsg(r1, &(0x7f0000000700)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02010000000020df0000000000000000805bf86c57020002000000f1fffff400000000000000000000010300000000e4ff064b3fdf3a000000080000000000000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ece000206000000090000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) [ 2024.154611] binder: 361:363 transaction failed 29201/-71, size 0-0 line 2816 [ 2024.161888] binder: 361:363 ioctl c0306201 20000600 returned -14 19:21:13 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}) 19:21:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:14 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000001300), 0x0, 0x0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(gcm_base(ctr(aes-aesni),ghash-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000012c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005900)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, &(0x7f0000fb3fa9)=""/87, 0x57}, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f00000000c0)) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) syz_open_dev$usb(0x0, 0xffffffff, 0x501001) 19:21:14 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x6000000000000000) [ 2024.300179] binder: undelivered TRANSACTION_COMPLETE [ 2024.305757] binder: undelivered TRANSACTION_ERROR: 29201 19:21:14 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000683ff4)={@multicast2, @loopback}, 0xc) setsockopt$inet_group_source_req(r0, 0x0, 0x80000002e, &(0x7f0000000140)={0x6, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @dev}}}, 0x108) r1 = socket(0x10, 0x803, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f00000003c0), 0x4) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000280)={0x1, {{0x2, 0x0, @multicast2}}}, 0x108) [ 2024.349474] binder: send failed reply for transaction 5508, target dead [ 2024.396090] binder: 389:390 got reply transaction with bad transaction stack, transaction 5511 has target 389:0 19:21:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}) 19:21:14 executing program 3: r0 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x0, 0x2c80) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000100)=0x3ab, 0x4) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40082, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000080)={0x0, @speck128, 0x1, "b9a71e44f920b82b"}) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000180)={0x2, 0x4e23, @loopback}, 0x64) r3 = getpgid(0x0) sendmsg$key(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x12, 0x9, 0x6, 0x2, 0x0, 0x70bd25, 0x25dfdbfd}, 0x10}}, 0x408c4) fcntl$setown(r1, 0x8, r3) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) sendto(r2, &(0x7f0000000040)="b6", 0x1, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000140), 0x4) [ 2024.452518] binder: 389:390 transaction failed 29201/-71, size 0-0 line 2816 [ 2024.468546] binder: 389:390 ioctl c0306201 20000600 returned -14 [ 2024.585820] binder: undelivered TRANSACTION_COMPLETE [ 2024.592922] binder: send failed reply for transaction 5511, target dead 19:21:14 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x4}, 0xffffffffffffffc4) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}) 19:21:14 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x2000000006) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000040)=ANY=[@ANYBLOB="577e3a4c1f02a4e5dc5e374d443b110dac57"], 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) socket$l2tp(0x18, 0x1, 0x1) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x8000000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000280)={0x0, 0x0, @ioapic}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) lstat(&(0x7f0000000100)='./file0/file0\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) prctl$PR_CAPBSET_READ(0x17, 0x0) 19:21:14 executing program 3: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x400402, 0x0) ioctl$VIDIOC_G_INPUT(r0, 0x80045626, &(0x7f0000000380)) r1 = socket$inet(0x2, 0x3, 0x2) sendmmsg(0xffffffffffffffff, &(0x7f0000003440)=[{{&(0x7f0000000180)=@can, 0x80, &(0x7f00000002c0), 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="10000000000000000000000008000000478584297649f6d3c7a74285db98a2c39d741d3d52827e02ebce97f986c0ae74c1d0a31d1893afec2a756c8a350651fa1a3250d4a66b5337ef689f3354cf4d7a8f3c505e56304de2c4d85dd28fb8b66fcf2fea842e24aa928975e7adb503292f2fc94ff077d5fba265fd618c8a52df4e73d5f5f7eeeb509d40a0b50145c40ddc9d7637e8aa7302add78f487992d60dc7d6655b9aac3efdbe2f0f355b5316acb74ed3afcb674cec7d1ad05a0f6df1f8b3e111e6596e5c50762f8c63e1956c1b550a8df311c53107a4b301a56ed11f489e730167191a2a55c02fe3818ec4bc353b77700870fbc9f8e4a18a3cc223475ced96ffad53a409f2444d811b519c4af27230b1c8ec91a92e5db5c931007980048c5afa287d06551e134c2aab26da66c84a34e687d29fdd"], 0x10}}], 0x1, 0x0) sendmmsg(r1, &(0x7f00000038c0)=[{{&(0x7f0000000040)=@nl=@unspec, 0x80, &(0x7f0000000140)=[{&(0x7f0000000200)="b9c8d4a7d1d4817535ed3aba344891993ba836a63a793e0c3d220e21a7b51e90bd06d6d1b2340f82566c0aa5d08d37a32bd617a9345020db83dc959da1e056a72ee1a3b40490aaa9f598c0e950c8c8a1d9a3c94fc0069f9ca604d0ca4293e176c04a099e582c679a5bdc4fecba39a99548eb4e5430e8a7c515acaff707483a1f501bb7c6038908f33974be47c7bbf55530f3c29bdf55a845cdd6390c3e2c49f5075fe153300d56af13cc36abd8620fc934cb5843c7b97b0f27f1174313141dad49805341fa47b8686cd126befe567dd7204202e33438179a19bc4d60e7577ae0f4a432574206d9be8a2cff90102185936e0502d9f3bc87bb957177123223", 0xfe}, {&(0x7f0000000000)="a1251093beafc3506e8a5e24c0f9636983a5e8", 0x13}, {&(0x7f00000000c0)="53e4144fa8e11e4177b1d9aaa74396d3f136d77800dd0dd628bd493ef02f281527d8e77fcef071c4568d095ea2a075ce8f6efc8d056148a224c257dc7f2293bd5612c7e70823b0b7cafa0b8e73529cf1", 0x50}], 0x3, &(0x7f0000000380)}}, {{&(0x7f0000000400)=@in={0x2, 0x0, @local}, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000000480)}}], 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000300)=0x100, 0x4) 19:21:14 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe000000000000000) [ 2024.842060] binder: 425:426 got reply transaction with bad transaction stack, transaction 5514 has target 425:0 19:21:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}}) 19:21:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_G_CTRL(r2, 0xc008561b, &(0x7f00000000c0)={0x3, 0x5}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xffffffffffffffe8, 0x0, &(0x7f0000000180)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x8000, 0x0) write$cgroup_type(r4, &(0x7f0000000240)='threaded\x00', 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f00000003c0)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 2024.893031] binder: 425:426 transaction failed 29201/-71, size 0-0 line 2816 [ 2024.930273] binder: 425:426 ioctl c0306201 20000600 returned -14 19:21:14 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) getitimer(0x1, &(0x7f0000000000)) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0xfffffffffffffffd}, {}, 0x80000000, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0xfffffffffffffffe, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xfffffffffffffde7) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2025.025923] binder: 448:450 ERROR: BC_REGISTER_LOOPER called without request [ 2025.056237] binder_thread_release: 4 callbacks suppressed [ 2025.056249] binder: release 425:426 transaction 5514 out, still active 19:21:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}) [ 2025.082876] binder: 448:452 got reply transaction with no transaction stack [ 2025.107484] binder: 450 RLIMIT_NICE not set [ 2025.115410] binder: undelivered TRANSACTION_COMPLETE [ 2025.154572] binder: 448:452 transaction failed 29201/-71, size 0-0 line 2801 [ 2025.165302] binder: send failed reply for transaction 5514, target dead [ 2025.177056] binder: 459:460 got reply transaction with bad transaction stack, transaction 5519 has target 459:0 19:21:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}}) 19:21:14 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r1 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) connect$vsock_stream(r1, &(0x7f0000001340)={0x28, 0x0, 0x2710}, 0x10) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2025.243283] binder: 459:460 transaction failed 29201/-71, size 0-0 line 2816 19:21:15 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xe803000000000000) [ 2025.307734] binder: 459:460 ioctl c0306201 20000600 returned -14 19:21:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2025.404275] binder: release 459:460 transaction 5519 out, still active [ 2025.417614] binder: send failed reply for transaction 5519, target dead [ 2025.524961] binder: 479:480 got reply transaction with bad transaction stack, transaction 5522 has target 479:0 [ 2025.572673] binder: 479:480 transaction failed 29201/-71, size 0-0 line 2816 [ 2025.604825] binder: 479:480 ioctl c0306201 20000600 returned -14 [ 2025.694999] binder: release 479:480 transaction 5522 out, still active [ 2025.713644] binder: send failed reply for transaction 5522, target dead [ 2025.734480] net_ratelimit: 26 callbacks suppressed [ 2025.734487] protocol 88fb is buggy, dev hsr_slave_0 [ 2025.734541] protocol 88fb is buggy, dev hsr_slave_1 [ 2025.739499] protocol 88fb is buggy, dev hsr_slave_1 19:21:15 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x5c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}}) 19:21:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:15 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xeffdffff00000000) 19:21:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x2000) r1 = dup3(r0, r0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000080)={{0x2, 0x5, 0x7ff, 0x401, 'syz1\x00', 0x7}, 0x0, [0x80, 0x100000001, 0x1, 0x259b8f30, 0x72ce, 0x101, 0xab0000, 0x9, 0x1, 0x3, 0x1, 0x4, 0xfffffffffffffffb, 0x3, 0xfffffffffffff7a9, 0x74, 0x1, 0x5, 0x3, 0x20, 0x9, 0x8000, 0x1, 0x8, 0x936, 0x9, 0x84, 0x2, 0x0, 0x8, 0x3, 0x7fff, 0x1, 0x10001, 0x6, 0xfff, 0x48f, 0x80000000, 0x10001, 0xffff, 0x401, 0x2a0f, 0xffffffff0, 0x0, 0x0, 0x7, 0xfff, 0x7fff, 0x78, 0x2, 0x80, 0x100, 0x5, 0x200, 0x9, 0x8, 0x0, 0x0, 0x48a, 0x8001, 0x1, 0xd9, 0x7, 0x3, 0x10000, 0x6, 0x6, 0x9, 0xea, 0x400, 0x3, 0xff, 0xdd, 0x2, 0xfffffffffffffffd, 0x1, 0x5, 0x0, 0x7253, 0x9, 0xffff, 0x7, 0x7fff, 0x304, 0x54, 0x9, 0x9, 0x4, 0x50c0, 0x8, 0x7fff, 0x30f7b514, 0x80000001, 0x0, 0x5, 0x1, 0x1c1000000, 0x2, 0x4, 0x7fff, 0x1, 0x40, 0x0, 0x0, 0x315, 0x5, 0x7, 0x31b, 0x4, 0x0, 0x40, 0x7ff, 0x3f, 0x7ff, 0x9, 0x100000001, 0x100000000, 0x3, 0x0, 0x20, 0x4, 0x6a, 0x6, 0x7fffffff, 0x7, 0x7, 0xff, 0x3]}) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000580)={0x3, &(0x7f0000000000)=[{0x3ff, 0xffff}, {0xff}, {0x3dc, 0x40}]}) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f00000005c0)=0x6f0d, 0x8) 19:21:15 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x2000000006) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000040)=ANY=[@ANYBLOB="577e3a4c1f02a4e5dc5e374d443b110dac57"], 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) socket$l2tp(0x18, 0x1, 0x1) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x8000000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000280)={0x0, 0x0, @ioapic}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) lstat(&(0x7f0000000100)='./file0/file0\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) prctl$PR_CAPBSET_READ(0x17, 0x0) [ 2025.939239] binder: 493:496 ioctl c0306201 20000600 returned -14 19:21:15 executing program 3: socketpair$unix(0x1, 0x4000000001, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2e, 0xffffffc4}}, &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x1, 0x348, &(0x7f0000000480)=""/195}, 0x48) 19:21:15 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}}) 19:21:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:15 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x800) [ 2026.122193] binder: release 493:496 transaction 5525 out, still active [ 2026.134463] protocol 88fb is buggy, dev hsr_slave_0 [ 2026.136615] binder: send failed reply for transaction 5525, target dead [ 2026.139588] protocol 88fb is buggy, dev hsr_slave_1 19:21:15 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf401000000000000) [ 2026.214492] protocol 88fb is buggy, dev hsr_slave_0 [ 2026.219663] protocol 88fb is buggy, dev hsr_slave_1 [ 2026.224885] protocol 88fb is buggy, dev hsr_slave_0 [ 2026.229995] protocol 88fb is buggy, dev hsr_slave_1 [ 2026.235183] protocol 88fb is buggy, dev hsr_slave_0 19:21:16 executing program 3: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100), 0xb) 19:21:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff}}) [ 2026.329252] binder: 528:536 ioctl c0306201 20000600 returned -14 19:21:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:16 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$negate(0xd, r0, 0xb3f, r1) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f00000001c0)=0x8, 0xf746dbe7f2f4f688) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000100), &(0x7f0000000140)=0x20) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) close(r2) [ 2026.478755] binder: release 528:536 transaction 5528 out, still active 19:21:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}}) 19:21:16 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xfffffffffffffffd, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x8082, 0x0) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2026.606271] binder: 554:555 ioctl c0306201 20000600 returned -14 [ 2026.721024] binder: release 554:555 transaction 5531 out, still active 19:21:16 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x2000000006) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000040)=ANY=[@ANYBLOB="577e3a4c1f02a4e5dc5e374d443b110dac57"], 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) socket$l2tp(0x18, 0x1, 0x1) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x8000000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000280)={0x0, 0x0, @ioapic}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) lstat(&(0x7f0000000100)='./file0/file0\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) prctl$PR_CAPBSET_READ(0x17, 0x0) 19:21:16 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xf5ffffff00000000) 19:21:16 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000000)={0x5, 0xc00000, "dc892297a0aa3368d37bc28356d948affbacc6a354a546b9", {0x3, 0xe3ef}, 0x74bc}) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) write$RDMA_USER_CM_CMD_GET_EVENT(r0, &(0x7f0000000040)={0xc, 0x8, 0xfa00, {0x0}}, 0x10) 19:21:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}) 19:21:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:16 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2027.009874] binder: 569:570 ioctl c0306201 20000600 returned -14 19:21:16 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}}) 19:21:16 executing program 3: syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) mq_notify(r1, &(0x7f00000001c0)={0x0, 0x2a, 0x4, @thr={&(0x7f0000000100), 0x0}}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@window={0x3, 0x7fffffff, 0xffffffff}, @mss={0x2, 0x3}, @window={0x3, 0xff, 0x1f69}, @window={0x3, 0x48, 0x8}], 0x4) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000040), 0xfffffffffffffea9) 19:21:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2027.193050] binder: release 569:570 transaction 5534 out, still active [ 