f0000001540)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}], 0x20, 0x4000000}, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x2) clone(0x10000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r6 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x9, 0x200) wait4(r3, &(0x7f00000015c0), 0x8, &(0x7f0000001600)) setsockopt$inet_mreqsrc(r6, 0x0, 0x28, &(0x7f0000000100)={@multicast2, @multicast1, @local}, 0xc) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x28000, 0x440082) accept4$vsock_stream(r7, &(0x7f0000000040)={0x28, 0x0, 0x2711}, 0x10, 0x80800) [ 661.360473] binder: 28600:28607 ioctl 40046207 0 returned -16 [ 661.399185] binder: undelivered TRANSACTION_ERROR: 29201 16:05:40 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x3}, @addr={0x5, 0x7ff}}], 0x30) 16:05:40 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xec0}, 0x0) 16:05:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x8000000000000000]}}], 0x0, 0x0, 0x0}) 16:05:40 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0x1) 16:05:40 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x4}, @addr={0x5, 0x7ff}}], 0x30) 16:05:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf00}, 0x0) [ 661.645825] binder: 28641:28642 got transaction with invalid offset (-9223372036854775808, min 0 max 24) or object. 16:05:41 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0x1) 16:05:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400203) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 661.753539] binder: 28641:28642 transaction failed 29201/-22, size 24-8 line 3097 [ 661.849713] binder: BINDER_SET_CONTEXT_MGR already set 16:05:41 executing program 5: perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=0x0, &(0x7f0000000140)=0x4) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000001c0)={r1, 0x4ebe}, &(0x7f0000000200)=0x8) getsockopt(0xffffffffffffffff, 0x3f, 0xb9, &(0x7f0000000140), &(0x7f0000000180)) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlockall() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, 0x0, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, 0x0) 16:05:41 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x5}, @addr={0x5, 0x7ff}}], 0x30) [ 661.873195] binder: 28641:28642 ioctl 40046207 0 returned -16 [ 661.892812] binder: undelivered TRANSACTION_ERROR: 29201 16:05:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x5865}, 0x0) 16:05:41 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(0x0, 0x6004, 0x1) 16:05:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0xfdfdffff00000000]}}], 0x0, 0x0, 0x0}) 16:05:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x20000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 662.087885] binder: 28669:28670 got transaction with invalid offset (-144678142324244480, min 0 max 24) or object. 16:05:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f00000000c0)={0x0, {0x2, 0x4e22, @local}, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xa, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000040)='bpq0\x00', 0x0, 0x7, 0x2a49}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x6000}, 0x0) 16:05:41 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x8}, @addr={0x5, 0x7ff}}], 0x30) [ 662.162489] binder: 28669:28670 transaction failed 29201/-22, size 24-8 line 3097 16:05:41 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(0x0, 0x6004, 0x1) [ 662.242860] binder_alloc_mmap_handler: 1 callbacks suppressed [ 662.242878] binder_alloc: binder_alloc_mmap_handler: 28669 20001000-20004000 already mapped failed -16 16:05:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x101201, 0x0) connect$l2tp(r3, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e20, @multicast1}, 0x2, 0x1, 0x4, 0x4}}, 0x2e) 16:05:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x6558}, 0x0) [ 662.425735] binder: BINDER_SET_CONTEXT_MGR already set [ 662.440683] binder: 28669:28670 ioctl 40046207 0 returned -16 16:05:42 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x2, 0x2) tkill(r0, 0x2a) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x2000000000084, 0x0, 0xca}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) clone(0x0, 0x0, 0x0, 0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 16:05:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x42}, @addr={0x5, 0x7ff}}], 0x30) 16:05:42 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(0x0, 0x6004, 0x1) 16:05:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0xffffffff00000000]}}], 0x0, 0x0, 0x0}) 16:05:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x8100}, 0x0) 16:05:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x9904}, 0x0) 16:05:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xbf}, @addr={0x5, 0x7ff}}], 0x30) 16:05:42 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) r1 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) accept4$unix(r1, &(0x7f0000000140)=@abs, &(0x7f0000000080)=0x6e, 0x800) fsync(r1) [ 663.003371] binder: 28704:28709 got transaction with invalid offset (-4294967296, min 0 max 24) or object. [ 663.038066] binder: 28704:28709 transaction failed 29201/-22, size 24-8 line 3097 16:05:42 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0x1) [ 663.108216] binder_alloc: binder_alloc_mmap_handler: 28704 20001000-20004000 already mapped failed -16 16:05:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x1a0}, @addr={0x5, 0x7ff}}], 0x30) [ 663.178134] binder: BINDER_SET_CONTEXT_MGR already set [ 663.237011] binder: 28704:28709 ioctl 40046207 0 returned -16 [ 663.269079] binder_alloc: 28704: binder_alloc_buf, no vma [ 663.271177] binder_release_work: 1 callbacks suppressed [ 663.271184] binder: undelivered TRANSACTION_ERROR: 29201 [ 663.294939] binder: 28704:28709 transaction failed 29189/-3, size 24-8 line 3035 [ 663.340940] binder: undelivered TRANSACTION_ERROR: 29189 16:05:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xc00e}, 0x0) 16:05:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x300}, @addr={0x5, 0x7ff}}], 0x30) 16:05:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2, 0x0, 0x0}) 16:05:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x4000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf000}, 0x0) [ 663.520408] binder: 28733:28735 ioctl c0306201 200003c0 returned -14 16:05:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x500}, @addr={0x5, 0x7ff}}], 0x30) 16:05:42 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0x1) [ 663.583444] binder_alloc: binder_alloc_mmap_handler: 28733 20001000-20004000 already mapped failed -16 [ 663.660303] binder: BINDER_SET_CONTEXT_MGR already set [ 663.665637] binder: 28733:28735 ioctl 40046207 0 returned -16 16:05:43 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x34000}, 0x0) 16:05:43 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x4200}, @addr={0x5, 0x7ff}}], 0x30) [ 663.743277] binder: release 28733:28735 transaction 1432 out, still active [ 663.765602] binder: undelivered TRANSACTION_COMPLETE [ 663.779160] binder: send failed reply for transaction 1432, target dead [ 663.950735] device bridge_slave_1 left promiscuous mode [ 663.956290] bridge0: port 2(bridge_slave_1) entered disabled state [ 664.041323] device bridge_slave_0 left promiscuous mode [ 664.046774] bridge0: port 1(bridge_slave_0) entered disabled state [ 664.192640] device hsr_slave_1 left promiscuous mode [ 664.245877] device hsr_slave_0 left promiscuous mode [ 664.305882] team0 (unregistering): Port device team_slave_1 removed [ 664.316908] team0 (unregistering): Port device team_slave_0 removed [ 664.327695] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 664.366131] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 664.439114] bond0 (unregistering): Released all slaves [ 664.767338] IPVS: ftp: loaded support on port[0] = 21 16:05:44 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0x1) 16:05:44 executing program 5: r0 = socket$bt_cmtp(0x1f, 0x3, 0x5) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x2201, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000100)=0xfb) open_by_handle_at(r0, &(0x7f0000000000)={0xa2, 0x20000000001, "951b271a7e4531dcc3628ccd466116b9b585c244227627913de526df26cf6563910c86145d1670e9f5909ed4dae2e52009e7be82d2d1fe7cf4e39615c1266b83fca761188dcfd053208556d745d93bb8746ddfab0364fdf37dbeb27b6ccd6f5d37a1efba7268de0ac36114fb1cb7e33e5a518972aca2d24b359297fc2c628970651397bf77ed4c91325dfef9ad00000000000000000000000000"}, 0x2f64) 16:05:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x12, 0x0, 0x0}) 16:05:44 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x400300}, 0x0) 16:05:44 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xbf00}, @addr={0x5, 0x7ff}}], 0x30) 16:05:44 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf0ffff}, 0x0) [ 664.917034] binder: 28761:28766 ioctl c0306201 200003c0 returned -14 [ 664.978825] binder_alloc: binder_alloc_mmap_handler: 28761 20001000-20004000 already mapped failed -16 [ 664.978956] binder: BINDER_SET_CONTEXT_MGR already set [ 665.068979] binder: release 28761:28766 transaction 1436 out, still active [ 665.099566] binder: 28761:28766 ioctl 40046207 0 returned -16 [ 665.110430] binder: undelivered TRANSACTION_COMPLETE [ 665.115651] binder: send failed reply for transaction 1436, target dead [ 665.194012] chnl_net:caif_netlink_parms(): no params data found [ 665.272494] IPVS: ftp: loaded support on port[0] = 21 [ 665.343130] bridge0: port 1(bridge_slave_0) entered blocking state [ 665.350584] bridge0: port 1(bridge_slave_0) entered disabled state [ 665.357955] device bridge_slave_0 entered promiscuous mode [ 665.368495] bridge0: port 2(bridge_slave_1) entered blocking state [ 665.375591] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.383351] device bridge_slave_1 entered promiscuous mode [ 665.411321] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 665.432533] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 665.521445] team0: Port device team_slave_0 added [ 665.527950] team0: Port device team_slave_1 added [ 665.574384] chnl_net:caif_netlink_parms(): no params data found [ 665.642334] device hsr_slave_0 entered promiscuous mode [ 665.699331] device hsr_slave_1 entered promiscuous mode [ 665.822347] bridge0: port 1(bridge_slave_0) entered blocking state [ 665.829138] bridge0: port 1(bridge_slave_0) entered disabled state [ 665.836539] device bridge_slave_0 entered promiscuous mode [ 665.855041] bridge0: port 2(bridge_slave_1) entered blocking state [ 665.861658] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.869399] device bridge_slave_1 entered promiscuous mode [ 665.916596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 665.926709] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 665.937739] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 665.974362] 8021q: adding VLAN 0 to HW filter on device team0 [ 665.989003] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 665.996141] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 666.020061] team0: Port device team_slave_0 added [ 666.026504] team0: Port device team_slave_1 added [ 666.034132] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 666.042573] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 666.057933] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.064348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 666.072348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 666.080559] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 666.088212] bridge0: port 2(bridge_slave_1) entered blocking state [ 666.094625] bridge0: port 2(bridge_slave_1) entered forwarding state [ 666.102114] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 666.110427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 666.147580] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 666.156823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 666.173438] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 666.185517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 666.198143] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 666.206315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 666.214341] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 666.225637] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 666.236525] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 666.272801] device hsr_slave_0 entered promiscuous mode [ 666.318981] device hsr_slave_1 entered promiscuous mode [ 666.388648] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 666.396640] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 666.404446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 666.430477] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 666.531010] binder: 28780:28784 ioctl 4b47 20000180 returned -22 [ 666.537260] 8021q: adding VLAN 0 to HW filter on device bond0 [ 666.556276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 666.565301] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 666.576113] 8021q: adding VLAN 0 to HW filter on device team0 [ 666.586616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 666.594507] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.600913] bridge0: port 1(bridge_slave_0) entered forwarding state [ 666.608107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 666.625704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 666.633535] bridge0: port 2(bridge_slave_1) entered blocking state [ 666.639960] bridge0: port 2(bridge_slave_1) entered forwarding state [ 666.661076] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 666.669836] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 666.686106] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 666.697204] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 666.710186] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 666.717358] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 666.726133] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 666.747745] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 666.755720] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 666.823452] Unknown ioctl 1074024961 [ 666.829199] Unknown ioctl 1074024961 16:05:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create(0x7) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:46 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x1000000}, @addr={0x5, 0x7ff}}], 0x30) 16:05:46 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:05:46 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x1000000}, 0x0) 16:05:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x14, 0x0, 0x0}) 16:05:46 executing program 5: r0 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000240)={0x0, 0x9, 0x1, {0xb, @pix={0x0, 0xffffffff00000001}}}) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000000)={0xb, 0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f00000000c0)={0x4, 0x2, [{0xf8, 0x0, 0x5}, {0x7, 0x0, 0x400}, {0x8001, 0x0, 0xee}, {0xfffffffffffffc01, 0x0, 0x1000}]}) dup3(r1, r2, 0x8000000000008000) dup3(r1, r2, 0x0) [ 667.378175] binder: 28796:28799 ioctl c0306201 200003c0 returned -14 16:05:46 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x2000000}, @addr={0x5, 0x7ff}}], 0x30) [ 667.418603] binder_alloc: binder_alloc_mmap_handler: 28796 20001000-20004000 already mapped failed -16 16:05:46 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x2000000}, 0x0) 16:05:46 executing program 5: setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x503af14019914d9c) perf_event_open(&(0x7f000001d000)={0x1, 0xff47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kexec_load(0x4d3, 0x3, &(0x7f0000000240)=[{&(0x7f0000000000)="7968ff688a1ca136c3fd5f1a238b5fdec7470442ca45d3143b96134e430908dbce0cb5b77f7b27a94bdfa8b65455490a49234198ab01ab9e117dbd95a71aee4de0a23115da1b5a5f43d2d590c499097aa3cf71fd6dfd2f3107fedbb66266ff7a29ec51ec35b8bb74ca5f4518b1e09d2d6748e8361d0ac45ad3b7a22e", 0x7c, 0x7, 0x1f}, {&(0x7f0000000080)="14f54d82dc757295ffaf52d00e13e6fc00c35229fa27a37d82c5", 0x1a, 0x7, 0x9}, {&(0x7f0000000600)="1ed524fe9395953f5eb1dc47e1ad40ca9a48bbb275ab17701e0419e7e583a1159505ff622d890094cb71d5c54c279a53d0543a439e214a360837cd728129cd55245824f929c9ba1d0fea75fbe66632202951cc08cc388dfa88de1d1074fdc6eecb0ff3a1f93c4ec047961290e1932d1a3ccb99c0ff2a22f1143978cda39a62a02079c4c49c538c595e0dc955c66739262647873e06d7ae6d2717210e241fae34eabea1002788ed204ea90366003b7f2a691cce5ee54b3825729d10b2023fb455e3bd2ca5591e5c92ef5d6485d2adf6bba3ff4262649f195c6515e345634400f2a6827c1a3f15fd6817ce68d98ce399140fd2708ead669ffd51dbb72e3d1e9f8d79482b0c8dab3eb2059823d46a3044230b8059e7e65f790b8d098594a4c35206d57674f39fe81dcb89000fb135858571d3a0844383dccd2db71faf9d88ae6fbed2c45b1bf375f144c71d4f11cba8e8539a9c3b5dcc61224570c8fe6785ca7c8ae7a51969b14b1cb412679266884754aff774172b1dd053563001757d67ff880c6c39b4a7fe5bb85328566244ee96a33495901302e99e3b5b9114c253c48304bdaccdfd06167b9d4868044c0866f3ab16b16326a069b2a48e5612a6628123c7de093164d2a1af900c3aad3323014648bd30b2cae15dd899833b3a3c0c3b260240c6ec2283fb10a0c4fa7693a1db0b5fef408624ae2f1a3057c85ba03e6a507da38eb2a1e28c1a64ce2e58da92e49f859e08a2357df9c264fa27cff769ec1b10e25172c9411d036a3d6661c028c24b3442ecf3892766979bd89ca31405ffb862fae4689f349553ebe013b31f72f0b1a99761504721a35f65720b16edc90747810729bf9acef361a180f64c0fdf15c69416d3a2578f14c8bb3bb82b4f77e92a5ceab5f6d744b41e651fc806c7c2a402535860a67c52c94992c08af6c9e36dbcecc88cba893ccba3bc4a450610a9b9f7a32d0f79d5c93ea47625278515c1052ce27626a40420ddb773ec2469a287f6ae3e03aaa2f164fdc3a1a546b37bd7bd64e76936f5776734e932f791058f0274744d29874d2b295ba97ec7dc1c84b7c0893f49ade1874b371c3a7f00ccc2a079e97be6c05d10872ec540d66b3f0bdcd198f5695c34488e9b555453578b54ca17e3d7b4e193d52ee03760cf534aa7246dc33edbc4680dc83c6300b2a7057da1e898cc71cc55f74d9a35513cbccbe25d918f3f22df8c5dd4cce1116a0a2feb57fa4c6b8c8883a6802d6d6d2f897ce0b4a368cd698d4895f7773294453cc8dd84fd6f9c2f8a393a5a21824b1c3e78a34f7014c0261dbcc170c7ba8d59ddd907948c560f8664c818559eeee82c13436e967336818bd228e387155b58888db9ec9e085adbd9eb3dd022f0310ea3ed99e60a877ebaaa3d5e4af0bfb616c9fba9f7696d61987df94af760067044c30c535854867832faf6845342a4f8f1e6cb2824ebab6ba0f1acd482f0fedcaa9091a72e43c440c884182430b136bed17a849f630d221a55261b2715a56735d9908e949890f01a239ea10417d03f81fc5a45e6eb822fccb27e61e9173de26dbbc80e4743e7f1663c5b246e388467ff047f95965dc6fc162e47c41409579630dc393a0298d8730b2ebcff52c4c48497aad3914aa4a300d7aab95c176ffc8e120b31e950cedc3d606980982a6dd0ae0c625fd05eeb940119ab217764dd65cf2d2d986fcaa30fdc0d5d3946fe960cb7406ede782323845c074c552d2ab8f74fd09711b3dc31d6c8644590d0c38285405550d7a9b55c8b0cdad71b50bab013395177a0bfc48c64265a2925378386c303c2bb8aca1dfc124b29a64173cc4e92e61b1d186ce1ea2a178de2c696b1f55fa871c8cff9342f24f20244722709882e74d764182eff7621710a838c1b928e4a8e992d6a961d960c043d43abebcc2d737abd48d876ca9eac0c6f156060e9354e591cecbb94d0e8bdd16d4cfcb834f56649a7d570bfa1732f5ef17f8a7b0da2a5adeb8433c48eccb0bb4bbf1050d581a5fce466fd1e386f11663eb36f216adfac608ec5b23766f1b77509d136d690770806ff491f2bb2bb7c23403c8aaed438aa46e19837c85b229e5b479ae6bcec7fc379256ff85a59d7c6ec2970da9dc3222f2ae416d3da91612e456594cfca0b1da3078c728f4f4d04cd9fcd01f5d8122b78cec6ab557ac75819ba36e18ded50d925b1ebeecece38b36f48cdb4796a575363ee3fa3aad1587ff285f367ce0366d3e590b714b669e03fb6a3adad82d071f948e48aa15fc12569e4820a877dd612f394bad35d3abeef721d853737392f3f0ed26b6ba414019bb54918ac60c235e2da332a04ad7d63c313acfd99f16520e9e62c241b225a1022ae9649b3179bb291b209da867b12c85d1fbccadfe9611468a6c026f83face309ba9edd19bc155839a7c2191b57d3fa7a4ee31db165f5a50e15df070a7fdeb68979b7925287019fb82ccedb231ad23a613395a98a049a3881b1035b23f90143fefcd79e97e2cdf10dc0b0423515ff24a86d9e8fafe52dfa38dbccaf69ec42ed3ae105e74bee7859b677faa5fb5f1a201dd63527186f278c845c90651fca67f2f2bd10769522e2a4224fa33486515787022e4757ca83379185eb133be18ebd6bc56c4c917bc8fd3c818433995c2b61244e898f3eab30bf005dd5f657755d2757ba01bd472b79aa057ed2f5ed898410f5ebc5cdd7fa72f7732a4183a4f3d4a7b292e805ae420b196ea9175b048933505a86431fa0cd40322e40db40a308f111305f6a24fa0d8ad52d42db207d6ed1b57681b6c70df3791cfe8e8801df05d7eca4e2371f516aad1d2a9a745e87dd7a3e7f29b8d7a912dc030e415dd9ba6056df610711efe0699b546fb926ade8c1211739b210631651070438d1b9203e07e84c66165fe2a760e5bcbe7240e1cbf88917f5a9b7054623d59c4c9261bedc3d33287642bb327cc2fe2c130b47d5b6d51724c1cab9a939e770c0a6c65279874b5a2be8e83174aceb994d42af29f2a0ad70dd0b6f920b199270a11067f952fa44b1a5287d6744c51f381e0fda8286e246442c600a294a8afca5e30259e2c0359134566874de4ac03ec9765d460fd23ab8a93d88f1488bb25bc4dc8a68f1fce6a6e8f576c36bc52a274a164521d596140042af00a27cef5b3147ba143c14478c2283d3512ccbce736eb5aeffd8c1b2058c833aafb78f35b943cfce0611c7997aaa388a602dc0028bc0ad8f94c04b386035731f3d80c4dbcecacab0bd167a4da6276e0521f450ee7cd367603ee093d33c96dbe2c7b5fa7c930c568acad35148ec4ad73fa06e614957ce24745478613ce1f7106d89a9d865bc805c37adc50fa3f9afd65a23bea257411cb562ce667694af9d4a7fd45686c023921994861e7bd95c8cf05d18ec757956070aca5788629e4e595fd1c3ffb28f5c3546c4a26c6be8a6acad361e1d1ba0e0adde490651fc174787e9bb5897bc351443765afc495a4bb3c8761403f43dda077b59015d0f9c8b5811070c43ff53aa705ae64b741a172c0b71289a6a0260c31ad4dc4d39e63202d0103279be17f9a2c9e66528d9405c65a6d93435cc98bd3e77c45c3e771e6ccc22adfa9211a44d60cfcbf3dbcf7001ef415147a37ea7a4bee9599ff8f29936f8bc78dde587d7bb5ee1f6f065eec6e172d813827fc5ffd44be6412a81253e31d8266789566959460a5c34d132b6b2521b9d38d771759b98b9cf58d5ccf1d373f7651bc60f0c3421b8a94821ee338886b59b97eab19533382e21094ed706c60047d1e6a4e507cff1bb9c2ca4575cb9473edc8182d5137f312f515b615ad0ea4121bebed16f01d7c75488506d841059ca8462a1b2d2a38a0c6921ae91b909263cfaf823a681849500576c781d6a68566296d009b72f8aab4419caa979f625f6a1f9734f9e88a4934ceabfbfb8dea61ba7679404669bee9d61bae1925dc36fe812961e4f17bd27152370993ca0e6a7681a52720aa271567d6978881ae238fca50615ef83014746fa96ffef3014b43407e0c21a3f4b2e1153a62fcc97a5ef3eaf79e7ff5c4e323754348e8eb60f3192edd7ab825ef2ea84295bd1cb09c366f202ebb250105714f139776783990893e26b211a1ed321e8045d229e8b10a85fcec65bc34b777ab16690b0cc3a789318aa570fec92a92544546819488ac1a1f9d0bef52935ecef0b7fece5eeb0ae930e20e08d3bd09419f42da32f08713eb33ceb86ed7921ac208728294b2ffc3a4217d885ff9887e881bf6ef90f575f774275f3cbf5b0f030db7a2f3c3aa14e116e1b6290df47a62086bca6bf342d989e09be2fa233efee7dbfbf32aad276fd58ec5a0cca33c65f95631ab165ef2becf33dfef643f472637917e670aa27dad26f66565314d21286171d6b49a6bdb1d3cb7d4e9a660ab1d24cb80a450bf66f1631c07e2f9a151fc134921bcaf592ac52ebf4864fffb9f9597df1048ed28a2b9dbfe593d6f3f12c0397b3d6bb96f860c02291fa2d1963dd92fbb8a8c0bfbb04947b769725af3934d7cef640b13bdc970d65f9b957dc3035541b008f9e9a73767d5bf358ac22d993620c5d65a717a5b446857b84e293d7f25797a426284e5cd951922ce6c4723c89110b5eb6ba61576d384b1149ded8ccd17f2bce888f5fb5ac8303cf9f2e3b09d2327205effa616b8cfcb06c3f05a4b29d06779087946d14bd7e05231917fa279590a14f634a3f14f3258f11f68048c42ce90616e7b0b1bc5ca30a5ea55458dac47c1ba9a291b5c3f1844b658c4df40e456225a0c2ff96917d718baa246a42ce9eb639e7a6a7a7c5d70174f42f674231336ed8f1b930ee662ce8f3d19bef69512b04fcee4881f84a134580f8e238dd09e1b005dffad05295e791d5d6c6020ddb7d1cde2acafc66ef889b3a6ab4469f96399025002d94e5c96b4d1d968ca62e88b394460684b8f96c3f7f40c2e65a97d42aa3ba214f9e1e7e284e4e195def03aef6c5787fa8834bede7e9faf2faad1f3588008cbdc4476b2e92e5cc64bca1edc55e7aa47023f1a8a83f6d25fd9f5d24643fbe217e85dbdf4f1b3a90bf8c1f93e082311f6cbd2bc37686fb31420ea005744842b128778c956e112e67a7e97b7fe14c156bc685e1c0081bd4e67f52714a08caf45795d8decb561202f267c81d2c3cb466e9e1468234c3291b7a4ad9c79d31bc1b76f81a517a1dc32feece01fa9b0990c8d1f3a21f2019522025f1c8dfe3dbb5a51ce25ff2a8d21d82acd64bf60bef90f9cd7029a08d0469b30e23712d0cbfaec9d5e96fd5f2d506ba5bb99a4f5cbe576d2340ca2227921c5642a3e68b5f28e130854a9457432409ff65d399da4cc3d8c15690dde5977f3f4be049467752e141f17d2140683f4f8263609118aae7530c56f7cc6eff23023cf7df85bb98d123197a7a340ebd651e259b617da9c137b7c74c1c86259c809396a1b514a220f785371ad645940c879cc81928170680dc8e8554a068e3d9e402a75c40b185c148506077e3f455e5976c8c1fa386ad8d7b1c3a3dfa468f3a4a5753c36e316c6ccfc9422bf67076b497f1412f3e9462d3ee32c25d6ad94259666e425341e44e49bfc8f397dfb9a354db7cbd5c7fcb4620b9a758d04ebe7414b69a5768e8382340045052b59a906fbf320a75f55d328db4fbaa76e7b07c91169bc9d67aaf8b20dd808f2c305edc70b989547b0f28dd924fdd8b2dde1fcecb8da1566a89f7470c76e32e74dda15160307b7f101421a64c5452cffd201b471da658c8eabcce14d8b74020e43157246054c98f50598e6b2c", 0x1000, 0x6, 0x8}], 0x160000) socket$inet6_udp(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x14) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) gettid() r0 = timerfd_create(0x0, 0x0) timerfd_gettime(r0, &(0x7f00000005c0)) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid\x00', 0x80008000000002, 0x0) write$UHID_CREATE2(r1, &(0x7f0000000100)={0xb, 'syz1\x00', 'syz0\x00', 'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\xff\xff\xff\x00', 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "80"}, 0x119) fallocate(0xffffffffffffffff, 0x0, 0x4, 0x20) r2 = socket$inet_udp(0x2, 0x2, 0x0) dup3(r2, r1, 0x0) [ 667.463581] binder: BINDER_SET_CONTEXT_MGR already set [ 667.483632] binder: 28803:28808 ioctl 4b47 20000180 returned -22 [ 667.517604] binder: 28796:28799 ioctl 40046207 0 returned -16 16:05:46 executing program 1 (fault-call:1 fault-nth:0): perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 667.590326] binder_alloc: 28796: binder_alloc_buf, no vma [ 667.590375] binder: release 28796:28799 transaction 1439 out, still active 16:05:47 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x3000000}, @addr={0x5, 0x7ff}}], 0x30) 16:05:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x3000000}, 0x0) [ 667.632765] binder: undelivered TRANSACTION_COMPLETE [ 667.645575] FAULT_INJECTION: forcing a failure. [ 667.645575] name failslab, interval 1, probability 0, space 0, times 0 [ 667.652520] binder: 28796:28804 transaction failed 29189/-3, size 24-8 line 3035 [ 667.668517] binder: send failed reply for transaction 1439, target dead [ 667.724249] binder: 28796:28804 ioctl c0306201 200003c0 returned -14 [ 667.732654] CPU: 1 PID: 28820 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #50 [ 667.739861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 667.746050] binder: undelivered TRANSACTION_ERROR: 29189 [ 667.749219] Call Trace: [ 667.749249] dump_stack+0x1db/0x2d0 [ 667.749274] ? dump_stack_print_info.cold+0x20/0x20 [ 667.749292] ? __f_unlock_pos+0x19/0x20 [ 667.749315] ? find_held_lock+0x35/0x120 [ 667.749346] should_fail.cold+0xa/0x15 [ 667.749371] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 667.782990] ? ___might_sleep+0x1e7/0x310 [ 667.787157] ? arch_local_save_flags+0x50/0x50 [ 667.791758] ? kasan_check_write+0x14/0x20 [ 667.796013] __should_failslab+0x121/0x190 [ 667.800268] should_failslab+0x9/0x14 [ 667.804079] kmem_cache_alloc+0x2be/0x710 [ 667.804100] ? check_preemption_disabled+0x48/0x290 [ 667.804136] getname_flags+0xd6/0x5b0 [ 667.804157] do_mknodat+0x1a6/0x530 [ 667.813322] ? do_file_open_root+0x4f0/0x4f0 [ 667.813344] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 667.813362] ? trace_hardirqs_off_caller+0x300/0x300 [ 667.813383] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 667.840388] __x64_sys_mknod+0x7b/0xb0 [ 667.844293] do_syscall_64+0x1a3/0x800 [ 667.848204] ? syscall_return_slowpath+0x5f0/0x5f0 [ 667.853159] ? prepare_exit_to_usermode+0x232/0x3b0 [ 667.858198] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 667.863066] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 667.868264] RIP: 0033:0x458089 [ 667.871469] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 667.890382] RSP: 002b:00007f22fb020c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 667.898099] RAX: ffffffffffffffda RBX: 00007f22fb020c90 RCX: 0000000000458089 [ 667.905388] RDX: 0000000000000000 RSI: 0000000000006004 RDI: 0000000020000040 [ 667.912662] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 16:05:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x200, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000040)={0x6, 0x0, 0x0, 0x24c4}) ioctl$DRM_IOCTL_AGP_UNBIND(r2, 0x40106437, &(0x7f00000000c0)={r3, 0x9}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002780)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000002840)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002800)={&(0x7f00000027c0)=@gettclass={0x24, 0x2a, 0x0, 0x8001, 0x25dfdbfe, {0x0, r4, {0xf, 0xffff}, {0x6, 0x1f}, {0xf, 0x1}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x24004004}, 0x40000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x4000000}, 0x0) 16:05:47 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x4000000}, @addr={0x5, 0x7ff}}], 0x30) 