2027.218334] binder_release_work: 5 callbacks suppressed [ 2027.218340] binder: undelivered TRANSACTION_COMPLETE [ 2027.256321] binder_release_work: 8 callbacks suppressed [ 2027.256327] binder: undelivered TRANSACTION_ERROR: 29201 19:21:16 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xfe80000000000000) [ 2027.308998] binder: BINDER_SET_CONTEXT_MGR already set [ 2027.324850] binder: 602:606 ioctl 40046207 0 returned -16 [ 2027.335874] binder_alloc: 569: binder_alloc_buf, no vma 19:21:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc3}}) 19:21:17 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000000)={0x0, 0x9e, "e4ca94dd748aa9ae12b6b67f1e37f2542ad3190c5d48a98e9edd037a0d68660e1ee821f3d64dcd591940c8ae78a9268fca9f17765f35e019b5702117fb59e19f0c2e51990742d1a4625baa75a71538a04f8ad2dfaef320d3f3451ba77071da7ac4560b9a2fef35b2ed3c0a8fec09dd9867e5b473f678aee694989a4f97df40c69e0802a01359afed9d7646befbd672ff3e120c229432441644ce72dcd59e"}, &(0x7f00000000c0)=0xa6) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000100)={r1, 0x6, 0xfffffffffffffe00}, &(0x7f0000000180)=0x8) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2027.372651] binder: 602:606 ioctl c0306201 20000600 returned -14 [ 2027.499361] binder: undelivered TRANSACTION_ERROR: 29189 19:21:17 executing program 2: r0 = socket$inet6(0xa, 0x803, 0x2000000006) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000040)=ANY=[@ANYBLOB="577e3a4c1f02a4e5dc5e374d443b110dac57"], 0x1) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) socket$l2tp(0x18, 0x1, 0x1) sendmmsg(r2, &(0x7f0000005fc0), 0x8000000000000fc, 0x8000000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000280)={0x0, 0x0, @ioapic}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) lstat(&(0x7f0000000100)='./file0/file0\x00', 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r3, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) prctl$PR_CAPBSET_READ(0x17, 0x0) 19:21:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}) 19:21:17 executing program 1: pipe2(&(0x7f00000004c0)={0xffffffffffffffff}, 0x4000) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000001c0)=0x0) capset(&(0x7f0000000440)={0x20080522, r2}, &(0x7f0000000480)={0x47f, 0x4, 0x5, 0x5, 0x8001}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000000)={{{@in=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000100)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000000180)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@ipv4={[], [], @multicast1}, @in6=@empty, 0x4e21, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0xa0, 0x2f, r3, r4}, {0xbb22, 0xffffffffd8ae0480, 0x5, 0x2, 0x4ca, 0x6, 0x606, 0x3}, {0x69f2e0a3, 0x8, 0xfff, 0x4}, 0x1, 0x0, 0x2, 0x1, 0x1, 0x3}, {{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4d5, 0x33}, 0xa, @in=@local, 0x0, 0x5, 0x2, 0x1, 0x2, 0x7f, 0x8000000000000000}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) 19:21:17 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xffff000000000000) 19:21:17 executing program 3: syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) mq_notify(r1, &(0x7f00000001c0)={0x0, 0x2a, 0x4, @thr={&(0x7f0000000100), 0x0}}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@window={0x3, 0x7fffffff, 0xffffffff}, @mss={0x2, 0x3}, @window={0x3, 0xff, 0x1f69}, @window={0x3, 0x48, 0x8}], 0x4) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000040), 0xfffffffffffffea9) [ 2028.081291] binder_transaction: 4 callbacks suppressed [ 2028.081306] binder: 635:641 got reply transaction with bad transaction stack, transaction 5538 has target 635:0 19:21:17 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = request_key(&(0x7f0000000280)='dns_resolver\x00', &(0x7f00000002c0)={'syz', 0x0}, &(0x7f0000000300)='/dev/vbi#\x00', 0xfffffffffffffffe) r2 = add_key(&(0x7f0000000340)='encrypted\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f00000003c0)="48ed45c49d3662b0090e89412ac141caa6e96cf739a7f8b814c3c8d75bb6fb266d69474e7583cdd3160b1c9d81835c464313515a861928875d6f9096585890249c67a6782ee021a0141029cf36d70c4e89ebbae5623f9756bddb799e8240551e36fc3ae3b443cd99b4fd07cc61a0c1b4aac806c4dde7bc45b9a976d7ff51aabd24af9a9d213bc9677ef7ead2e02675d9633ca74fbdf0b6293da42c544f0b39ce8f3cad7a2481895f8cb2536f53", 0xad, 0xfffffffffffffffc) keyctl$instantiate(0xc, r1, 0x0, 0x0, r2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) r3 = accept$inet(0xffffffffffffff9c, &(0x7f00000005c0)={0x2, 0x0, @dev}, &(0x7f0000000600)=0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x3, &(0x7f0000000640)=0xffffffff80000001, 0x4) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dlm-monitor\x00', 0x20000, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r4, 0x4010aeab, &(0x7f0000000500)={0x6, 0x2000}) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) timer_create(0x7, &(0x7f0000000000)={0x0, 0x1b, 0x6, @tid=0xffffffffffffffff}, &(0x7f0000000040)=0x0) timer_gettime(r5, &(0x7f0000000080)) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x0, 0x0) syz_open_dev$rtc(&(0x7f0000000480)='/dev/rtc#\x00', 0x5, 0x20400) write$FUSE_LSEEK(r6, &(0x7f0000000240)={0x18, 0x0, 0x2, {0x5}}, 0x18) r7 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x0, 0x2) socket$pppoe(0x18, 0x1, 0x0) write$P9_RSTATFS(r7, &(0x7f0000000180)={0x43, 0x9, 0x2, {0xdb48, 0x800, 0x787c, 0x2, 0x800, 0x101, 0x7fffffff, 0x100000001, 0x7}}, 0x43) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}) [ 2028.144903] binder_transaction: 5 callbacks suppressed [ 2028.144921] binder: 635:641 transaction failed 29201/-71, size 0-0 line 2816 [ 2028.212185] encrypted_key: master key parameter '‰A*ÁAʦél÷9§ø¸ÃÈ×[¶û&miGNuƒÍÓ ƒ\FCQZ†(‡]o–XX$œg¦x.à! )Ï6× N‰ëºåb?—V½Ûyž‚@U6ü:ã´CÍ™´ýÌa Á´ªÈÄÝç¼E¹©v×ÿQª½$¯š!;Ég~÷êÒà&uÙc<§O½ð¶)=¤,TO 9Î<­z$‰_Œ²SoS' is invalid [ 2028.225421] binder: 635:641 ioctl c0306201 20000600 returned -14 [ 2028.261100] encrypted_key: master key parameter '‰A*ÁAʦél÷9§ø¸ÃÈ×[¶û&miGNuƒÍÓ ƒ\FCQZ†(‡]o–XX$œg¦x.à! )Ï6× N‰ëºåb?—V½Ûyž‚@U6ü:ã´CÍ™´ýÌa Á´ªÈÄÝç¼E¹©v×ÿQª½$¯š!;Ég~÷êÒà&uÙc<§O½ð¶)=¤,TO 9Î<­z$‰_Œ²SoS' is invalid 19:21:18 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xffffff7f00000000) 19:21:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2028.411549] binder: send failed reply for transaction 5538 to 635:641 19:21:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}) [ 2028.454552] binder: undelivered TRANSACTION_COMPLETE 19:21:18 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000000)={{{@in6=@empty, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000100)=0xe8) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000180)={@rand_addr="9c318d3ef8d53c309accf527b3b6e037", @loopback, @ipv4={[], [], @local}, 0x5, 0x8, 0x9, 0x0, 0x1, 0x1000000, r1}) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2028.486841] binder: undelivered TRANSACTION_ERROR: 29201 [ 2028.534717] binder: undelivered TRANSACTION_ERROR: 29189 19:21:18 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000001c0)=0xf) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x983, 0x0) r2 = accept4(r1, &(0x7f0000000000)=@xdp, &(0x7f0000000100)=0xfffffe0c, 0x800) recvfrom$unix(r2, &(0x7f0000000340)=""/220, 0xdc, 0x100, &(0x7f0000000440)=@file={0x1, './file0\x00'}, 0x6e) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f00000000c0)=0x7, 0x4) ioctl$TIOCCBRK(r0, 0x5428) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000240)={0x0, 0x1ff, 0x9, 0x9, 0x5, 0x100000000, 0xffffffffffffff81, 0x2, {0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x400, 0x962, 0x200000000, 0x80, 0x3}}, &(0x7f0000000080)=0xb0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000000300)={r3, 0x9}, 0x8) 19:21:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}}) 