16:05:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1200, 0x0, 0x0}) [ 667.912675] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22fb0216d4 [ 667.927209] R13: 00000000004c3d73 R14: 00000000004d6d78 R15: 0000000000000004 16:05:47 executing program 5: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x2, 0x0) ioctl$RTC_VL_CLR(r0, 0x7014) syz_mount_image$xfs(&(0x7f00000004c0)='xfs\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2, &(0x7f0000000440)=[{&(0x7f0000000240)="6cdf19ae0a31710116927a4f6ce9c0f1e0cb2687509dab34343826fad9bc1eae00f4abc6ae0d45c068b28a9bd761fb8689b2987b3d9fd3c882b9d64c629e2e01f15faf0a608bf3683bbdab07a2c17749c7c4079a14c4f6b6e525e8e316f0eb5f3fa9744f5c15", 0x66}, {0x0, 0x0, 0x8001}], 0x0, 0x0) ioctl$SIOCX25SSUBSCRIP(r0, 0x89e1, &(0x7f0000000040)={'bond_slave_1\x00', 0x6, 0xbb}) 16:05:47 executing program 1 (fault-call:1 fault-nth:1): perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 668.068655] binder: 28834:28837 ioctl c0306201 200003c0 returned -14 16:05:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x6000000}, 0x0) [ 668.111202] binder_alloc: binder_alloc_mmap_handler: 28834 20001000-20004000 already mapped failed -16 [ 668.148268] Unknown ioctl 28692 16:05:47 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x5000000}, @addr={0x5, 0x7ff}}], 0x30) [ 668.157600] binder: BINDER_SET_CONTEXT_MGR already set [ 668.178876] binder: 28841:28850 ioctl 4b47 20000180 returned -22 [ 668.205082] Unknown ioctl 35297 [ 668.214661] FAULT_INJECTION: forcing a failure. [ 668.214661] name failslab, interval 1, probability 0, space 0, times 0 [ 668.219078] binder: send failed reply for transaction 1443 to 28834:28837 [ 668.243897] binder: 28834:28837 ioctl 40046207 0 returned -16 [ 668.303582] CPU: 0 PID: 28852 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #50 [ 668.310827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 668.320191] Call Trace: [ 668.322799] dump_stack+0x1db/0x2d0 [ 668.326454] ? dump_stack_print_info.cold+0x20/0x20 [ 668.331520] should_fail.cold+0xa/0x15 [ 668.335431] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 668.340566] ? ___might_sleep+0x1e7/0x310 [ 668.344734] ? arch_local_save_flags+0x50/0x50 [ 668.349368] __should_failslab+0x121/0x190 [ 668.353623] should_failslab+0x9/0x14 [ 668.357434] kmem_cache_alloc+0x2be/0x710 [ 668.361620] __d_alloc+0xae/0xbe0 [ 668.365090] ? d_lookup+0x163/0x360 [ 668.368748] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 668.373775] ? d_alloc_parallel+0x1f10/0x1f10 [ 668.378285] ? trace_hardirqs_on+0xbd/0x310 [ 668.382622] ? lookup_dcache+0x23/0x140 [ 668.386610] ? trace_hardirqs_off_caller+0x300/0x300 [ 668.391727] ? lock_acquire+0x1db/0x570 [ 668.395709] ? filename_create+0x1a8/0x5a0 [ 668.399958] ? ___might_sleep+0x1e7/0x310 [ 668.404141] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 668.409190] d_alloc+0x99/0x420 [ 668.412483] ? __d_lookup+0x960/0x960 [ 668.416300] ? __d_alloc+0xbe0/0xbe0 [ 668.420056] __lookup_hash+0xcd/0x190 [ 668.423868] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 668.429425] filename_create+0x1d6/0x5a0 [ 668.433507] ? kern_path_mountpoint+0x40/0x40 [ 668.438031] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 668.443579] ? getname_flags+0x277/0x5b0 [ 668.447663] do_mknodat+0x1bd/0x530 [ 668.451321] ? do_file_open_root+0x4f0/0x4f0 [ 668.455750] ? trace_hardirqs_off_caller+0x300/0x300 [ 668.460870] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 668.465657] __x64_sys_mknod+0x7b/0xb0 [ 668.469566] do_syscall_64+0x1a3/0x800 [ 668.473568] ? syscall_return_slowpath+0x5f0/0x5f0 [ 668.478531] ? prepare_exit_to_usermode+0x232/0x3b0 [ 668.483570] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 668.488446] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 668.493643] RIP: 0033:0x458089 [ 668.496847] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 668.515760] RSP: 002b:00007f22fb020c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 668.523479] RAX: ffffffffffffffda RBX: 00007f22fb020c90 RCX: 0000000000458089 [ 668.530760] RDX: 0000000000000000 RSI: 0000000000006004 RDI: 0000000020000040 [ 668.538036] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 668.545313] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22fb0216d4 [ 668.552626] R13: 00000000004c3d73 R14: 00000000004d6d78 R15: 0000000000000004 16:05:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1400, 0x0, 0x0}) 16:05:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x8000000}, 0x0) 16:05:47 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x8000000}, @addr={0x5, 0x7ff}}], 0x30) [ 668.575925] XFS (loop5): Invalid superblock magic number 16:05:48 executing program 1 (fault-call:1 fault-nth:2): perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 668.717574] binder: undelivered TRANSACTION_COMPLETE [ 668.722732] binder: undelivered TRANSACTION_ERROR: 29189 [ 668.754983] Unknown ioctl 28692 [ 668.833148] FAULT_INJECTION: forcing a failure. [ 668.833148] name failslab, interval 1, probability 0, space 0, times 0 [ 668.847151] binder: 28877:28883 ioctl c0306201 200003c0 returned -14 16:05:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x610000, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f0000000040)={0x80000000, 0xfffffffffffffff9, 0xfff, 0xc3e9, 0x4}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:48 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xa000000}, 0x0) [ 668.905954] CPU: 0 PID: 28882 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #50 [ 668.913191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 668.922557] Call Trace: [ 668.925192] dump_stack+0x1db/0x2d0 [ 668.928863] ? dump_stack_print_info.cold+0x20/0x20 [ 668.930973] binder_alloc: binder_alloc_mmap_handler: 28877 20001000-20004000 already mapped failed -16 [ 668.933950] should_fail.cold+0xa/0x15 [ 668.943699] binder: BINDER_SET_CONTEXT_MGR already set [ 668.947332] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 668.947390] ? ___might_sleep+0x1e7/0x310 [ 668.947414] ? arch_local_save_flags+0x50/0x50 [ 668.947466] __should_failslab+0x121/0x190 [ 668.947495] should_failslab+0x9/0x14 [ 668.947520] kmem_cache_alloc+0x2be/0x710 [ 668.947571] __d_alloc+0xae/0xbe0 [ 668.953455] binder: 28877:28883 ioctl 40046207 0 returned -16 [ 668.957941] ? d_lookup+0x163/0x360 [ 668.957965] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 668.957986] ? d_alloc_parallel+0x1f10/0x1f10 [ 668.958005] ? trace_hardirqs_on+0xbd/0x310 [ 668.958027] ? lookup_dcache+0x23/0x140 [ 668.958045] ? trace_hardirqs_off_caller+0x300/0x300 [ 668.958063] ? lock_acquire+0x1db/0x570 [ 668.964478] binder: release 28877:28883 transaction 1446 out, still active [ 668.966791] ? filename_create+0x1a8/0x5a0 [ 668.978248] binder: undelivered TRANSACTION_COMPLETE [ 668.978949] ? ___might_sleep+0x1e7/0x310 [ 668.982522] binder: send failed reply for transaction 1446, target dead [ 668.988296] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 668.988327] d_alloc+0x99/0x420 [ 668.988346] ? __d_lookup+0x960/0x960 [ 668.988370] ? __d_alloc+0xbe0/0xbe0 [ 668.988412] __lookup_hash+0xcd/0x190 [ 668.988428] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 668.988452] filename_create+0x1d6/0x5a0 [ 668.988476] ? kern_path_mountpoint+0x40/0x40 [ 668.988506] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 668.988522] ? getname_flags+0x277/0x5b0 [ 668.988550] do_mknodat+0x1bd/0x530 [ 669.093020] ? do_file_open_root+0x4f0/0x4f0 [ 669.097460] ? trace_hardirqs_off_caller+0x300/0x300 [ 669.102597] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 669.107375] __x64_sys_mknod+0x7b/0xb0 [ 669.111281] do_syscall_64+0x1a3/0x800 [ 669.115188] ? syscall_return_slowpath+0x5f0/0x5f0 [ 669.120150] ? prepare_exit_to_usermode+0x232/0x3b0 [ 669.125196] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 669.130098] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 669.135323] RIP: 0033:0x458089 16:05:48 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x42000000}, @addr={0x5, 0x7ff}}], 0x30) 16:05:48 executing program 5: r0 = socket$inet6(0xa, 0x40000000000006, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x40) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @loopback=0x7f000002}, 0x10) shutdown(r0, 0x1) [ 669.138528] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 669.157438] RSP: 002b:00007f22fb020c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 669.165166] RAX: ffffffffffffffda RBX: 00007f22fb020c90 RCX: 0000000000458089 [ 669.172449] RDX: 0000000000000000 RSI: 0000000000006004 RDI: 0000000020000040 [ 669.179732] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 669.187009] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22fb0216d4 [ 669.194291] R13: 00000000004c3d73 R14: 00000000004d6d78 R15: 0000000000000004 16:05:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2000, 0x0, 0x0}) 16:05:48 executing program 1 (fault-call:1 fault-nth:3): perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 669.365268] binder: 28886:28897 ioctl 4b47 20000180 returned -22 16:05:48 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xc000000}, 0x0) [ 669.434601] binder: 28895:28905 ioctl c0306201 200003c0 returned -14 16:05:48 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x80ffffff}, @addr={0x5, 0x7ff}}], 0x30) [ 669.481093] binder_alloc: binder_alloc_mmap_handler: 28895 20001000-20004000 already mapped failed -16 [ 669.509168] FAULT_INJECTION: forcing a failure. [ 669.509168] name failslab, interval 1, probability 0, space 0, times 0 16:05:48 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000340)) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f00000000c0)=[@in={0x2, 0x4e24, @local}], 0x10) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/audio\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000480), &(0x7f0000000500)=0x4) getpeername$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000540)=0x14) sendmsg$alg(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000980)="6aa70bc3d6e4f5928340950185a24c25c0d815071a5504e78a7dd03fb0b32989d291c1d7", 0x24}], 0x1, &(0x7f0000000a00), 0x0, 0x80}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000680)={{{@in=@dev, @in=@multicast1}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f0000000780)=0xe8) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000002c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) r1 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000440)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$unlink(0x9, 0x0, r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000000)=ANY=[@ANYBLOB="b702000013000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000045040400010000000404000001000000b7030000000000006a0a00fe00000000850000002b000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x0, 0xe, 0x9f, &(0x7f0000000280)="43037f632e7592319135dad4e437", &(0x7f0000000380)=""/159, 0x100}, 0x28) [ 669.562205] binder: BINDER_SET_CONTEXT_MGR already set [ 669.578237] CPU: 1 PID: 28909 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #50 [ 669.585440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 669.594882] Call Trace: [ 669.597488] dump_stack+0x1db/0x2d0 [ 669.601146] ? dump_stack_print_info.cold+0x20/0x20 [ 669.606184] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 669.611299] ? lockdep_hardirqs_on+0x415/0x5d0 [ 669.615903] should_fail.cold+0xa/0x15 [ 669.619806] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 669.624928] ? ___might_sleep+0x1e7/0x310 [ 669.629095] ? arch_local_save_flags+0x50/0x50 [ 669.633710] __should_failslab+0x121/0x190 [ 669.637959] should_failslab+0x9/0x14 [ 669.641769] kmem_cache_alloc+0x2be/0x710 [ 669.641874] ? ext4_alloc_inode+0xa5/0x860 [ 669.641897] selinux_inode_alloc_security+0x108/0x3b0 [ 669.650282] ? inode_free_rcu+0x20/0x20 [ 669.650331] ? __put_user_ns+0x70/0x70 [ 669.650351] ? lockdep_init_map+0x10c/0x5b0 [ 669.668031] ? debug_object_init+0x16/0x20 [ 669.672683] security_inode_alloc+0x90/0xe0 [ 669.677024] inode_init_always+0x662/0xd30 [ 669.681270] ? kasan_check_write+0x14/0x20 [ 669.685521] ? __address_space_init_once+0x240/0x240 [ 669.690649] ? add_lock_to_list.isra.0+0x450/0x450 [ 669.695596] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 669.701455] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 669.707003] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 669.712557] alloc_inode+0x83/0x190 [ 669.716196] new_inode_pseudo+0x71/0x1b0 [ 669.720268] ? prune_icache_sb+0x1c0/0x1c0 [ 669.724520] new_inode+0x1f/0x40 [ 669.727981] __ext4_new_inode+0x484/0x6cb0 [ 669.732236] ? avc_has_perm+0x460/0x7e0 [ 669.736229] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 669.741778] ? ext4_free_inode+0x1a80/0x1a80 [ 669.746253] ? lock_downgrade+0x910/0x910 [ 669.750409] ? kasan_check_read+0x11/0x20 [ 669.754571] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 669.759859] ? rcu_read_unlock_special+0x380/0x380 [ 669.764847] ? security_load_policycaps+0x540/0x540 [ 669.769889] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 669.775439] ? avc_has_perm+0x55c/0x7e0 [ 669.779430] ? avc_has_perm_noaudit+0x630/0x630 [ 669.784115] ? ___might_sleep+0x1e7/0x310 [ 669.788291] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 669.793842] ? __dquot_initialize+0x632/0xda0 [ 669.798346] ? security_transition_sid+0x7d/0xa0 [ 669.803130] ? dquot_get_next_dqblk+0x180/0x180 [ 669.807824] ? selinux_dentry_init_security+0x2e0/0x2e0 [ 669.813203] ext4_mknod+0x264/0x620 [ 669.816846] ? ext4_add_nondir+0x90/0x90 [ 669.820906] ? selinux_inode_mknod+0x80/0xc0 [ 669.825321] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 669.830864] ? security_inode_mknod+0xf4/0x130 [ 669.835458] vfs_mknod+0x447/0x790 [ 669.839013] do_mknodat+0x31c/0x530 [ 669.842654] ? do_file_open_root+0x4f0/0x4f0 [ 669.847071] ? trace_hardirqs_off_caller+0x300/0x300 [ 669.852179] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 669.856940] __x64_sys_mknod+0x7b/0xb0 [ 669.860835] do_syscall_64+0x1a3/0x800 [ 669.864736] ? syscall_return_slowpath+0x5f0/0x5f0 [ 669.869676] ? prepare_exit_to_usermode+0x232/0x3b0 [ 669.874701] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 669.879563] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 669.884752] RIP: 0033:0x458089 [ 669.887955] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 16:05:48 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xc1ba3a2}, 0x0) 16:05:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xe000000}, 0x0) [ 669.906862] RSP: 002b:00007f22fafffc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 669.914572] RAX: ffffffffffffffda RBX: 00007f22fafffc90 RCX: 0000000000458089 [ 669.921848] RDX: 0000000000000000 RSI: 0000000000006004 RDI: 0000000020000040 [ 669.929132] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 669.936404] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22fb0006d4 [ 669.943672] R13: 00000000004c3d73 R14: 00000000004d6d78 R15: 0000000000000003 [ 669.979443] binder: 28895:28905 ioctl 40046207 0 returned -16 [ 670.001430] binder: release 28895:28905 transaction 1450 out, still active [ 670.001840] binder_alloc: 28895: binder_alloc_buf, no vma [ 670.014216] binder: undelivered TRANSACTION_COMPLETE 16:05:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf000000}, 0x0) [ 670.034444] binder: send failed reply for transaction 1450, target dead [ 670.077365] binder: 28895:28908 transaction failed 29189/-3, size 24-8 line 3035 [ 670.115957] binder: 28895:28908 ioctl c0306201 200003c0 returned -14 [ 670.155653] binder: undelivered TRANSACTION_ERROR: 29189 16:05:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x3f00, 0x0, 0x0}) 16:05:49 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x81ffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:05:49 executing program 1 (fault-call:1 fault-nth:4): perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:05:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x10000000}, 0x0) 16:05:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000040)={0x3f, 0x0, 0x6, 0x5, 0x0}, &(0x7f00000000c0)=0x10) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f00000001c0)={r2, 0x2, 0x7c, "a214b616d6e6db01ea0d51f140870ac96e7405e1ac8f9424bbe47b00df0c23f4ef6981b2f5c1528499232446ae1c53ca50dc5073dffa388f3dd5facfc0c0da722c7d5336ab62487296a914ae987a197dec2f2914d487bc800ca8c7d3dffdc730e81c4b5606b62b60bab043281e1c0a1dccc6d105f176eab649cdb8ac"}, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:49 executing program 5: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f00000000c0)={0x3, 0x473d}) r1 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x80, 0x0) ioctl$CAPI_NCCI_OPENCOUNT(r1, 0x80044324, &(0x7f0000000040)) socket$vsock_stream(0x28, 0x1, 0x0) [ 670.413750] FAULT_INJECTION: forcing a failure. [ 670.413750] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 670.425616] CPU: 0 PID: 28942 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #50 [ 670.432823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 670.437143] binder: 28936:28944 ioctl c0306201 200003c0 returned -14 [ 670.442190] Call Trace: [ 670.442222] dump_stack+0x1db/0x2d0 [ 670.442257] ? dump_stack_print_info.cold+0x20/0x20 16:05:49 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x92ffffff}, @addr={0x5, 0x7ff}}], 0x30) [ 670.460041] ? perf_trace_lock+0x47b/0x750 [ 670.464340] should_fail.cold+0xa/0x15 [ 670.468260] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 670.473448] ? rcu_read_unlock+0x16/0x60 [ 670.477567] ? find_held_lock+0x35/0x120 [ 670.481667] ? rcu_read_unlock+0x16/0x60 [ 670.485778] should_fail_alloc_page+0x50/0x60 [ 670.490300] __alloc_pages_nodemask+0x323/0xdc0 [ 670.492338] binder_alloc: binder_alloc_mmap_handler: 28936 20001000-20004000 already mapped failed -16 [ 670.494986] ? lock_downgrade+0x910/0x910 [ 670.495006] ? kasan_check_read+0x11/0x20 16:05:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x60000000}, 0x0) [ 670.495028] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 670.495055] ? __alloc_pages_slowpath+0x2cc0/0x2cc0 [ 670.508675] ? ___might_sleep+0x1e7/0x310 [ 670.508708] ? trace_hardirqs_off+0xb8/0x310 [ 670.527485] cache_grow_begin+0x9c/0x8c0 [ 670.527514] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 670.527559] ? check_preemption_disabled+0x48/0x290 [ 670.527600] kmem_cache_alloc+0x645/0x710 [ 670.550802] ext4_alloc_inode+0xa5/0x860 [ 670.554895] ? ratelimit_state_init+0xb0/0xb0 [ 670.559505] ? perf_trace_run_bpf_submit+0x241/0x310 [ 670.564645] ? perf_trace_lock+0x47b/0x750 [ 670.568897] ? perf_trace_run_bpf_submit+0x241/0x310 [ 670.574011] ? perf_trace_run_bpf_submit+0x248/0x310 [ 670.579191] ? add_lock_to_list.isra.0+0x450/0x450 [ 670.584164] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.589722] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.595275] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.600841] ? ratelimit_state_init+0xb0/0xb0 [ 670.605378] alloc_inode+0x66/0x190 [ 670.606607] binder: BINDER_SET_CONTEXT_MGR already set [ 670.609028] new_inode_pseudo+0x71/0x1b0 [ 670.609049] ? prune_icache_sb+0x1c0/0x1c0 [ 670.609088] new_inode+0x1f/0x40 [ 670.626008] __ext4_new_inode+0x484/0x6cb0 [ 670.630285] ? avc_has_perm+0x460/0x7e0 [ 670.634305] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.636082] binder: 28936:28944 ioctl 40046207 0 returned -16 [ 670.639865] ? ext4_free_inode+0x1a80/0x1a80 [ 670.639885] ? lock_downgrade+0x910/0x910 [ 670.639904] ? kasan_check_read+0x11/0x20 [ 670.639926] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 16:05:50 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x93ffffff}, @addr={0x5, 0x7ff}}], 0x30) [ 670.639951] ? rcu_read_unlock_special+0x380/0x380 [ 670.660066] binder_alloc: 28936: binder_alloc_buf, no vma [ 670.663807] ? security_load_policycaps+0x540/0x540 [ 670.663838] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.684835] ? avc_has_perm+0x55c/0x7e0 [ 670.688847] ? avc_has_perm_noaudit+0x630/0x630 [ 670.693538] ? ___might_sleep+0x1e7/0x310 [ 670.697728] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.703285] ? __dquot_initialize+0x632/0xda0 [ 670.707820] ? security_transition_sid+0x7d/0xa0 16:05:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x65580000}, 0x0) [ 670.711440] binder: 28936:28944 transaction failed 29189/-3, size 24-8 line 3035 [ 670.712612] ? dquot_get_next_dqblk+0x180/0x180 [ 670.712653] ? selinux_dentry_init_security+0x2e0/0x2e0 [ 670.722816] binder: send failed reply for transaction 1455 to 28936:28944 [ 670.724863] ext4_mknod+0x264/0x620 [ 670.724905] ? ext4_add_nondir+0x90/0x90 [ 670.744867] ? selinux_inode_mknod+0x80/0xc0 [ 670.749318] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 670.754876] ? security_inode_mknod+0xf4/0x130 [ 670.759490] vfs_mknod+0x447/0x790 [ 670.763057] do_mknodat+0x31c/0x530 [ 670.766714] ? do_file_open_root+0x4f0/0x4f0 [ 670.771157] ? trace_hardirqs_off_caller+0x300/0x300 [ 670.776280] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 670.781068] __x64_sys_mknod+0x7b/0xb0 [ 670.784972] do_syscall_64+0x1a3/0x800 [ 670.788883] ? syscall_return_slowpath+0x5f0/0x5f0 [ 670.793833] ? prepare_exit_to_usermode+0x232/0x3b0 [ 670.798889] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 670.803781] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 670.808982] RIP: 0033:0x458089 [ 670.812189] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 670.831114] RSP: 002b:00007f22fb020c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 670.838864] RAX: ffffffffffffffda RBX: 00007f22fb020c90 RCX: 0000000000458089 [ 670.846152] RDX: 0000000000000000 RSI: 0000000000006004 RDI: 0000000020000040 [ 670.853430] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 670.860705] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22fb0216d4 [ 670.867983] R13: 00000000004c3d73 R14: 00000000004d6d78 R15: 0000000000000004 [ 670.876749] binder: 28936:28944 ioctl c0306201 200003c0 returned -14 16:05:50 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x94ffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:05:50 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x1) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0x3436, 0x3}, 0x13}, 0x10) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, 0x0, &(0x7f00000000c0)=0x287) 16:05:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1000000, 0x0, 0x0}) 16:05:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x81000000}, 0x0) [ 671.032623] binder: 28956:28966 ioctl 4b47 20000180 returned -22 [ 671.136745] binder: 28973:28975 ioctl c0306201 200003c0 returned -14 [ 671.182956] binder_alloc: binder_alloc_mmap_handler: 28973 20001000-20004000 already mapped failed -16 [ 671.216077] binder: BINDER_SET_CONTEXT_MGR already set [ 671.229549] binder: 28973:28979 ioctl 40046207 0 returned -16 [ 671.263578] binder: send failed reply for transaction 1460 to 28973:28975 [ 671.297733] binder: undelivered TRANSACTION_COMPLETE [ 671.322533] binder: undelivered TRANSACTION_ERROR: 29189 [ 671.341523] binder: undelivered TRANSACTION_ERROR: 29189 [ 671.354411] binder: undelivered TRANSACTION_COMPLETE [ 671.369736] binder: undelivered TRANSACTION_ERROR: 29189 16:05:50 executing program 1 (fault-call:1 fault-nth:5): perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:05:50 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xa0010000}, @addr={0x5, 0x7ff}}], 0x30) 16:05:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x88a8ffff}, 0x0) 16:05:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2000000, 0x0, 0x0}) 16:05:50 executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x40000000015, 0x4, &(0x7f0000346fc8)=ANY=[@ANYBLOB="18000000000000000000000000000000711014000000000095000000f0ff0000"], &(0x7f0000f6bffb)='GPL\x00', 0x80, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$TIOCCONS(r1, 0x541d) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)=0x0) syz_open_procfs$namespace(r2, &(0x7f0000000040)='ns/uts\x00') 16:05:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f00000000c0)=""/106) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x10000000fffffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x4000) [ 671.518248] binder: 28988:28990 ioctl 80404532 200000c0 returned -22 [ 671.534723] binder: 28986:28987 ioctl c0306201 200003c0 returned -14 16:05:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x99040000}, 0x0) [ 671.579842] binder_alloc: binder_alloc_mmap_handler: 28986 20001000-20004000 already mapped failed -16 [ 671.602152] FAULT_INJECTION: forcing a failure. [ 671.602152] name failslab, interval 1, probability 0, space 0, times 0 [ 671.615599] binder: 28988:28997 ioctl 4b47 20000180 returned -22 16:05:50 executing program 5: getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000680)={0x0, @in6={{0xa, 0x0, 0x0, @loopback}}}, 0x0) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x100, 0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000040)) kexec_load(0x0, 0x7, &(0x7f00000005c0), 0x0) [ 671.636987] binder: BINDER_SET_CONTEXT_MGR already set [ 671.647019] binder: 28986:28987 ioctl 40046207 0 returned -16 [ 671.670715] CPU: 0 PID: 29000 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #50 [ 671.677952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 671.687327] Call Trace: [ 671.689946] dump_stack+0x1db/0x2d0 [ 671.693614] ? dump_stack_print_info.cold+0x20/0x20 [ 671.698649] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 671.703777] ? lockdep_hardirqs_on+0x415/0x5d0 [ 671.708404] should_fail.cold+0xa/0x15 [ 671.712329] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 671.717471] ? ___might_sleep+0x1e7/0x310 [ 671.721650] ? arch_local_save_flags+0x50/0x50 [ 671.726291] __should_failslab+0x121/0x190 [ 671.730558] should_failslab+0x9/0x14 [ 671.734385] kmem_cache_alloc+0x2be/0x710 [ 671.738575] ? ext4_alloc_inode+0xa5/0x860 [ 671.742844] selinux_inode_alloc_security+0x108/0x3b0 [ 671.747509] binder: send failed reply for transaction 1464 to 28986:28987 [ 671.748056] ? inode_free_rcu+0x20/0x20 [ 671.758963] ? __put_user_ns+0x70/0x70 [ 671.762878] ? lockdep_init_map+0x10c/0x5b0 [ 671.767260] ? debug_object_init+0x16/0x20 [ 671.771554] security_inode_alloc+0x90/0xe0 [ 671.775901] inode_init_always+0x662/0xd30 [ 671.780160] ? perf_trace_lock+0x47b/0x750 [ 671.784413] ? __address_space_init_once+0x240/0x240 [ 671.789543] ? add_lock_to_list.isra.0+0x450/0x450 [ 671.794486] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.800034] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.805578] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.811155] alloc_inode+0x83/0x190 [ 671.814798] new_inode_pseudo+0x71/0x1b0 [ 671.818876] ? prune_icache_sb+0x1c0/0x1c0 [ 671.823161] new_inode+0x1f/0x40 [ 671.826550] __ext4_new_inode+0x484/0x6cb0 [ 671.830812] ? avc_has_perm+0x460/0x7e0 [ 671.834825] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.840386] ? ext4_free_inode+0x1a80/0x1a80 [ 671.844805] ? lock_downgrade+0x910/0x910 [ 671.848966] ? kasan_check_read+0x11/0x20 [ 671.853143] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 671.858443] ? rcu_read_unlock_special+0x380/0x380 [ 671.863395] ? security_load_policycaps+0x540/0x540 [ 671.868434] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.873982] ? avc_has_perm+0x55c/0x7e0 [ 671.877982] ? avc_has_perm_noaudit+0x630/0x630 [ 671.882667] ? ___might_sleep+0x1e7/0x310 [ 671.886843] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.892397] ? __dquot_initialize+0x632/0xda0 [ 671.896906] ? security_transition_sid+0x7d/0xa0 [ 671.901690] ? dquot_get_next_dqblk+0x180/0x180 [ 671.906391] ? selinux_dentry_init_security+0x2e0/0x2e0 [ 671.911784] ext4_mknod+0x264/0x620 [ 671.915454] ? ext4_add_nondir+0x90/0x90 [ 671.919523] ? selinux_inode_mknod+0x80/0xc0 [ 671.923948] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 671.929502] ? security_inode_mknod+0xf4/0x130 [ 671.934152] vfs_mknod+0x447/0x790 [ 671.937748] do_mknodat+0x31c/0x530 [ 671.941404] ? do_file_open_root+0x4f0/0x4f0 [ 671.945836] ? trace_hardirqs_off_caller+0x300/0x300 [ 671.950988] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 671.955764] __x64_sys_mknod+0x7b/0xb0 [ 671.959680] do_syscall_64+0x1a3/0x800 [ 671.963600] ? syscall_return_slowpath+0x5f0/0x5f0 [ 671.968558] ? prepare_exit_to_usermode+0x232/0x3b0 [ 671.973621] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 671.978502] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 671.983712] RIP: 0033:0x458089 [ 671.986919] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 672.005860] RSP: 