19:21:18 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xffffffff00000000) 19:21:18 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x2) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) setsockopt(r0, 0xf4, 0x1e08, &(0x7f0000000040)="211b63bbbffa8a7bb12f01166c4436cb269cbbda10e8530c27d16ed57a0aeba5fd6e1c61f9746778c257a2592e43dfb20f1d943ef9b64ba4f37840730e3111ef04bce07db2e9758c08f9c1557a969a8d203ddbc3a4c5a815d4dfc7224e0eb184277d76d3175a6e556c9953cd8f2d45ba2c0879184f54d12ffc7716125914e45175b248a4bf8378ef3dbae5f75b2f27da2c7a1b216ace43830091008c366c389e", 0xa0) 19:21:18 executing program 3: syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) mq_notify(r1, &(0x7f00000001c0)={0x0, 0x2a, 0x4, @thr={&(0x7f0000000100), 0x0}}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@window={0x3, 0x7fffffff, 0xffffffff}, @mss={0x2, 0x3}, @window={0x3, 0xff, 0x1f69}, @window={0x3, 0x48, 0x8}], 0x4) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000040), 0xfffffffffffffea9) [ 2029.195460] binder: 697:701 got reply transaction with bad transaction stack, transaction 5541 has target 697:0 19:21:18 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}}) [ 2029.239976] binder: 697:701 transaction failed 29201/-71, size 0-0 line 2816 [ 2029.284637] binder: 697:701 ioctl c0306201 20000600 returned -14 19:21:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:19 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20}, {0x200000000000000, 0x4}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000}}) 19:21:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x4000) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e21, 0x1, @mcast2, 0x7}, {0xa, 0x4e23, 0x7, @empty, 0x5}, 0x8, [0x5, 0x3d, 0x2, 0x2dc, 0x1, 0xefb, 0x3fe00000, 0xffff]}, 0x5c) bind$alg(r0, &(0x7f0000001b80)={0x26, 'skcipher\x00', 0x0, 0x0, 'salsa20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000028c0)="b7f2288a933d66593ae164c990a0028e", 0x10) r2 = accept$alg(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vcan0\x00'}) write$binfmt_script(r2, &(0x7f0000000000)=ANY=[], 0xffffff29) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') recvmsg(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000002900)=""/4096, 0xfffffe6d}], 0x1, &(0x7f0000001400)=""/123, 0x7b}, 0x0) [ 2029.401101] binder: release 697:701 transaction 5541 out, still active [ 2029.412169] binder: undelivered TRANSACTION_COMPLETE [ 2029.457010] binder: undelivered TRANSACTION_ERROR: 29201 [ 2029.474147] binder: BINDER_SET_CONTEXT_MGR already set 19:21:19 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0xfffffffffffff000) [ 2029.520959] binder: 726:727 ioctl 40046207 0 returned -16 [ 2029.520995] binder_send_failed_reply: 3 callbacks suppressed [ 2029.521000] binder: send failed reply for transaction 5541, target dead [ 2029.567223] binder: 726:736 transaction failed 29189/-22, size 0-0 line 2896 19:21:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}}) [ 2029.614778] binder: 726:727 got reply transaction with no transaction stack 19:21:19 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2029.676168] binder: 726:727 transaction failed 29201/-71, size 0-0 line 2801 [ 2029.684536] binder: 726:727 ioctl c0306201 20000600 returned -14 19:21:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000}}) [ 2029.730450] binder: 726:736 ioctl c0306201 20000600 returned -14 19:21:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:19 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) [ 2029.840110] binder: release 726:736 transaction 5546 out, still active [ 2029.859408] binder: undelivered TRANSACTION_COMPLETE [ 2029.893086] binder: undelivered TRANSACTION_ERROR: 29201 [ 2029.929486] binder: undelivered TRANSACTION_ERROR: 29189 [ 2029.939021] binder: 760:764 got reply transaction with bad transaction stack, transaction 5548 has target 760:0 [ 2029.950534] binder: send failed reply for transaction 5546, target dead [ 2029.967982] binder: 760:764 transaction failed 29201/-71, size 0-0 line 2816 [ 2029.979045] binder: 760:764 ioctl c0306201 20000600 returned -14 [ 2030.057102] binder: release 760:764 transaction 5548 out, still active [ 2030.071293] binder: undelivered TRANSACTION_COMPLETE [ 2030.084817] binder: undelivered TRANSACTION_ERROR: 29201 [ 2030.099857] binder: send failed reply for transaction 5548, target dead 19:21:19 executing program 3: syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x10000014c) mq_notify(r1, &(0x7f00000001c0)={0x0, 0x2a, 0x4, @thr={&(0x7f0000000100), 0x0}}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@window={0x3, 0x7fffffff, 0xffffffff}, @mss={0x2, 0x3}, @window={0x3, 0xff, 0x1f69}, @window={0x3, 0x48, 0x8}], 0x4) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000000040), 0xfffffffffffffea9) 19:21:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3ffffff00000000}}) 19:21:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9400, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:19 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x208200, 0x0) ioctl$TIOCNXCL(r1, 0x540d) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) setsockopt$inet_dccp_int(r0, 0x21, 0xa, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0xde, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0xed) sendmmsg(r0, &(0x7f0000000240), 0x0, 0x800) 19:21:19 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) r0 = dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r2, 0x1d}}, 0x10) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r4, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) [ 2030.209815] binder: 776:779 got reply transaction with bad transaction stack, transaction 5551 has target 776:0 [ 2030.258250] binder: 776:779 transaction failed 29201/-71, size 0-0 line 2816 [ 2030.266548] binder: 776:779 ioctl c0306201 20000600 returned -14 [ 2030.354945] binder: release 776:779 transaction 5551 out, still active [ 2030.361698] binder: undelivered TRANSACTION_COMPLETE [ 2030.383575] binder: undelivered TRANSACTION_ERROR: 29201 19:21:20 executing program 2: pipe(&(0x7f00000005c0)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffffa, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) clock_gettime(0x0, &(0x7f00000043c0)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000004280)=[{{&(0x7f0000000080)=@pptp={0x18, 0x2, {0x0, @dev}}, 0x80, &(0x7f0000000180), 0x0, &(0x7f00000001c0)=""/64, 0x40}}, {{0x0, 0x0, &(0x7f0000002940)=[{0xfffffffffffffffd}], 0x1, &(0x7f00000029c0)=""/106, 0x6a}}], 0x2, 0x0, &(0x7f0000004400)={0x0, r2+10000000}) openat$cgroup_procs(r0, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) splice(r1, 0x0, r1, 0x0, 0x409, 0x1) 19:21:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000}}) 19:21:20 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x207100, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2030.414177] binder: send failed reply for transaction 5551, target dead 19:21:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}) 19:21:20 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) r0 = socket$inet6(0xa, 0x803, 0x3) setsockopt$inet6_dccp_int(r0, 0x21, 0x16, &(0x7f0000000000)=0x3f, 0x4) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r2, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) [ 2030.485168] binder: 802:805 got reply transaction with bad transaction stack, transaction 5554 has target 802:0 [ 2030.515760] binder: 802:805 transaction failed 29201/-71, size 0-0 line 2816 [ 2030.553098] binder: 802:805 ioctl c0306201 20000600 returned -14 19:21:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}) [ 2030.658226] binder: release 802:805 transaction 5554 out, still