002b:00007f22fb020c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000085 [ 672.013613] RAX: ffffffffffffffda RBX: 00007f22fb020c90 RCX: 0000000000458089 [ 672.020890] RDX: 0000000000000000 RSI: 0000000000006004 RDI: 0000000020000040 [ 672.028168] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 16:05:51 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xbf000000}, @addr={0x5, 0x7ff}}], 0x30) [ 672.035444] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22fb0216d4 [ 672.042720] R13: 00000000004c3d73 R14: 00000000004d6d78 R15: 0000000000000004 16:05:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x9effffff}, 0x0) 16:05:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x12000000, 0x0, 0x0}) 16:05:51 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xfdffffff}, @addr={0x5, 0x7ff}}], 0x30) [ 672.256576] binder: 29015:29017 ioctl c0306201 200003c0 returned -14 [ 672.284413] binder_alloc: binder_alloc_mmap_handler: 29015 20001000-20004000 already mapped failed -16 [ 672.313912] binder: BINDER_SET_CONTEXT_MGR already set [ 672.317668] binder: 28988:28997 ioctl 80404532 200000c0 returned -22 [ 672.333049] binder: 29015:29017 ioctl 40046207 0 returned -16 [ 672.415109] binder: send failed reply for transaction 1468 to 29015:29017 [ 672.422288] binder: undelivered TRANSACTION_COMPLETE [ 672.422301] binder: undelivered TRANSACTION_ERROR: 29189 [ 672.438732] binder: undelivered TRANSACTION_COMPLETE [ 672.455227] binder: undelivered TRANSACTION_ERROR: 29189 16:05:51 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:05:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xa0010000}, 0x0) 16:05:51 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000280)='/dev/video#\x00', 0x1, 0x80) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x0, 0x1, 0x0, "be32dae83fc6cbce72547af31a6060808bc59ca686c09837cdf50cad6f1c21b5"}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000200)={{0xffffffffffff0000, 0x4}, 0x0, 0x72, 0x3, {0x100, 0x8}, 0x2, 0x6}) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f00000002c0)) ioctl$CAPI_MANUFACTURER_CMD(r1, 0xc0104320, &(0x7f0000000140)={0x2, &(0x7f0000000340)="558710dfc9d1dae8082f7cd3e65424cdac79c1bc86dd8164d451436ec7fa7c952496a0204639f6c44a1db3723c2fc6041b8ab907f7e2e11ca203200747f7241b4885846cd1a72cc124d6f337158a77cc11f6cd8b15dd69bc4ada70d3dd5b80eca81f8b82c152b24a32d0e916f32b8a5eb7ad63c195f6f661e797be8c0b7b3d1d2419bfe5aeac0d95aa95700cba935db54339509d827785de9e7a8eb8c3c0c2e494daaef3734fea916ac838b1d709ab9b33360f5c507289c07c151865eb4e29a10e07cc3d6a7715217d6248"}) r2 = fcntl$getown(r0, 0x9) syz_open_procfs(r2, &(0x7f0000000300)='map_files\x00') bind$llc(r1, &(0x7f0000000180)={0x1a, 0x102, 0x3, 0x9, 0x3, 0xfffffffffffffffc, @dev={[], 0x1f}}, 0x10) fcntl$setstatus(r0, 0x4, 0x4000) ioctl$VIDIOC_S_OUTPUT(r0, 0xc004562f, &(0x7f00000001c0)) 16:05:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x14000000, 0x0, 0x0}) 16:05:51 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xfeffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:05:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x20000, 0x0) ioctl$RTC_WIE_ON(r2, 0x700f) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xa2a31b0c}, 0x0) 16:05:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xffffff80}, @addr={0x5, 0x7ff}}], 0x30) [ 672.636145] binder: 29030:29032 ioctl c0306201 200003c0 returned -14 [ 672.667455] binder_alloc: binder_alloc_mmap_handler: 29030 20001000-20004000 already mapped failed -16 16:05:52 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000840)='/selinux/checkreqprot\x00', 0xb41, 0x0) ioctl$VIDIOC_LOG_STATUS(r0, 0x5646, 0x0) write$apparmor_exec(r0, 0x0, 0xa724) getitimer(0x1, &(0x7f0000000000)) personality(0x100000) [ 672.727727] binder: 29040:29047 ioctl 4b47 20000180 returned -22 16:05:52 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6002, 0xffffffffffffffff) 16:05:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x20000000, 0x0, 0x0}) [ 672.777060] binder: send failed reply for transaction 1472 to 29030:29032 [ 672.788649] binder: undelivered TRANSACTION_COMPLETE [ 672.815772] binder: undelivered TRANSACTION_ERROR: 29189 16:05:52 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xc00e0000}, 0x0) 16:05:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xffffff81}, @addr={0x5, 0x7ff}}], 0x30) 16:05:52 executing program 5: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000200), &(0x7f0000000240)=0x4) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x200) fcntl$setstatus(r3, 0x4, 0x2c00) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000040)={0x2, [0x0, 0x0]}, &(0x7f00000000c0)=0xc) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000100)={r4, @in={{0x2, 0x4e21, @local}}}, 0x84) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000280)={0x4, 0x6, 0x8001, 0x100000000, 0xd, 0x80000000}) 16:05:52 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf0ffffff}, 0x0) 16:05:52 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6003, 0xffffffffffffffff) [ 673.042876] binder: 29064:29066 ioctl c0306201 200003c0 returned -14 16:05:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xffffff92}, @addr={0x5, 0x7ff}}], 0x30) [ 673.105831] binder_alloc: binder_alloc_mmap_handler: 29064 20001000-20004000 already mapped failed -16 [ 673.216426] binder: release 29064:29066 transaction 1476 out, still active [ 673.229443] binder: undelivered TRANSACTION_COMPLETE [ 673.246301] binder: send failed reply for transaction 1476, target dead 16:05:52 executing program 4: syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x8400, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:52 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xffffa888}, 0x0) 16:05:52 executing program 5: clone(0x13102001ff0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x80001, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='veth0_to_bond\x00', 0x10) setsockopt(r0, 0x3, 0x1, &(0x7f0000000180)="2362879dbb4f2abf088d0dbccbb87b3590caeec0e1cda0cd3790f8d20b841ebcd3344ed79bfb3ded3851214dcb0ec2b7dd9cd7089f565ab443b7823ee545713e0ea32473cac692d9e842fab8df22fda262ccc48ca23b8e5918195c598dff466ef10bd8f4c807a7d428e8d84f77853244534526f57046484911c4a31f0756a52934fec9bb9b3696225795ddc1e02e0b9833ac7e87566399c03c8401bd02550f", 0x9f) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x8, 0xa9}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000100)={r1, 0xffffffffffffffff, 0x10, 0x97, 0x3}, &(0x7f0000000140)=0x18) fadvise64(r0, 0x0, 0x7, 0x0) 16:05:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x3f000000, 0x0, 0x0}) 16:05:52 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6005, 0xffffffffffffffff) 16:05:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xffffff93}, @addr={0x5, 0x7ff}}], 0x30) 16:05:52 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) setresuid(0x0, 0xee01, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x401870c8, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x1, 0x118) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100040}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0xb36, 0x70bd26, 0x25dfdbfe, {{}, 0x0, 0x4, 0x0, {0x8}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x40) [ 673.530308] binder: 29090:29099 ioctl c0306201 200003c0 returned -14 [ 673.567591] binder_alloc: binder_alloc_mmap_handler: 29090 20001000-20004000 already mapped failed -16 16:05:52 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xfffff000}, 0x0) 16:05:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x4000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f00000001c0)={0x9, 0x108, 0xfa00, {r3, 0x39, "3beb19", "8135d9b54af4d7a6f6e42b9325d626b6c38f8af6de3904be79b59191ac9a55fddc70df30c2389020b334086cc22fa96b58226d09640ad571d6df4d6b365b45930cb3c34714e420457f69471ed45bf3cac98657be4cc760f96f736b864f239da2ef7c481bcae495c5ee664f77aa8d00cc8c6c71587019060aa3a2f6c27b76faa14bfb72c7fe1a802f5ccc038b3ca928a587da15c2ad414b31bff3fd34621af39b21870dca8dc2961142953c1f333535337ec09d2c80af6c7df3f46afe4b9b9f012db4c2a77c37619cae2a601bb409b2e0ca6ebab0db5e89e869974e0b9a8449d94c14b4dd165f610623932e62b88ae8d3307bdc72c6beda5ba0b4e99e48e3957c"}}, 0x110) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xffffff94}, @addr={0x5, 0x7ff}}], 0x30) [ 673.585337] binder: BINDER_SET_CONTEXT_MGR already set [ 673.594409] binder: 29090:29099 ioctl 40046207 0 returned -16 [ 673.639474] binder: release 29090:29099 transaction 1480 out, still active [ 673.655242] binder_alloc: 29090: binder_alloc_buf, no vma [ 673.664905] binder: undelivered TRANSACTION_COMPLETE 16:05:53 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6006, 0xffffffffffffffff) [ 673.687071] binder: send failed reply for transaction 1480, target dead [ 673.694232] binder: 29090:29105 transaction failed 29189/-3, size 24-8 line 3035 [ 673.736776] binder: 29090:29105 ioctl c0306201 200003c0 returned -14 [ 673.768224] binder: undelivered TRANSACTION_ERROR: 29189 16:05:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xffffff7f}, 0x0) 16:05:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xfdfdffff, 0x0, 0x0}) 16:05:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xfffffffd}, @addr={0x5, 0x7ff}}], 0x30) [ 673.885871] binder: 29115:29126 ioctl 4b47 20000180 returned -22 16:05:53 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x14) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz1\x00', {}, 0x0, [], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3f]}, 0x45c) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x100000000, 0x2}, &(0x7f0000000140)=0x90) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000180)={r2, 0x251, 0x1}, &(0x7f00000001c0)=0x8) 16:05:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xffffff9e}, 0x0) [ 673.962497] binder: 29130:29132 ioctl c0306201 200003c0 returned -14 16:05:53 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6007, 0xffffffffffffffff) [ 674.019095] binder_alloc: binder_alloc_mmap_handler: 29130 20001000-20004000 already mapped failed -16 [ 674.105233] input: syz0 as /devices/virtual/input/input21 [ 674.116427] binder: send failed reply for transaction 1485 to 29130:29132 [ 674.127594] binder: undelivered TRANSACTION_COMPLETE [ 674.151200] input: syz0 as /devices/virtual/input/input22 [ 674.162751] binder: undelivered TRANSACTION_ERROR: 29189 16:05:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xfffffff0}, 0x0) 16:05:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xfffffffe}, @addr={0x5, 0x7ff}}], 0x30) 16:05:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xfffffdfd, 0x0, 0x0}) [ 674.451951] binder: 29159:29161 ioctl c0306201 200003c0 returned -14 [ 674.472287] binder_alloc: binder_alloc_mmap_handler: 29159 20001000-20004000 already mapped failed -16 [ 674.487233] binder: BINDER_SET_CONTEXT_MGR already set [ 674.492537] binder: 29159:29161 ioctl 40046207 0 returned -16 [ 674.499242] binder: release 29159:29161 transaction 1489 out, still active [ 674.515069] binder: undelivered TRANSACTION_COMPLETE [ 674.520286] binder: send failed reply for transaction 1489, target dead 16:05:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$setsig(r1, 0xa, 0x26) 16:05:53 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x600f, 0xffffffffffffffff) 16:05:53 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="936c384ee782a7b9d795a37762c8e38162de74bb259a7cf3a8c8925f2091a26b921cc47bfe00ab6798688a97813b43975d3328bdbf70f524fd54d32f246510453e8b620d594d3e70fe0d94f50726f842f1f28e22ec376fb1abff4c8684a0332e6496daf35e199db71e14a09796bc23d79d7c") r1 = syz_open_dev$sndseq(&(0x7f0000832ff3)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc08c5332, &(0x7f0000dc5f98)) dup3(r0, r1, 0x0) 16:05:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x1a0ffffffff}, 0x0) 16:05:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x1a0ffffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:05:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x100000000000000, 0x0, 0x0}) [ 674.647949] binder: 29169:29174 ioctl c0306201 200003c0 returned -14 [ 674.672560] binder_alloc: binder_alloc_mmap_handler: 29169 20001000-20004000 already mapped failed -16 16:05:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x40030000000000}, 0x0) [ 674.701726] binder: BINDER_SET_CONTEXT_MGR already set [ 674.716121] binder: 29169:29174 ioctl 40046207 0 returned -16 [ 674.732529] binder: 29175:29180 ioctl 4b47 20000180 returned -22 16:05:54 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6010, 0xffffffffffffffff) 16:05:54 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x100000000000000}, @addr={0x5, 0x7ff}}], 0x30) [ 674.758200] binder: release 29169:29174 transaction 1493 out, still active [ 674.764512] binder_alloc: 29169: binder_alloc_buf, no vma [ 674.773090] binder: undelivered TRANSACTION_COMPLETE [ 674.804011] binder: 29169:29183 transaction failed 29189/-3, size 24-8 line 3035 [ 674.807731] binder: send failed reply for transaction 1493, target dead [ 674.825946] binder: 29169:29183 ioctl c0306201 200003c0 returned -14 [ 674.870320] binder: undelivered TRANSACTION_ERROR: 29189 16:05:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x200000000000000, 0x0, 0x0}) 16:05:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf0ffffffffffff}, 0x0) 16:05:54 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x200000000000000}, @addr={0x5, 0x7ff}}], 0x30) [ 675.076498] binder: 29195:29200 ioctl c0306201 200003c0 returned -14 [ 675.114405] binder_alloc: binder_alloc_mmap_handler: 29195 20001000-20004000 already mapped failed -16 [ 675.158337] binder: BINDER_SET_CONTEXT_MGR already set [ 675.164308] binder: release 29195:29200 transaction 1497 out, still active [ 675.171977] binder: 29195:29200 ioctl 40046207 0 returned -16 [ 675.178953] binder: undelivered TRANSACTION_COMPLETE [ 675.191917] binder: send failed reply for transaction 1497, target dead 16:05:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='sessionid\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001ff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x1) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:05:54 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x601b, 0xffffffffffffffff) 16:05:54 executing program 5: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x400000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0xffffffff, @empty, 0x1}, @in={0x2, 0x4e22, @empty}, @in={0x2, 0x4e20, @remote}], 0x3c) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/17, 0x10000, 0x1000}, 0x18) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000000280)=0x400, 0x4) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000100)=0x8, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f00000002c0)=0x80, 0x4) bind$xdp(r3, &(0x7f0000000300)={0x2c, 0x0, r1}, 0x10) close(r3) 16:05:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x100000000000000}, 0x0) 16:05:54 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x300000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:05:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1200000000000000, 0x0, 0x0}) 16:05:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 675.326678] binder: 29209:29210 ioctl 4b47 20000180 returned -22 16:05:54 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6038, 0xffffffffffffffff) [ 675.423332] binder: 29215:29221 ioctl c0306201 200003c0 returned -14 16:05:54 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x400000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:05:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x200000000000000}, 0x0) [ 675.484290] binder_alloc: binder_alloc_mmap_handler: 29215 20001000-20004000 already mapped failed -16 16:05:54 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000580)) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x20, 0x400000) ioctl$KVM_GET_FPU(r4, 0x81a0ae8c, &(0x7f0000000340)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x10000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x0, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r5, 0x541b, &(0x7f00000000c0)) sendmsg$key(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x8, 0x9, 0x2, 0x1e, 0x0, 0x70bd27, 0x25dfdbfc, [@sadb_x_nat_t_port={0x1, 0x15, 0x4e23}, @sadb_x_sec_ctx={0x4, 0x18, 0x4, 0x4000000000000, 0x14, "8854595837d48cf9840086dbab2f2d42cafb2835"}, @sadb_sa={0x2, 0x1, 0x4d2, 0x8b3f, 0x44a2, 0xb, 0x2, 0x1}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d6}, @sadb_sa={0x2, 0x1, 0x4d6, 0x10001, 0x80000000, 0xbc, 0x4, 0x20000001}, @sadb_x_policy={0x8, 0x12, 0x1, 0x0, 0x0, 0x6e6bc0, 0x7af5, {0x6, 0xff, 0x1b7, 0x8, 0x0, 0x0, 0x0, @in=@rand_addr=0x9, @in6=@empty}}, @sadb_key={0x1, 0x9}, @sadb_x_policy={0x8, 0x12, 0x4, 0x3, 0x0, 0x6e6bc0, 0x0, {0x6, 0x3e, 0x6, 0x1, 0x0, 0x3, 0x0, @in6=@loopback, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0xf0}}, 0x4000800) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000500)) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x10000, 0x200200) [ 675.554211] binder: BINDER_SET_CONTEXT_MGR already set [ 675.559539] binder: 29215:29221 ioctl 40046207 0 returned -16 [ 675.567139] binder: 29223:29231 ioctl 4b47 20000180 returned -22 [ 675.593676] binder: release 29215:29221 transaction 1501 out, still active [ 675.632443] binder: undelivered TRANSACTION_COMPLETE [ 675.649359] binder: send failed reply for transaction 1501, target dead 16:05:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x1400000000000000, 0x0, 0x0}) 16:05:55 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:05:55 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x300000000000000}, 0x0) [ 675.803699] binder: 29242:29248 ioctl 4b47 20000180 returned -22 [ 675.824359] binder: 29244:29250 ioctl c0306201 200003c0 returned -14 [ 675.859089] binder_alloc: binder_alloc_mmap_handler: 29244 20001000-20004000 already mapped failed -16 [ 675.891533] binder: BINDER_SET_CONTEXT_MGR already set [ 675.913227] binder: 29244:29250 ioctl 40046207 0 returned -16 [ 675.917980] binder: release 29244:29250 transaction 1505 out, still active [ 675.943452] binder: undelivered TRANSACTION_COMPLETE [ 675.953904] binder: send failed reply for transaction 1505, target dead [ 676.104669] device bridge_slave_1 left promiscuous mode [ 676.110237] bridge0: port 2(bridge_slave_1) entered disabled state [ 676.154386] device bridge_slave_0 left promiscuous mode [ 676.159862] bridge0: port 1(bridge_slave_0) entered disabled state [ 680.063572] device hsr_slave_1 left promiscuous mode [ 680.148115] device hsr_slave_0 left promiscuous mode [ 680.208783] team0 (unregistering): Port device team_slave_1 removed [ 680.219751] team0 (unregistering): Port device team_slave_0 removed [ 680.232993] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 680.279608] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 680.360893] bond0 (unregistering): Released all slaves 16:06:01 executing program 5: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f000001c000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x0, 0x0) r0 = creat(&(0x7f00000002c0)='./file0/bus\x00', 0x1) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000200)={0x0, @reserved}) lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f0000000080)='\x00', 0x1, 0x1) accept4$ax25(r0, &(0x7f00000000c0)={{0x3, @bcast}, [@rose, @rose, @bcast, @rose, @default, @remote, @bcast, @bcast]}, &(0x7f0000000180)=0x48, 0x0) getxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000300)=@known='com.apple.system.Security\x00', &(0x7f0000000340)=""/165, 0xa5) mount(0x0, &(0x7f000000fff8)='./file0\x00', 0x0, 0x7ffbf, 0x0) 16:06:01 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x500000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:01 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:01 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x400000000000000}, 0x0) 16:06:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x2000000000000000, 0x0, 0x0}) 16:06:01 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f00000001c0)=""/242, 0x4000, 0x800, 0x5}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 681.918112] binder: 29264:29271 ioctl c0306201 200003c0 returned -14 [ 681.942665] binder_alloc: binder_alloc_mmap_handler: 29264 20001000-20004000 already mapped failed -16 16:06:01 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x800000000000000}, @addr={0x5, 0x7ff}}], 0x30) [ 681.976354] binder: BINDER_SET_CONTEXT_MGR already set 16:06:01 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x600000000000000}, 0x0) 16:06:01 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00') setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0xfffffffffffffffe, 0x5, 0x9000}, 0x4) [ 682.056076] binder: 29264:29271 ioctl 40046207 0 returned -16 [ 682.088986] binder: 29284:29286 ioctl 4b47 20000180 returned -22 [ 682.095521] binder: release 29264:29271 transaction 1509 out, still active 16:06:01 executing program 5: mkdir(&(0x7f00000001c0)='./control/../file0\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = accept4$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14, 0x80000) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'netdevsim0\x00', 0x2}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result}], 0x30) unlink(&(0x7f0000001240)='./control/file0\x00') rmdir(&(0x7f0000000140)='./control\x00') unlink(&(0x7f0000000180)='./control/file1\x00') ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x6) close(r0) [ 682.114664] binder: undelivered TRANSACTION_COMPLETE [ 682.119932] binder: send failed reply for transaction 1509, target dead 16:06:01 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x4200000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x3f00000000000000, 0x0, 0x0}) 16:06:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_init_net_socket$llc(0x1a, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:01 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x800000000000000}, 0x0) [ 682.316483] binder: 29310:29312 ioctl 4b47 20000180 returned -22 [ 682.332414] binder: 29306:29309 ioctl c0306201 200003c0 returned -14 16:06:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat(0xffffffffffffffff, &(0x7f0000000b00)='./file0\x00', 0x0, 0x80) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000b80)='/dev/null\x00', 0xc0002, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000b40)={0x0, 0xd1b45e04143f23e7, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000040)={0x9, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000140)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000240)='/dev/cachefiles\x00', 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000a40)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f0000000ac0)={0x13, 0x10, 0xfa00, {&(0x7f0000000840), r6}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f00000002c0), &(0x7f0000000740), &(0x7f0000000780)=0x0) syz_mount_image$reiserfs(&(0x7f00000001c0)='reiserfs\x00', &(0x7f0000000200)='./file0\x00', 0x2, 0x6, &(0x7f0000000680)=[{&(0x7f0000000340)="47e9053447d6a56dbde711e26f76fe19063fa4081a1ef3eac0076c71b98f620e53a7f0a060dfcce2df999db882ae166841c2c9784840efec3688ce752817263f1ea6a9a0f351f3193084b23be281e564f6b0ebe6895ce1c4544280c426e4a8f5183c2e756f815eaf15f9e470a2689c472e3d0963f04978cf28b0e4d59216d10522ab319b2e884a70ec6620bff67f7e07d8b4fdf246ee5c402de4326811cda817800a90db8c27d06a41739a7f461a5081b62425e7e84e4bcf0690b15ae0be4af80351fabf67fb2929e95ea3ea4d68b0eb300c89", 0xd3, 0x5}, {&(0x7f0000000240), 0x0, 0x7fffffff}, {&(0x7f0000000280)="2b3c048b9e931cf9accacf679b22c8148130a2a9872d1ec46f66", 0x1a, 0x9567}, {&(0x7f0000000440)="385a7a65f92679ef3552dd43fe141d85a1b945eae162962c4f46b3dba7da5b9718be3c449705c07c5ebb37af19590cd365a3e3d7380fabcc94ab31c68424ca1c32eb9ec403c1e532f5669ac81e656c74ff4835e1712ff88637746edb7ec25c9e717e574a8d19aa7471357c8731b3c7413824154c956ecae6f2d4ad7f9e4c5d7c55aa942ccb8acbb4527dbc87c295a88bb7", 0x91, 0x2}, {&(0x7f0000000500)="6730dacbee3e66f42d845de4513e8bed021e5511d71c75cdbbe93c6b9c6af9db61a61754cba6609ebb0ac8b53715cd009d5bae27b7f802c87d9aa20af8625a978a40620b5efdd764a5a8a4abe14c529bfaa15e235c22a2c0a39f67daf846ac5a40673f833a06a13597c5bd0e25404f92e01f006237f052f40149", 0x7a, 0x8000}, {&(0x7f0000000580)="983ea13b031ac055eca676d1a3ba82feb7df6ac2486482be1184fc9dc2fd869ec335283d96e8a2799c3979d0b0369028a06b377a18a5dac1d98be7952c1cfb9be29fc4d32a5c112ba4576f48fec5db7d88fa71ad1ca5ddf010daef27fd1b61d6dc66fe96a6dad5dc98fbacd70ca9bb4df6c08e399404241fbc44f1c9e95bfc1eafd9b6aed810695c8819420d5c2b52166427d003bb37ad4883c9fa33a32a3093c49335cc8bc7a059dfd439b127196b0a089d4375884ea0e05acc081befabcff7ddb00269ee2e9e59988a7669324b87", 0xcf, 0xdb37}], 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='grpquota,noacl,data=journal,data=journal,replayonly,barrier=flush,grpjquota,jdev=./file0,audit,fowner>', @ANYRESDEC=r7, @ANYBLOB='\x00\x00']) 16:06:01 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x80ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) [ 682.381339] binder_alloc: binder_alloc_mmap_handler: 29306 20001000-20004000 already mapped failed -16 16:06:01 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x400000, 0x0) ioctl$CAPI_GET_SERIAL(r0, 0xc0044308, &(0x7f0000000000)=0xcc53) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0x0, r0, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:01 executing program 5: r0 = syz_open_dev$dri(&(0x7f00000000c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000000000)={0x7fff, 0x3}) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f00000001c0)={0x8}) [ 682.452065] binder: send failed reply for transaction 1513 to 29306:29309 [ 682.468912] binder: undelivered TRANSACTION_COMPLETE 16:06:01 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xa00000000000000}, 0x0) 16:06:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 682.500612] binder: undelivered TRANSACTION_ERROR: 29189 [ 682.531325] binder: 29321:29325 ioctl 4b47 20000180 returned -22 16:06:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x8000000000000000, 0x0, 0x0}) 16:06:02 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x81ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:02 executing program 5: openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0xc0400, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x802c2, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x2, 0x0) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f0000000100)={0x40, 'syz1\x00'}) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, &(0x7f0000000340)={[], [{@context={'context', 0x3d, 'system_u'}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}]}) 16:06:02 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x10003, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0xbbc4, 0x800) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000000c0)={0x1, 0x6, 0x1, r1}) 16:06:02 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xc00000000000000}, 0x0) [ 682.769466] binder: 29342:29346 ioctl 4b47 20000180 returned -22 16:06:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x78, 0x90, 0xffffffffffffffff, {"66f1fb9c5407c1fa48cd71a9bb17ee24290996ba19ce322491b18efe57b39971d6ae9202965f602997d5f4af2b77e8f57b56cb0cc9d37ad9f1966dc0d4c63a565e19e3f8095c5e2bacf5cb3827cf8d46d826ca9542d50614483172ba381f839edf8644f4309ed01acafb3b44eec1e5604e3e4e927d3b32"}}, {0x0, "35398ea183d892551a4230978f259d6d4899f3a684b35d6a0c57164518730aba9ec35ae68e7757aefce07bed0995a45047417c740a135640bbecd86401e87086bf4deaa33dff108d214e222806d3a01451299fd3c5c3718a06b0831ec20e0152d98c75e8"}}, &(0x7f0000000340)=""/171, 0xf6, 0xab, 0x1ccbb396}, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$TCSBRK(r2, 0x5409, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f00000000c0)={0x3, 0x81, 0x5d, 'queue0\x00', 0x1}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) creat(&(0x7f0000000040)='./file0\x00', 0x1c) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 682.849843] binder: 29347:29354 ioctl c0306201 200003c0 returned -14 [ 682.862693] SELinux: duplicate or incompatible mount options 16:06:02 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x92ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000600)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000100)={0x494, r1, 0xc2b, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xbc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc2f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x3e, @mcast1, 