active [ 2030.672841] binder: undelivered TRANSACTION_COMPLETE [ 2030.718691] binder: undelivered TRANSACTION_ERROR: 29201 [ 2030.739288] binder: send failed reply for transaction 5554, target dead 19:21:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0x100000}) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000000)=ANY=[@ANYBLOB="420024f9"]) ioctl$KVM_NMI(r2, 0xae9a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000013000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000040)={0x1000, 0x1000}) ioctl$KVM_RUN(r1, 0xae80, 0x0) 19:21:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:20 executing program 1: r0 = socket$inet6(0xa, 0x2, 0xfffffffffffffffe) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000180)={0x0, {0x4, 0x8}}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x2}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x400000000005}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) getsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000080), &(0x7f00000000c0)=0x4) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x1, 0x151080) write$P9_RRENAMEAT(r2, &(0x7f0000000040)={0x7, 0x4b, 0x1}, 0x7) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000001c0)=0x0) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000000240)=r3) 19:21:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) 19:21:20 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) r0 = dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x7, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20020400}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x1c, r1, 0x820, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0xc010) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r2 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) bind$netlink(r3, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r4, 0x89fa, &(0x7f0000000080)={'sit0\x00', @ifru_map={0x7f, 0x4, 0x5, 0x80000001, 0x8001}}) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r5, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) [ 2031.164032] binder: 835:841 got reply transaction with bad transaction stack, transaction 5557 has target 835:0 [ 2031.215108] binder: 835:841 transaction failed 29201/-71, size 0-0 line 2816 [ 2031.247654] binder: 835:841 ioctl c0306201 20000600 returned -14 19:21:21 executing program 2: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video36\x00', 0x2, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xfffffffffffffff8, 0xf936a040ed38d914) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000040)=0x626) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000380)={0x0, 0xe, 0x4, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "5adbbd6f"}, 0x0, 0x0, @planes=0x0, 0x4}) 19:21:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) 19:21:21 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20c1, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:21 executing program 3: r0 = socket(0x10, 0x2, 0x0) sendto(r0, &(0x7f0000000300)="f3000000376bfb3fcd00000000a109474185a7cf52e0112a4328dd00f70461ca116320347b26537ef410d22215d18c0e063ede988aaa730b53b3a7974f02d88d873dfd620d4d522fcd3fef34a3b2f85a589b2d49b2335fb4125341bfea5eaa", 0xf2, 0x0, 0x0, 0xffffff8a) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0)=0x7, 0x4) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f0000000180)=""/85, 0x55}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/120, 0x78}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000280)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000000)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}}], 0x1, 0x6, &(0x7f0000003700)={0x77359400}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x105200, 0x0) ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000000200)={0x3, 0x400, 0xee83}) 19:21:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x50a000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2031.336245] binder: release 835:841 transaction 5557 out, still active 19:21:21 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) r0 = dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) r4 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000340)={r0, 0x10000, 0x1, r1}) sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x14, r4, 0x1, 0x70bd2d, 0x25dfdbfd, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x40000) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r5, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}, 0x82}], 0x40000000000017d, 0x0) [ 2031.383525] binder: undelivered TRANSACTION_COMPLETE 19:21:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) [ 2031.426954] binder: send failed reply for transaction 5557, target dead [ 2031.462500] binder: 866:867 got reply transaction with bad transaction stack, transaction 5560 has target 866:0 19:21:21 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x1be, &(0x7f0000000180)={&(0x7f00000000c0)=@getaddr={0x14, 0x16, 0x808, 0x70bd2c, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x8}) [ 2031.551079] binder: 866:867 transaction failed 29201/-71, size 0-0 line 2816 [ 2031.590245] binder: 866:867 ioctl c0306201 20000600 returned -14 19:21:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) 19:21:21 executing program 1: r0 = socket$inet6(0xa, 0x200000000800002, 0x3fffffeffffffffd) ioctl$KDGETKEYCODE(0xffffffffffffffff, 0x4b4c, &(0x7f0000000040)={0x100000000}) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000000), 0x0, 0x0) 19:21:21 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000001e0001000000000000000700020000002b341c1bdba5698bce2f427d5f0d6e177f299f313f79f084ee0984b22c6c697bb0823e1341706ae9322bfa02c171d5f15cd7aef04c739b7eb33b6cfd6d157f0e6f7cba46205484fbc3968792ee7deee3bc8b191be9a25a10ac6501d1a3db409b5a775517e408ddd9e831ef01c0ef732d47eb6f31fa1a379c912c7e0a24f047402e53071337342b87bd85ca5e5c28f76066fba9875b6843f8cfd865fb4ee3fb8299984e0bde884844cd33ab7ab03143c4166b3b0ea73c995fd98910ac892616d40cd85d61b5997740a9bd1c436b68d3879e72a352f9f40b94d83dcd7b2f1c4e"], 0xdf}}, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x19) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f00000000c0)={0x9, 0x400, 0x8001, 0x2, 0xfc8, 0x4, 0x8, 0x80000001, 0x0}, &(0x7f0000000140)=0x20) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0x18}, 0x4}}, 0x47b0, 0xd2b, 0x7fff, 0x5}, 0x98) 19:21:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x709000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:21 executing program 0: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) [ 2031.698824] binder: release 866:867 transaction 5560 out, still active [ 2031.717411] binder: undelivered TRANSACTION_COMPLETE 19:21:21 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) recvmsg$kcm(0xffffffffffffff9c, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0xffffffffffffff93, &(0x7f0000000340)=[{&(0x7f0000000080)=""/80, 0x50}, {&(0x7f0000000240)=""/249, 0xf9}, {&(0x7f0000000480)=""/25, 0xfffffed8}, {&(0x7f0000000180)=""/104, 0x68}], 0x4, &(0x7f0000000380)=""/125, 0x7d}, 0x140) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000440)) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2031.748363] binder: send failed reply for transaction 5560, target dead [ 2031.783842] binder: 898:899 got reply transaction with bad transaction stack, transaction 5563 has target 898:0 19:21:21 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2031.828710] binder: 898:899 transaction failed 29201/-71, size 0-0 line 2816 [ 2031.853457] binder: 898:899 ioctl c0306201 20000600 returned -14 [ 2031.946657] binder: release 898:899 transaction 5563 out, still active [ 2031.960333] binder: undelivered TRANSACTION_COMPLETE [ 2031.973245] binder: send failed reply for transaction 5563, target dead [ 2031.974453] net_ratelimit: 25 callbacks suppressed [ 2031.974461] protocol 88fb is buggy, dev hsr_slave_0 [ 2031.980137] protocol 88fb is buggy, dev hsr_slave_0 [ 2031.985021] protocol 88fb is buggy, dev hsr_slave_1 [ 2031.990006] protocol 88fb is buggy, dev hsr_slave_1 19:21:21 executing program 3: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) 19:21:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x80000000000a01, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000100)={r2, 0x3}) write$binfmt_aout(r0, &(0x7f0000000200)=ANY=[], 0xfffffffffffffe4a) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000140), 0x111, 0xa}}, 0x20) ioctl$TCFLSH(r0, 0x540b, 0x2) 19:21:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) 19:21:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x712000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 19:21:21 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x8000000000000000) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @local}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) 19:21:21 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) r0 = dup(0xffffffffffffffff) lstat(0x0, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f00000005c0)={0xa, 0x4, 0xfa00, {r2}}, 0xc) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) pipe2$9p(&(0x7f0000000000), 0x80000) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f00000004c0)={0x80000000, 0x106, "cb2353b55b63ebb3632123dca5c86d9df97cef165fdd7f268758e1c5ffd4df28", 0x6, 0x8, 0x0, 0x2, 0x5, 0x100, 0x1f, 0x80000001, [0x40, 0xffff, 0x1, 0x7]}) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) listxattr(0x0, 0x0, 0x2c9) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000040)=0x8000, 0x4) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x30}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x3, 0x0, 0xdffffffffffffffe}}, 0xe8) write$UHID_CREATE2(r4, &(0x7f0000000300)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009800ff0ffbffffff010000000100000004000000c8b17fdaf14e9e728a0c1044fc376a4968f66fbe4c6e925fb138d8f28683620495e4fe6de83daa7cc79154e08bedeeb84d5078196e41b03a76238a066c1ce08d50f796d25ef9edcad02ca8018a070452d066eeebbd9fd0a7e902bfc6d9fc58ab63af79068622417b8aad520c401dc63feeea5e2646719ca003ca43247e1c67d3728f3c7e13da6dad4b3391b5000000000000000000000000"], 0x1b0) sendmmsg(r6, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) [ 2032.226424] binder: 926:931 got reply transaction with bad transaction stack, transaction 5566 has target 926:0 [ 2032.256533] ================================================================== [ 2032.264307] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x396a/0x3f00 19:21:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) [ 2032.271522] Read of size 4 at addr ffff888085ddf3d0 by task syz-executor0/940 [ 2032.278800] [ 2032.280447] CPU: 1 PID: 940 Comm: syz-executor0 Not tainted 5.0.0-rc2+ #29 [ 2032.282336] binder: 926:931 ioctl c0306201 20000600 returned -14 [ 2032.287461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2032.287473] Call Trace: [ 2032.287496] dump_stack+0x1db/0x2d0 [ 2032.287521] ? dump_stack_print_info.cold+0x20/0x20 [ 2032.287541] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.287559] ? check_preemption_disabled+0x48/0x290 [ 2032.287575] ? xfrm_state_find+0x396a/0x3f00 [ 2032.287594] print_address_description.cold+0x7c/0x20d [ 2032.287610] ? xfrm_state_find+0x396a/0x3f00 [ 2032.287625] ? xfrm_state_find+0x396a/0x3f00 [ 2032.287641] kasan_report.cold+0x1b/0x40 [ 2032.347435] ? xfrm_state_find+0x396a/0x3f00 [ 2032.352045] __asan_report_load4_noabort+0x14/0x20 [ 2032.356989] xfrm_state_find+0x396a/0x3f00 [ 2032.361265] ? xfrm_state_afinfo_get_rcu+0x1b0/0x1b0 [ 2032.366390] ? __lock_acquire+0x572/0x4a30 [ 2032.370636] ? rcu_read_unlock_special+0x380/0x380 19:21:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) [ 2032.375574] ? rcu_softirq_qs+0x20/0x20 [ 2032.379570] ? mark_held_locks+0x100/0x100 [ 2032.383814] ? kernel_text_address+0x73/0xf0 [ 2032.388231] ? __kernel_text_address+0xd/0x40 [ 2032.392754] ? unwind_get_return_address+0x61/0xa0 [ 2032.397689] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.403326] ? print_usage_bug+0xd0/0xd0 [ 2032.407406] ? debug_smp_processor_id+0x1c/0x20 [ 2032.412085] ? perf_trace_lock+0x12f/0x750 [ 2032.416352] xfrm_tmpl_resolve+0x385/0xe00 [ 2032.420622] ? __xfrm_decode_session+0x140/0x140 19:21:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) [ 2032.425399] ? debug_smp_processor_id+0x1c/0x20 [ 2032.430100] ? perf_trace_lock+0x12f/0x750 [ 2032.434433] ? check_preemption_disabled+0x48/0x290 [ 2032.439458] ? do_raw_spin_trylock+0x270/0x270 [ 2032.444051] ? add_lock_to_list.isra.0+0x450/0x450 [ 2032.448999] xfrm_resolve_and_create_bundle+0x145/0x27f0 [ 2032.454472] ? xfrm_sk_policy_lookup+0x4ca/0x660 [ 2032.459650] ? find_held_lock+0x35/0x120 [ 2032.460167] cgroup: fork rejected by pids controller in /syz5 [ 2032.463716] ? xfrm_sk_policy_lookup+0x4ca/0x660 19:21:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f0000000080)={'bridge0\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) [ 2032.463747] ? xfrm_migrate+0x1a30/0x1a30 [ 2032.463764] ? lock_downgrade+0x910/0x910 [ 2032.463781] ? kasan_check_read+0x11/0x20 [ 2032.463797] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2032.463813] ? rcu_read_unlock_special+0x380/0x380 [ 2032.497050] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.502613] ? xfrm_sk_policy_lookup+0x4f1/0x660 [ 2032.507920] ? xfrm_selector_match+0xfc0/0xfc0 [ 2032.512520] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 2032.517555] xfrm_lookup_with_ifid+0x340/0x2a90 [ 2032.522233] ? xfrm_lookup_with_ifid+0x340/0x2a90 [ 2032.527086] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.532646] ? xfrm_policy_lookup+0x90/0x90 [ 2032.536979] ? rcu_read_unlock_special+0x380/0x380 [ 2032.541923] ? udp_sendmsg+0x8f0/0x3a40 [ 2032.545922] ? ip_route_output_key_hash+0x2b9/0x400 [ 2032.550953] ? ip_route_output_key_hash_rcu+0x3470/0x3470 [ 2032.556638] xfrm_lookup_route+0x3b/0x1f0 [ 2032.560798] ip_route_output_flow+0xad/0xc0 [ 2032.565130] udp_sendmsg+0x24cb/0x3a40 [ 2032.569028] ? ip_reply_glue_bits+0xc0/0xc0 [ 2032.573367] ? udp4_lib_lookup_skb+0x440/0x440 [ 2032.577961] ? add_lock_to_list.isra.0+0x450/0x450 [ 2032.582896] ? trace_hardirqs_on+0xbd/0x310 [ 2032.587226] ? check_preemption_disabled+0x48/0x290 [ 2032.592254] ? __lock_acquire+0x572/0x4a30 [ 2032.596501] ? perf_trace_lock+0x12f/0x750 [ 2032.600776] ? mark_held_locks+0x100/0x100 [ 2032.605034] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2032.609627] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.615171] ? check_preemption_disabled+0x48/0x290 [ 2032.620199] ? debug_smp_processor_id+0x1c/0x20 [ 2032.624871] ? perf_trace_lock+0x12f/0x750 [ 2032.629121] udpv6_sendmsg+0x1843/0x3570 [ 2032.633189] ? udpv6_sendmsg+0x1843/0x3570 [ 2032.637436] ? debug_smp_processor_id+0x1c/0x20 [ 2032.642131] ? perf_trace_lock+0x12f/0x750 [ 2032.646374] ? debug_smp_processor_id+0x1c/0x20 [ 2032.651067] ? udp6_unicast_rcv_skb.isra.0+0x2f0/0x2f0 [ 2032.656354] ? release_sock+0x1e8/0x2b0 [ 2032.660344] ? find_held_lock+0x35/0x120 [ 2032.664420] ? release_sock+0x1e8/0x2b0 [ 2032.668405] ? __local_bh_enable_ip+0x15a/0x270 [ 2032.673088] ? __local_bh_enable_ip+0x15a/0x270 [ 2032.677788] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2032.682375] ? trace_hardirqs_on+0xbd/0x310 [ 2032.686705] ? _raw_spin_unlock_bh+0x31/0x40 [ 2032.691140] ? trace_hardirqs_off_caller+0x300/0x300 [ 2032.696256] ? do_raw_spin_unlock+0xa0/0x330 [ 