0x9}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0xfffffffffffffff8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x46}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8234}]}]}, @TIPC_NLA_BEARER={0x118, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf56b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffff7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x101, @mcast2, 0xffffffff}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8}]}]}, @TIPC_NLA_MEDIA={0x74, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MON={0x54, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x800}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1b}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffffffffffe}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xe19}]}, @TIPC_NLA_LINK={0x30, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x41ca}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_NET={0x58, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x100}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xb32}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8000}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'nr0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x0, @mcast1, 0x9}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x4, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'team_slave_1\x00'}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xaa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ce40000000}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'caif0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x30ee}]}, @TIPC_NLA_MEDIA={0x78, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16493b3f00000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}]}, 0x494}, 0x1, 0x0, 0x0, 0x20048081}, 0x4000080) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r3, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000000)=@ethtool_cmd={0x7, 0x0, 0x70a000, 0x0, 0x0, 0x0, 0x2}}) [ 682.899436] SELinux: duplicate or incompatible mount options [ 682.906079] binder_alloc: binder_alloc_mmap_handler: 29347 20001000-20004000 already mapped failed -16 16:06:02 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xc1ba3a200000000}, 0x0) 16:06:02 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x1) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x2, 0x161c40) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f0000000340)=ANY=[@ANYBLOB="080000000000000000000000000000090000000000000000000000000000000000000000000000002d493ca9bc4ba5b9bf0316c52582e9fb3dd38dc0e61ddabbb62f917b49fd45cf7cd84c45a7c16d56f1500e16de1d8f6a040451bc3351348139c44728e1a915b2bfb28aa480e1c439bc865d0873917b76afbcc4f956c4a192"]) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0xff, 0x9, 0x548c, 0x10000, 0x4, 0x5ea0}) accept4(r1, 0x0, &(0x7f0000000100), 0x800) mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x6000, 0xffffffffffffffff) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x106, 0xb}}, 0x20) [ 682.978651] binder: BINDER_SET_CONTEXT_MGR already set [ 682.987724] binder: 29365:29369 ioctl 4b47 20000180 returned -22 [ 683.027891] binder: 29347:29354 ioctl 40046207 0 returned -16 [ 683.065986] binder: release 29347:29354 transaction 1517 out, still active [ 683.072492] Started in network mode 16:06:02 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x93ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 683.079108] binder: undelivered TRANSACTION_COMPLETE [ 683.096682] binder: send failed reply for transaction 1517, target dead [ 683.103207] Own node identity 6, cluster identity 256 16:06:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xfdfdffff00000000, 0x0, 0x0}) 16:06:02 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xe00000000000000}, 0x0) [ 683.162408] 32-bit node address hash set to 6 [ 683.200986] Cannot configure node identity twice 16:06:02 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0x1) [ 683.249393] binder: 29388:29389 ioctl c0306201 200003c0 returned -14 [ 683.275796] binder_alloc: binder_alloc_mmap_handler: 29388 20001000-20004000 already mapped failed -16 16:06:02 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x94ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000600)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000100)={0x494, r1, 0xc2b, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xbc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc2f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x3e, @mcast1, 0x9}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0xfffffffffffffff8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffff7}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x46}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8234}]}]}, @TIPC_NLA_BEARER={0x118, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf56b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffff7fff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x101, @mcast2, 0xffffffff}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8}]}]}, @TIPC_NLA_MEDIA={0x74, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MON={0x54, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x800}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1b}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffffffffffe}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xe19}]}, @TIPC_NLA_LINK={0x30, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x41ca}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}, @TIPC_NLA_NET={0x58, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}, @TIPC_NLA_NET_NODEID_W1={0xc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x100}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xb32}]}, @TIPC_NLA_BEARER={0xcc, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8000}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'nr0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x0, @mcast1, 0x9}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x4, @mcast2}}}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'team_slave_1\x00'}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xaa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ce40000000}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3f}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'caif0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x30ee}]}, @TIPC_NLA_MEDIA={0x78, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16493b3f00000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}]}]}, 0x494}, 0x1, 0x0, 0x0, 0x20048081}, 0x4000080) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r3, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000000)=@ethtool_cmd={0x7, 0x0, 0x70a000, 0x0, 0x0, 0x0, 0x2}}) [ 683.302667] binder: 29393:29396 ioctl 4b47 20000180 returned -22 [ 683.354622] binder: BINDER_SET_CONTEXT_MGR already set 16:06:02 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf00000000000000}, 0x0) [ 683.387037] binder: 29388:29389 ioctl 40046207 0 returned -16 [ 683.416841] binder: release 29388:29389 transaction 1521 out, still active [ 683.435244] binder: undelivered TRANSACTION_COMPLETE 16:06:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x800, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VIDIOC_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f00000000c0)={0x0, 0x0, [], {0x0, @reserved}}) 16:06:02 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xbf00000000000000}, @addr={0x5, 0x7ff}}], 0x30) [ 683.471670] binder: send failed reply for transaction 1521, target dead 16:06:02 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x1, &(0x7f00000000c0)=[{&(0x7f00000001c0)="db2fb505369925abc4b7906599f7281660f0f37660f8706e4ac9a02d1cfe2b72c7f4c13ad6ff19de7fef2fdfc1661bbcf46300b1d19fc790ffced07625c746f4cddef198c29e1e8f0e11dbe931e36fa358e5f2dbb748fc2fe386b0b009502b8233dd854f7a2431148d99ed32a1fa4ab4eb9d67d836cdcf395f383f923098fd17a32a948199827153901a54935d61e4c69ae99e2d06d248ceb0e42fd7bc55d53ae79240ee4dc24d5b73fab9d78640bfb35ea4d52b4f03688a4a8c75fa110ed22e4cbf7c0969273cad24f4a2ea9f55b2b6342dc45faeb01ebe2eab6614e6e9b5269b1b9ddea678862272e2d7", 0xeb, 0x7}], 0x8082, &(0x7f0000000340)={[{@noextent_cache='noextent_cache'}, {@noheap='noheap'}, {@nouser_xattr='nouser_xattr'}, {@adaptive_mode='mode=adaptive'}, {@lazytime='lazytime'}, {@background_gc_off='background_gc=off'}, {@noinline_xattr='noinline_xattr'}], [{@measure='measure'}, {@obj_user={'obj_user', 0x3d, '&+'}}, {@fsname={'fsname', 0x3d, 'eth0procsecurity'}}, {@subj_user={'subj_user', 0x3d, '\'eth0\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x36, 0x39, 0x33, 0x77, 0x31, 0x7b, 0x75, 0x38], 0x2d, [0x35, 0x77, 0x33, 0x63], 0x2d, [0x36, 0x66, 0x37, 0x7c], 0x2d, [0x31, 0x39, 0x3f, 0x7f], 0x2d, [0x77, 0x76, 0x37, 0x62, 0x34, 0x39, 0x37, 0x38]}}}, {@fsuuid={'fsuuid', 0x3d, {[0x3f, 0x35, 0x35, 0x3d, 0x63, 0x75, 0x65, 0x36], 0x2d, [0x0, 0x36, 0x77, 0x39], 0x2d, [0x0, 0x38, 0x37, 0x74], 0x2d, [0x34, 0x7b, 0x77, 0x36], 0x2d, [0x64, 0x35, 0x0, 0x36, 0x34, 0x35, 0x3e, 0x35]}}}, {@appraise_type='appraise_type=imasig'}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@seclabel='seclabel'}, {@euid_lt={'euid<', r0}}]}) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0xffffffff00000000, 0x0, 0x0}) 16:06:02 executing program 5: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000a80)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$sock_ax25_SIOCADDRT(r0, 0x890b, &(0x7f0000000ac0)={@bcast, @bcast, 0x3, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r1 = socket$kcm(0x2, 0x7, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=ANY=[], &(0x7f0000000200)='GP\x1a\x00\xf9\xd3\xc4q\xb4\xa5C\v\x11i\x1d\x81\xfbK\x9cI\x10j\xb3\xa0\x1e\xaan\x14\x94\xe1\x01\x12\xf6\xe5\'\xa7F\x96\x1b-\xa6a\xbc\x05\x17\xd1\xfe\xd1$\xf6\xef\xb4)-\xc4\xc6\xdfR\xa2\xc0b<\xdc\x1a\x18v}\x96\x1c&\xd3\xaa\x8cc:#Ig\xdf\xe0G\xb1Y\x97\xef\xc5\xa3\xbbR,\xb098F\xdc\xc3\xf6\xe7j(\x865i|d+<\xc7\xb3\xb3k=\x13T\xddP\x87\x12\xa1\xf1^;T-\x8a\f\f\x9as\xd1\x9d\x95+\xce\xf7\xd7\xd5\xcbp;D\xc4\xf1~_v\xe7\xa2\xf9\xc4N\ao\xb1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2, 0xab93031f99fda67f, &(0x7f0000000080)=""/251}, 0x48) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$FUSE_OPEN(r4, &(0x7f00000004c0)={0x20, 0xffffffffffffffda, 0x2, {0x0, 0x2}}, 0x20) sendmsg(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000000)=@nfc={0x27, 0x0, 0x2}, 0x80, 0x0}, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x890b, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x890c, &(0x7f0000000000)) r5 = open(&(0x7f0000000300)='./file0\x00', 0x204000, 0x0) ioctl$LOOP_SET_DIRECT_IO(r5, 0x4c08, 0x9) setxattr$security_selinux(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.selinux\x00', &(0x7f00000002c0)='system_u:object_r:scanner_device_t:s0\x00', 0x26, 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000500)=0x1ff, 0x4) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000400), &(0x7f0000000440)=0x4) execveat(r5, &(0x7f0000000540)='./file0\x00', &(0x7f0000000640)=[&(0x7f0000000580)='bdev\x00', &(0x7f00000005c0)='system_u:object_r:scanner_device_t:s0\x00', &(0x7f0000000600)='security.selinux\x00'], &(0x7f00000007c0)=[&(0x7f00000006c0)='security.selinux\x00', &(0x7f0000000700)='security.selinux\x00', &(0x7f0000000740)='posix_acl_access&\x00', &(0x7f0000000780)='security.selinux\x00'], 0x1800) 16:06:03 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x1000000000000000}, 0x0) [ 683.636915] binder: 29413:29414 ioctl 4b47 20000180 returned -22 16:06:03 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xfdffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) [ 683.700104] binder: 29413:29427 ioctl c0945662 200000c0 returned -22 [ 683.708168] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 683.728072] binder: 29423:29424 ioctl c0306201 200003c0 returned -14 [ 683.732465] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 683.761693] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 683.774889] binder_alloc: binder_alloc_mmap_handler: 29423 20001000-20004000 already mapped failed -16 [ 683.787884] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock 16:06:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/checkreqprot\x00', 0x34500, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000040), &(0x7f00000000c0)=0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x40}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000140)={r3}, &(0x7f00000001c0)=0x8) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:03 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x6000000000000000}, 0x0) [ 683.822271] binder: BINDER_SET_CONTEXT_MGR already set [ 683.840315] binder: 29423:29441 ioctl 40046207 0 returned -16 [ 683.847942] binder_alloc: 29423: binder_alloc_buf, no vma [ 683.854419] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) 16:06:03 executing program 5: io_setup(0x0, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2000, 0x1}) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000080)={'raw\x00'}, &(0x7f0000000100)=0x54) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 683.900423] binder: release 29423:29424 transaction 1525 out, still active [ 683.908019] binder: 29423:29424 transaction failed 29189/-3, size 24-8 line 3035 [ 683.916310] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 683.931072] binder: undelivered TRANSACTION_COMPLETE 16:06:03 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xfeffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) [ 683.977656] binder: send failed reply for transaction 1525, target dead [ 683.984959] binder: 29423:29424 ioctl c0306201 200003c0 returned -14 [ 683.993585] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 683.994459] binder: 29445:29447 ioctl 4b47 20000180 returned -22 [ 684.018083] binder: undelivered TRANSACTION_ERROR: 29189 16:06:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) write$binfmt_elf32(r1, &(0x7f0000000340)={{0x7f, 0x45, 0x4c, 0x46, 0xfffffffffffff001, 0x75de, 0x3, 0x7, 0x80, 0x0, 0x0, 0x10000, 0x221, 0x38, 0x1e3, 0x1, 0x9, 0x20, 0x2, 0x2, 0x3, 0x4}, [{0x7, 0x2, 0x1, 0x81, 0x8000, 0x3, 0x3f, 0x3f}], "6d120580bef3541d10ed56fe3dcd621d3cf585fc5f", [[], [], [], [], []]}, 0x56d) [ 684.029969] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock 16:06:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2, 0x0}) 16:06:03 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x6558000000000000}, 0x0) [ 