2032.700685] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.706242] ? check_preemption_disabled+0x48/0x290 [ 2032.711265] ? do_raw_spin_trylock+0x270/0x270 [ 2032.715856] ? release_sock+0x1e8/0x2b0 [ 2032.719852] ? __local_bh_enable_ip+0x15a/0x270 [ 2032.724530] ? _raw_spin_unlock_bh+0x31/0x40 19:21:22 executing program 3: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) 19:21:22 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast1, 0x1}, 0x28e2a78c09c7da7a) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x3) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) [ 2032.728945] ? release_sock+0x1e8/0x2b0 [ 2032.732934] ? __release_sock+0x3a0/0x3a0 [ 2032.737099] ? udp_v6_get_port+0x276/0x670 [ 2032.741351] inet_sendmsg+0x1af/0x740 [ 2032.745154] ? udp6_unicast_rcv_skb.isra.0+0x2f0/0x2f0 [ 2032.750435] ? inet_sendmsg+0x1af/0x740 [ 2032.754898] ? ipip_gro_receive+0x100/0x100 [ 2032.759229] ? apparmor_socket_sendmsg+0x2a/0x30 [ 2032.764078] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.769622] ? security_socket_sendmsg+0x93/0xc0 [ 2032.774387] ? ipip_gro_receive+0x100/0x100 [ 2032.778738] sock_sendmsg+0xdd/0x130 [ 2032.782463] ___sys_sendmsg+0x409/0x910 [ 2032.786454] ? copy_msghdr_from_user+0x570/0x570 [ 2032.791224] ? iterate_fd+0x4b0/0x4b0 [ 2032.795046] ? kasan_check_read+0x11/0x20 [ 2032.799202] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.804762] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.810320] ? check_preemption_disabled+0x48/0x290 [ 2032.815378] ? __might_fault+0x12b/0x1e0 [ 2032.819497] ? __fdget+0x1b/0x20 [ 2032.822872] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 19:21:22 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5, 0xfffffffffffffffc, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f0000000240), 0x5c3, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000000)={{0xa, 0x4e21, 0x3a8b293c, @remote, 0x5d}, {0xa, 0x4e21, 0x6, @rand_addr="e9d7bd75b9357d59b3f534fe1c04e443", 0x8}, 0x3, [0xf37d, 0x0, 0x5, 0x5, 0x5, 0x7f, 0x8]}, 0x5c) [ 2032.828421] ? sockfd_lookup_light+0xc2/0x160 [ 2032.832927] __sys_sendmmsg+0x246/0x730 [ 2032.836916] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 2032.841263] ? _copy_to_user+0xc9/0x120 [ 2032.845252] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2032.850805] ? put_timespec64+0x115/0x1b0 [ 2032.854963] ? nsecs_to_jiffies+0x30/0x30 [ 2032.859120] ? do_syscall_64+0x8c/0x800 [ 2032.863115] ? do_syscall_64+0x8c/0x800 [ 2032.867101] ? trace_hardirqs_on+0xbd/0x310 [ 2032.871432] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2032.876982] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2032.882355] ? trace_hardirqs_off_caller+0x300/0x300 [ 2032.887478] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2032.893029] __x64_sys_sendmmsg+0x9d/0x100 [ 2032.897281] do_syscall_64+0x1a3/0x800 [ 2032.901289] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2032.906234] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 2032.911262] ? __switch_to_asm+0x34/0x70 [ 2032.915341] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2032.920222] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2032.925414] RIP: 0033:0x458099 [ 2032.928615] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2032.947887] RSP: 002b:00007f82f3f05c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2032.955605] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458099 [ 2032.962885] RDX: 0000000000000001 RSI: 0000000020000a80 RDI: 0000000000000009 [ 2032.970161] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2032.977432] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82f3f066d4 [ 2032.984733] R13: 00000000004c4f7c R14: 00000000004d8a40 R15: 00000000ffffffff [ 2032.992034] [ 2032.993657] The buggy address belongs to the page: [ 2032.998671] page:ffffea00021777c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 [ 2033.004090] binder: release 926:931 transaction 5566 out, still active [ 2033.006816] flags: 0x1fffc0000000000() [ 2033.006835] raw: 01fffc0000000000 0000000000000000 ffffffff02170101 0000000000000000 [ 2033.006851] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 2033.006858] page dumped because: kasan: bad access detected [ 2033.006866] [ 2033.013787] binder: undelivered TRANSACTION_COMPLETE [ 2033.017392] Memory state around the buggy address: [ 2033.017404] ffff888085ddf280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 2033.017415] ffff888085ddf300: f1 f1 f1 f1 00 00 00 f2 f2 f2 00 00 00 00 00 f2 [ 2033.017425] >ffff888085ddf380: f2 f2 f2 f2 00 00 00 00 00 00 f2 f2 f2 f2 00 00 [ 2033.017432] ^ [ 2033.017443] ffff888085ddf400: 00 00 00 00 f2 f2 f2 f2 00 00 f8 f2 f2 f2 00 00 [ 2033.017458] ffff888085ddf480: 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 [ 2033.017465] ================================================================== [ 2033.034574] binder: send failed reply for transaction 5566, target dead [ 2033.038890] Disabling lock debugging due to kernel taint [ 2033.112813] protocol 88fb is buggy, dev hsr_slave_0 [ 2033.114771] protocol 88fb is buggy, dev hsr_slave_0 [ 2033.117897] protocol 88fb is buggy, dev hsr_slave_1 19:21:22 executing program 3: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000f68000)={@loopback}, 0x20) dup(0xffffffffffffffff) lstat(0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$inet6(0xa, 0x803, 0x3) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$RTC_VL_CLR(0xffffffffffffffff, 0x7014) socket$inet6(0xa, 0x0, 0x0) ioctl$SIOCGETLINKNAME(0xffffffffffffffff, 0x89e0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0xa, @in6, 0x0, 0x1, 0x0, 0xdffffffffffffffe}}, 0xe8) sendmmsg(r3, &(0x7f0000000a80)=[{{&(0x7f0000000100)=@in={0x2, 0xc67a}, 0x80, 0x0}}], 0x1, 0x0) 19:21:22 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x0) 19:21:22 executing program 2: pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x4002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) lseek(r1, 0xffffffffffffffff, 0x9) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$rds(r1, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0xffffffffffffff1d) read(r0, &(0x7f0000000200)=""/250, 0x78000) msgctl$IPC_RMID(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x3, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x25, 0x4c}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x220000, 0x0) getsockopt$sock_buf(r1, 0x1, 0x37, &(0x7f0000000300)=""/190, &(0x7f0000000100)=0xbe) gettid() ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000140)) 19:21:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x44, 0x0, &(0x7f0000000380)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x740000, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) [ 2033.122896] protocol 88fb is buggy, dev hsr_slave_1 [ 2033.127947] protocol 88fb is buggy, dev hsr_slave_0 [ 2033.137936] protocol 88fb is buggy, dev hsr_slave_1 [ 2033.181185] cgroup: fork rejected by pids controller in /syz1 [ 2033.214970] binder: 974:975 got reply transaction with bad transaction stack, transaction 5569 has target 974:0 [ 2033.238612] binder_transaction: 1 callbacks suppressed [ 2033.238629] binder: 974:975 transaction failed 29201/-71, size 0-0 line 2816 [ 2033.259514] Kernel panic - not syncing: panic_on_warn set ... [ 2033.265528] CPU: 0 PID: 940 Comm: syz-executor0 Tainted: G B 5.0.0-rc2+ #29 [ 2033.273944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2033.274480] binder: 974:975 ioctl c0306201 20000600 returned -14 [ 2033.283387] Call Trace: [ 2033.283424] dump_stack+0x1db/0x2d0 [ 2033.283440] ? dump_stack_print_info.cold+0x20/0x20 [ 2033.283461] panic+0x2cb/0x65c [ 2033.303967] ? add_taint.cold+0x16/0x16 [ 2033.307950] ? xfrm_state_find+0x396a/0x3f00 [ 2033.312464] ? preempt_schedule+0x4b/0x60 [ 2033.316615] ? ___preempt_schedule+0x16/0x18 [ 2033.321033] ? trace_hardirqs_on+0xb4/0x310 [ 2033.325360] ? xfrm_state_find+0x396a/0x3f00 [ 2033.329771] end_report+0x47/0x4f [ 2033.333223] ? xfrm_state_find+0x396a/0x3f00 [ 2033.337635] kasan_report.cold+0xe/0x40 [ 2033.338001] binder: release 974:975 transaction 5569 out, still active [ 2033.341872] ? xfrm_state_find+0x396a/0x3f00 [ 2033.341888] __asan_report_load4_noabort+0x14/0x20 [ 2033.341902] xfrm_state_find+0x396a/0x3f00 [ 2033.351153] kobject: 'loop4' (000000000a1f2ad1): kobject_uevent_env [ 2033.352963] ? xfrm_state_afinfo_get_rcu+0x1b0/0x1b0 [ 2033.360708] kobject: 'loop4' (000000000a1f2ad1): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 2033.362076] ? __lock_acquire+0x572/0x4a30 [ 2033.362094] ? rcu_read_unlock_special+0x380/0x380 [ 2033.371151] binder: undelivered TRANSACTION_COMPLETE [ 2033.373561] ? rcu_softirq_qs+0x20/0x20 [ 2033.373582] ? mark_held_locks+0x100/0x100 [ 2033.398190] binder_release_work: 4 callbacks suppressed [ 2033.398196] binder: undelivered TRANSACTION_ERROR: 29201 [ 2033.401195] ? kernel_text_address+0x73/0xf0 [ 2033.401210] ? __kernel_text_address+0xd/0x40 [ 2033.422022] binder: send failed reply for transaction 5569, target dead [ 2033.425207] ? unwind_get_return_address+0x61/0xa0 [ 2033.425222] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.425238] ? print_usage_bug+0xd0/0xd0 [ 2033.446440] ? debug_smp_processor_id+0x1c/0x20 [ 2033.451094] ? perf_trace_lock+0x12f/0x750 [ 2033.455333] xfrm_tmpl_resolve+0x385/0xe00 [ 2033.459560] ? __xfrm_decode_session+0x140/0x140 [ 2033.464304] ? debug_smp_processor_id+0x1c/0x20 [ 2033.468994] ? perf_trace_lock+0x12f/0x750 [ 2033.473232] ? check_preemption_disabled+0x48/0x290 [ 2033.478233] ? do_raw_spin_trylock+0x270/0x270 [ 2033.482820] ? add_lock_to_list.isra.0+0x450/0x450 [ 2033.487731] xfrm_resolve_and_create_bundle+0x145/0x27f0 [ 2033.493168] ? xfrm_sk_policy_lookup+0x4ca/0x660 [ 2033.497907] ? find_held_lock+0x35/0x120 [ 2033.501976] ? xfrm_sk_policy_lookup+0x4ca/0x660 [ 2033.506723] ? xfrm_migrate+0x1a30/0x1a30 [ 2033.510868] ? lock_downgrade+0x910/0x910 [ 2033.515003] ? kasan_check_read+0x11/0x20 [ 2033.519153] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 2033.524415] ? rcu_read_unlock_special+0x380/0x380 [ 2033.529334] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.534866] ? xfrm_sk_policy_lookup+0x4f1/0x660 [ 2033.539610] ? xfrm_selector_match+0xfc0/0xfc0 [ 2033.544179] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 2033.549188] xfrm_lookup_with_ifid+0x340/0x2a90 [ 2033.553844] ? xfrm_lookup_with_ifid+0x340/0x2a90 [ 2033.558681] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.564210] ? xfrm_policy_lookup+0x90/0x90 [ 2033.568973] ? rcu_read_unlock_special+0x380/0x380 [ 2033.574003] ? udp_sendmsg+0x8f0/0x3a40 [ 2033.577971] ? ip_route_output_key_hash+0x2b9/0x400 [ 2033.582975] ? ip_route_output_key_hash_rcu+0x3470/0x3470 [ 2033.588514] xfrm_lookup_route+0x3b/0x1f0 [ 2033.592677] ip_route_output_flow+0xad/0xc0 [ 2033.597004] udp_sendmsg+0x24cb/0x3a40 [ 2033.600878] ? ip_reply_glue_bits+0xc0/0xc0 [ 2033.605195] ? udp4_lib_lookup_skb+0x440/0x440 [ 2033.609762] ? add_lock_to_list.isra.0+0x450/0x450 [ 2033.614679] ? trace_hardirqs_on+0xbd/0x310 [ 2033.619000] ? check_preemption_disabled+0x48/0x290 [ 2033.624003] ? __lock_acquire+0x572/0x4a30 [ 2033.628222] ? perf_trace_lock+0x12f/0x750 [ 2033.632450] ? mark_held_locks+0x100/0x100 [ 2033.636762] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2033.641339] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.646866] ? check_preemption_disabled+0x48/0x290 [ 2033.651869] ? debug_smp_processor_id+0x1c/0x20 [ 2033.656522] ? perf_trace_lock+0x12f/0x750 [ 2033.660748] udpv6_sendmsg+0x1843/0x3570 [ 2033.664808] ? udpv6_sendmsg+0x1843/0x3570 [ 2033.669027] ? debug_smp_processor_id+0x1c/0x20 [ 2033.673680] ? perf_trace_lock+0x12f/0x750 [ 2033.677899] ? debug_smp_processor_id+0x1c/0x20 [ 2033.682590] ? udp6_unicast_rcv_skb.isra.0+0x2f0/0x2f0 [ 2033.687858] ? release_sock+0x1e8/0x2b0 [ 2033.691816] ? find_held_lock+0x35/0x120 [ 2033.695865] ? release_sock+0x1e8/0x2b0 [ 2033.699848] ? __local_bh_enable_ip+0x15a/0x270 [ 2033.704513] ? __local_bh_enable_ip+0x15a/0x270 [ 2033.709170] ? lockdep_hardirqs_on+0x415/0x5d0 [ 2033.713751] ? trace_hardirqs_on+0xbd/0x310 [ 2033.718082] ? _raw_spin_unlock_bh+0x31/0x40 [ 2033.722483] ? trace_hardirqs_off_caller+0x300/0x300 [ 2033.727569] ? do_raw_spin_unlock+0xa0/0x330 [ 2033.731962] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.737485] ? check_preemption_disabled+0x48/0x290 [ 2033.742485] ? do_raw_spin_trylock+0x270/0x270 [ 2033.747057] ? release_sock+0x1e8/0x2b0 [ 2033.751026] ? __local_bh_enable_ip+0x15a/0x270 [ 2033.755689] ? _raw_spin_unlock_bh+0x31/0x40 [ 2033.760092] ? release_sock+0x1e8/0x2b0 [ 2033.764053] ? __release_sock+0x3a0/0x3a0 [ 2033.768188] ? udp_v6_get_port+0x276/0x670 [ 2033.772413] inet_sendmsg+0x1af/0x740 [ 2033.776200] ? udp6_unicast_rcv_skb.isra.0+0x2f0/0x2f0 [ 2033.781468] ? inet_sendmsg+0x1af/0x740 [ 2033.785433] ? ipip_gro_receive+0x100/0x100 [ 2033.789742] ? apparmor_socket_sendmsg+0x2a/0x30 [ 2033.794485] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.800009] ? security_socket_sendmsg+0x93/0xc0 [ 2033.804755] ? ipip_gro_receive+0x100/0x100 [ 2033.809066] sock_sendmsg+0xdd/0x130 [ 2033.812780] ___sys_sendmsg+0x409/0x910 [ 2033.816748] ? copy_msghdr_from_user+0x570/0x570 [ 2033.821576] ? iterate_fd+0x4b0/0x4b0 [ 2033.825367] ? kasan_check_read+0x11/0x20 [ 2033.829499] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.835027] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.840550] ? check_preemption_disabled+0x48/0x290 [ 2033.845575] ? __might_fault+0x12b/0x1e0 [ 2033.849639] ? __fdget+0x1b/0x20 [ 2033.853000] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2033.858525] ? sockfd_lookup_light+0xc2/0x160 [ 2033.863007] __sys_sendmmsg+0x246/0x730 [ 2033.866975] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 2033.871393] ? _copy_to_user+0xc9/0x120 [ 2033.875356] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2033.880882] ? put_timespec64+0x115/0x1b0 [ 2033.885023] ? nsecs_to_jiffies+0x30/0x30 [ 2033.889169] ? do_syscall_64+0x8c/0x800 [ 2033.893130] ? do_syscall_64+0x8c/0x800 [ 2033.897100] ? trace_hardirqs_on+0xbd/0x310 [ 2033.901410] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2033.906937] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2033.912289] ? trace_hardirqs_off_caller+0x300/0x300 [ 2033.917378] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2033.922908] __x64_sys_sendmmsg+0x9d/0x100 [ 2033.927129] do_syscall_64+0x1a3/0x800 [ 2033.931010] ? syscall_return_slowpath+0x5f0/0x5f0 [ 2033.935927] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 2033.940932] ? __switch_to_asm+0x34/0x70 [ 2033.944981] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 2033.949813] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2033.954989] RIP: 0033:0x458099 [ 2033.958170] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2033.977055] RSP: 002b:00007f82f3f05c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2033.984750] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458099 [ 2033.992002] RDX: 0000000000000001 RSI: 0000000020000a80 RDI: 0000000000000009 [ 2033.999268] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 2034.006531] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82f3f066d4 [ 2034.013787] R13: 00000000004c4f7c R14: 00000000004d8a40 R15: 00000000ffffffff [ 2034.022335] Kernel Offset: disabled [ 2034.025960] Rebooting in 86400 seconds..