684.170914] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 684.253864] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 684.271437] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 684.289291] binder: 29464:29465 ioctl 4b47 20000180 returned -22 [ 684.304708] binder_alloc: binder_alloc_mmap_handler: 29463 20001000-20004000 already mapped failed -16 [ 684.318999] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 684.348002] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 684.349606] binder: BINDER_SET_CONTEXT_MGR already set [ 684.370256] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 684.394360] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 684.410114] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 684.418943] binder: 29463:29467 ioctl 40046207 0 returned -16 [ 684.428250] binder: send failed reply for transaction 1530 to 29463:29467 [ 684.435920] binder: undelivered TRANSACTION_COMPLETE [ 684.441527] binder: undelivered TRANSACTION_ERROR: 29189 16:06:03 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat(r0, &(0x7f00000023c0)='./file1\x00', 0x10200, 0x11) r1 = open(&(0x7f0000000000)='./file1\x00', 0x40000, 0x40) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000080)={0xa676, 0x81}) sendmsg$kcm(r1, &(0x7f0000002380)={&(0x7f00000000c0)=@l2={0x1f, 0x1ff, {0x6d, 0x80, 0x7, 0x3f, 0x1, 0x3ff}, 0x8001, 0x8}, 0x80, &(0x7f0000000240)=[{&(0x7f00000001c0)="d448899f927b31267a854b57ad3227c4acdfa4104623423ef0baeb4df759e87370ac96df7e0384a59e15607c67608ed9edecb84a2b15c273137bf894fd636ac1", 0x40}, {&(0x7f0000000200)="15496952f3507148af70c5ed3dc6f5fa28a5202671c774894fdbe48d2587f8880107d1b1f53cc4f22a415fcd557355", 0x2f}], 0x2, &(0x7f0000000280)=[{0x18, 0x10f, 0x8c, "f34579c3"}, {0x1010, 0x10f, 0x59d, "b64ff489160b79117bd1dee9114af112a3ffe9c66672e224a2e82c3350855e28ca5655e7f0e0f1846841518b2817b9e8c38ac17fe6a4a6b5295d12682c43e1a94528b78d3af1cf8552c387908640d8e6ab7995a8c6c6ee3af3703623e7ff1bdb773fa7ee6597e25daa889ace8c8ecf5cbb41a5910e615342da27879e75b4bb1913c75c18fbea205d62f15b3e14323093d46b7275a992930885d2fb59068d631705e14491591b8a26da647fc2df88986cb25caa8c8efde4ce945965f755f4fe73b4f4b8f76e728609ef990451eca346b1fc53c32739413c04a04e1eff9e55b8dd36661d799923201d3515e4280038663140993f3a48ac453d0e4d535e4d45849ec73a27b094cacd58fa25b6c3c83d290856b7de8a8d7358e0e415b50ac593f87ec41d659e0cb3316569abe7d659670b82768308ef5cdcd54bb664f69220bee05e5a8fa0905c6ed13f6b9fac3a6d7181aa7c5c5ceb50978509ea3951ef0bb9745aebd97c22aa6b209474303baff5a5521ff84b8ddd0d0142ba9a60175de47acf7151905ba287da1549b0967bbf5c1840cf0f1aa75d569fa5e7380484e79284974ffa6312952877fa3f356eb1e64312558678993db25514fc5f2c480804896b1a84ccde04f2e08a32170f69a2ef97e8702f9a2f79034f1ba4aece9c78a86232c689efed0eaf75319a257810fbb4df1c583c82d47c7ef60183aff723019d722b4e29a5531438ce4610affe59eb837396aed69217ab705f0590ba95c11ab1ec6d5d507a1d2b68d96858e6056c0e3e0bcd65a97401e158c94e12febbdc01a4fb89e8b9e37161ae2bbb671e599e95d89613035a218b8a61c54ddde88d47b11600515c38fa70e672f7caa800dbc822623afdcc1859d49fe3948c8fc37ca1638c3453ce1c754e337ebefe86abfcebeb3f759e6292fc131042462d903ea7c3fea7023ec285f8c7a7e24f2625f7aac0950a276b6a42c98f0cd95c17b2eeb06b9198e55feeccc61f87a3493772a7e7c716949358c7d6c67170125434cd0d3e960817a4520184f6f74874ed6f7807a029db8ddb92c59bf46162b741083a20f7736a024142345e1dc765d69a80285e1376e5e1250b9800854fe0a235b214a40964504178710a63ca4a0f19e2e60e7f5499120754331f5aa33e4465a9166df835246bac94c3aa9b10917b7b7be96b47149f0501dd61bb285223aca95b70f8756cacfce31e1bb1ca94493b1e2c92a5d70d440b7a532a5ab2f0d8fa73e650aa8d1591d3e8f6327b9135bf73ac97c5f2f86e6377bdf440d6449f7e3d8f5a934a3c0ff37d0cfe56fdbd229ca36cb0186cfbde54fe6c1983e93ee255b2f879d4300f31fbb0a0c49bc5551b46b2b6447cab271eec1b863e377ee61854fd94a48cf20c07ff25fb0f62c919662214f7ed697d7ea3b955642fe422119e9e549f149356b10b24106e1172e2c0ff07f78b2f3c486f8ea959ad1497c8acf75b79bbea96e055a61c7b6e4d408f64de8941c12d68ca240eab54e729e8a0a492444e5e358794dc1ccc4275391bbc0f48b2edba96443be50930d84ac9ed002d6f8c10717cff98626a163c782d2b8b607c665b7bef6b20f7cf572f707accf144e240ba9b23bc4d3a9828f5f7e7b07ad4cf1c41d4dc3f36b0fa24cfdeb55bdcef9216183cfaa9c3add56f087347dcf9b9b6002c684ac1b1a4daa5cc141f01b01f49acfe69b98d00fa43906affbd75bbe3afc8c8aac222d40bd8545eea9d91b31f2abb294643d43f28c8827850da0c54f4354cd2bb932b37eff7f33f9a9a71f5c52c76645a247da72541a26158a2f26a1bd84680a3c5398b0171a12e37d97cb5ab500be053a3e22af8db20413f0d02648fcc7efec3f25c3ec81cbdb00fc7141655d64f9c96f5fa7508ba16c2f93a2a6d979bdbb93ccdae8e3406f75a1d07ffb6b171ab6a2ec3d065335973331a8dfe4c1ef4d562abf2a55dacd950f86283c52b10af5d09912e04102a5c2098a8e1852fbc8ef1599c81323ca1d4ab2f492a070b1e131481eaea4a386bd465d164a25ff6ec810e92932666f1d84dda71e5d502054bdc62aa88d943371d50d789ea2fd1cc456885ca2afb5f650e3e4e0abd291727abbca93caefb6cb0ea9cac3c541d1922e8df9d67c00b36cdae8c3f406d91b051f37272db2d4ede6747e275ff3df0972f1762d0e3147291798679400e7adb8b304c708b3efa77f549bcfd2241f3d39fd1d0f202c225d04e0a49e4f7a77f778be97de3c913a34fe56945c741b8bf71912d7c77ea4689ff737819c2107af2de5c3c0b35f07acdcf245f9a5816656b90eac0b5b968369a6b0b3ff4dcb32147b156ab43796e904d42d3fa04c855bf45a2122a0a99f11e36faf8281ed6b107c2908229c200dd4f8f24150f586e16206965e71653d000cf172f2630419cadb09b51a38d667992800e93bec85cee8a529e11606282b238de99f4f93b0775804703b62115ae852320eee6499afe363445f26ea3ecf7c7fd7d18ee311daa0e6c8bf1b0f909b5fff7d9626acfe3a21e94b3874a8a6907f49fdb25ef008242ecae891e3fa1b679c460399da2738bbc16e33fcbf0976fdf153836001d4b0121105b0cdf8487bffb8b1b4806f91077d2cc5d47818bcb801ec9b684a6ce87d4613807dc523166575af3db456b06a799babb24691de448771552b6933f065a26d13b874e3fe8459610c199bcd97d96031b141ef22e4a15e577c2783283aa809b17c179648759b868005a368714316f00e33598aa41edfd19c59eb9191d3db3491550c93428691c9987fe3b2f92e7945989b4cfc73d999dc1823bdc3d73b4f16ba2ade7ecd6643d7012dfbbca0c9e052497270e282888e6dea4a0dfc0a12023eb6ea9667e70f979c1ff0c49e86863269df110e0d02d51a7e68ac3918bffc85ca8317d8f7a888a4fd6466a9e27b469271ed2197699b9ef0ce71ffe8e8b34fc0881ca0a20a168e317432b8951e7316dcd369dcd4db02af8a66f9e99f3dc543cc6be04120dcad831dcbff291a4e3d38436ceb7d63744cde9617eb92ad6f0b8fd802d12fac99f44a91595e8a090b00b354f1723f37d7b22deba15881283be8c2887dfe812bc9d6aba3392c841d61b816913c563587a38d5188735e0eba0bf8687a989c3f4af8b889e29094fb61887e8419c4da22cb635c41229d252ef35d59a9d2789363dd517799345e13bf0cc2a7f46aef533f76d2c8ee88e480a03fdf2c404c623fa482ed0b9abb2a9de81ef6ee4b62f7b5a84cad0e3570fcd92ffdb60178e93683a9ec07b21d1df0d601d43a01ebe91b997bbd02e8ce8ecd1887f48381caea42e9453607a50db05ba6c421e7c717e9606b8fe50130f0bcf0f0b29076ad5638a78440a583f6124015c6f95735547241f69dc98c59515639be4b4926ccad2d30679bb666055846fa0da421a6373932b883c43f639958fdc18f5aa20d691cd563671287f005cffa99eb6a1a45b8ab89ca05aac455a3d29353a525c7ec67dea083d74fd6a35cd6a3c6fe229bc310cc52d206444e75dcd70d0153e5b0549588d43676e882a7bf51d09a93993ebac0f5331a1439e543004618f78bca4b42250d4ffe1c5b7ac5bf48547518fa2408a12233405aa5992f270bdb7c57847989a0cab970044cc23b9f33afff097cccd2f6d48ace81d1c0a66fe15bf9261493d5ab654102a33667ea7a692c958ffb1444954d721d23b55a27c890336b9aa5a4b02bf9d946905b01f7cc00c89cccf1b54116fcdfc007c8824da8691080a8c1f0021731ea4cc51e66c134d1f6539e24e53ba2133f9f2d99231ff1a459056bfd9d1a598709bad52466497a179a720447efc0808ff9b8cd43f75302a55a6193c4f9580afc67f5aa46cb910326f06f52de30062990121d7f54b34ae02b7ccbb280c00ade909455b335e0e86a2778666fedfecb5548edc5a8b6105a59dd4d71f314c17aa3837db1089555af29abe952241fd7ad0a4b9e8c5441e31e5310c0d7d327b43ff119acdbdc89e081e7a0fe7c1142e601f834e48e5a37082587d0563d1428701a3ca0b70351e5af221df915aa0ce511667dafc02055d2bd3aa368e21116302af370e599e45cc8483733535b6e0982b4abae776cc10c4897af05f171c565fcff7b529fe60643b1a48a0fc5770156ba963a14031af5d630cb69a9f350c37c261978bd6cfd827862cf3ab4ff54b4bc201f74e171607a165509677a7ad49b62b6d8666de6b8a13d1df98b5914e560288d2c2ebc8d4e5e8373d324e25960aeaa9c04fca346d089a925bac8a337257a7fe427074401592829e2a98a4157f907b101eb67e83abc44e830a6162a546728dc1d5a7a163d4d735bdceaf971bcff9e77ebfc4f7baadf75dc2ae54fe506d7bf0a6eeac4fc53fba3102affcd68f4b25251c1978b8adc6b5b66eceec787687ae9d652e3311f6fbacb3d4738af7826e0a16458274673cdadec8bd0a86c7307ee0b0b3a38dc15b425e489e5f77f431ecfa2e2831c656667e7711dde7426d2a5f08b3232cfe65fdd6e67d81458147b5bbead15fa8041af5505ce3c3e2b35c2d688e0be806abec63f7a2147d28a97caf86aff5a50e04b7ebab800c5185cd5784307a18d2807ff633da6c079bf6b91e469959e32289f335096ca136cfa350806e8acfed39fc7a70fe2e5fe22dc45ac6d0c3c81680cfe709e4dcc2e5c903c23a1dbc9fd4fa0c27be7d1e38998df83a8cb74b5fafdd56565767e22f7ca276dfe20621c427ca7e215df9dc84eca9f75d56b51c28a4fda79b95590b9aee9010369e4d15b1230509cfcd468a2140187474894d4da7e0e97cd96b48d10c36082e6524b618904c14c0521921249f23e7eff0b7d33efb122bf7a39e5b290026e7a77ef20419ae0f5d88504aa5ae641b825f40c0738d304b3a25d0c8716d0c05d8746760d90f5cb922750fde17f856b90f978ce9eb4e7af20d973eba45013c6e98019cdeb265664721f0c9eb2eb8bc4596cc752d6ea187d9e7ca35a8f4943fa721e496b676b6afc58c852a3367b9c90443853ef0b67ac2924fd0885140d656e50f206faabc1b0e8a18771eff20ec7d2836607b69e76673cb428073052908310a7825adcbdb0e4de8819f421e2c4dca67b9d4c50478110b6de7194956cb02761747558191c80dc427e66d1bdcaaec8d391828b54c1ddd90c242bb8753780bd8a44b79d619d0c0db69b5911e3c402007c904b8c580f4afff0e0cd8b70dc6188162d23bee40254f2ea201d84669de165a02d6e37d0d3d293ecb28d640fe115a65d2e96ed8b648222b95796d36c7c31d21e078626beacfe326a23b97dc4bb8f5c113c4955ebc68ccfe2e969b5899fca349dbce0ff5cecbac938f78e8472f6aa5c9992cd93a9f8c7754aa06e52f337fdb12c1eda32b4b7161870e6d909f1f84c39d8de6f6e26b594585aa98fabceb48e2ead30eb89d1e306b10b4991d2f0aaaa1f8cfad03b7ff9a627e454bc276a6e0950fcd003244f36535f16f7175d54b8bcd84990a0955338f48fe456a628a47852ae4a3dba21c5254912444f6ce76ffb86cd1563cdb62d208bcb28acf69790572b1a5669d85068e642f6fb8c00be9851f709ca940e39acca2b9d7c98d2e36b1e94b052b593092a35d4ef32b499d6da0747904eb130c81cb22ef4c44d4f8a38788339b7d465ef72503ef02151253d97e98d054290edd8721025f303b628eb0fd705819a802b44d32fa63de2a253939b3c2fcca30824c01f9e779bbf117c932ecdecec14bf96d9aad2dbcc28fd0d6aea0a18be0ea365403045ace1aaa837d6fb618da7dac2573e0ceb9d3379341d7"}, {0xa8, 0x102, 0x0, "4f8397b332a462085dc267e68f9c223026a0213b6510816b6a3b203d31b196e8bbaa14fa7ef59ba83d0555d1c71f48fa0bad51da4d15f2b3ca1ddc10f3c44b4cd96d631b3cbc15cd96eb369407b6b8444a397c88f50a426ea20ea4bb1e8b4b51e19cb218f158022a15d3e9d7567e06e813deae27bfe3d68401b360624d80dbc15bb12175da986479188c02b21d13c8599fa8b2b18eff"}, {0x1010, 0x1, 0x8, "77c7e6df59b8a6308f1a9fa09959e2d45e7bd1016e3c131a9c7716f2baebe3f1f473812906e0026ca218ca1dffa114ff5a3f232644e4c758c7444743a0abb9d123e2d058523cfd069d72bec26b584da23ed2e88171564160c928acd9ee41428430489ab802cd2e9a70b1a536602092ca7962fc17262b1aeb9273038b011368d6c1bc9df5cc424b3fb5ea464de12ad4dce25a1c3122670f95bb2c01a2e3b8be02b4535033fb7348d2ddfcad07af1eac61697c457e17b559eb1f7837e405420a6eb7deacb8c2d3b780e94e381d71bc50d03fb6168e2289662d4eb5e25783e260d339775bddf391216d1d0a2c98043df09d2d15ecd5656ca90f6431855e59eff9769b615c5b3d81f77962becd38c7756cfdaadbf7559719c48fb5af8a3c49da3d7da00034a9cafb6a4acc86c31c1d141b769551c275544f7d700c1791cf0812ae95ca7c2f706a19dd6adf5077e2c0e709b1f727d2d36d6490d685364212ec7936d4c3403218bcd3e4f25e3980c581f1f58fb62aac79e32707684e32ae7067e26d94c460dcb7093df54dd87042c4d7fa800284ef7960849c18f9e056752638177ed8e13d2937dba6e47f4cd4077e4e082c9ed06d2787c63d4afed3ca82fe8a84c943b1ed14f8b0bc186248e2e01e73a2643b945800e71dd25522eb246e754f2353398be9ca100d17250f6b530ab41fa32a5adfe7c9362b0883d5383be63c8cc8883c769b780812228176a650681a650fa73dc0d4dee45047c3661b7062895653c0bede478e0f46f01beea589986292c8e025907faf5c68aed1ef4c80e625699ef0dcd14673374fedb4f688991944ed1cdb0734732fe1fe6975298672b24fc9b7038078de062b8b149520f024d6db6bce4d95509541a055d0ee816a752b3bb065e2ea033854b259e593aa801850ae117be2c7d4e786209cd195bd911fb3e36f90cca4e55547cc9c82a2b66b9f19e07f85b9bcaac9be9a8d1d07ada7f8adf5c0918c5ce76b262955f5d8bab07900e31f1d4f43a5ad053a24caa8aad64c6ee131dc7826f8314ecd2a69120a0d3272509f23ff3593a81aed781cade13b6cf6ed6ddda5dfad2f1bc5a974db60d1e543965a382af2b9bb1990bd6c0da1efde346e5c707d5f1c6c8ca0b808c8acb4548ed445a724ff74f5d5b099ad1e69a487e01c44f29c199dec5ca2ed891ceef97818eb63593b1df2bd1bd8a4f8fd18280ef77233e692766990cf6c62f6e2d7e854ab79c436b4ae5c70349e444fa44bcf7b6120b5a84bee96853e0c9bbf1aba072d914850ccdb773bc5ada802d756a0c112e858c0c011ad440358f1397a3c750e080273ca7842c4cbb728b4312c5828edadb10559b6597dfddde27a6d721066e728be2fe6b521438793e509505c5d27ed5eea68c68cb114a381650f781a17801a181045dbb1dffd157292d3694263f2618258aa681efbe173bcdff6935c9bf9b543ea45f6997c764dd5b7e103f372ae2b54e4cd1b247bdbe0cdb4ca4cd6ce5683cffca810c1ac12b81d54aa720d2bb4d023c9ddf798e0b0e83f05e2c8bfbc89bdaf3cffc06f4d7b01672288ab705f542ae0b5a5b3ec96b2b86bc62dfb266fa36890285d82db23524b477520b4255cfe484add02cd85f493f5ea807a8e603e49d467ddf4e995cedc6d45e1a6ba6dae673aee52fbe640a9adbdaefdfd96b6cddf3adb56d5749bc7462173e4565bafa3c3e8c058cc2bcef9bba2d2e3b4c9c64c494dc4891dd4a74ba9133e7d374a5bf37adb12636f95c89f247bdb463fefe406de403d0cfce3a85386fc2aa202e00ed7a9a0cdfb80d6a855c4525d3e2f550cf9ce917a62d82f22dba6ab31566d139b0a43f26338aad682f563e273fe0cd7dcae22282b3703eb6a672189e608d994f480a4a2f2b12e8488e7a44307ea7e14841838e642746901f7ce7358032c7eff76a0f8f5b39da9dd664efaab1c2cccfc86d1313a6d7610ddddde4f6dd2fb849909c75e829dfe85ce003b40bfd7e72d287cd11152d61f22a9f1856989cb9b1a28adcae2d1b58421e685af6bc8cae8ce30d65ca8e052d9b655225d9b6ad987a1f593cff6ed324e8abb061230d7f0e0464d3e878c1793391d02e07c552bd67128046d111bc5aee43ec61f95e22f524b19f66515fba76d5bb33b713fdbe9298448164685c7f02896cdbcf5569889541cdb7c1c83e5b1a241c5f8186c217c7a126f5bae34e67c4380bc8e89a0d8838dacc4df2401f16bb0931e60f7c57cf7c77d4f6834039b811294fd909d7e0ba3eef581f3ac759abcb3378ddf6486fd16d6da54c1777779ba3fecdc87fdd8413038f9c0da9b6f563be0f8934359dd9bd062fe30bf6e35fc851f3b913459b9bf1d229c485a685f4b2e7f450f467a12f35d13825a3a5331a2351cb416bb89a16ea98eae64d9e43687920db445913301b1d2eb52943f902b868895f88ca2ebd41607300683c7643738871690d165df595d784c10946ba93dcfd7f49507a2f7747240ab51008942b6e583a3a2ced494fb032710f90587a5cc50e9fa6842f4e41efc8ae6261affe325bfa346fd0a69833b770b6daa778b1fe06ba60a6f6d93f2d30ff4602edb35a8f882aa05605463da32b31701c4f620d39edc04cf2029e7001b40583d066d336e1243d98e0e77a6e4237a3645f0d68fca561568b8330e353529d85a54053060ba4508f41d171cfe62a3837387a50d5be5de61ba738bce1538bdbf0fce6fd50c6e905e28bc2326fc9c7b42a526fb313dda0d023ee0adca982e1e56fb489296df528c17e5a985b50d89fdfa71d50dadda79dc2c3b2fb792abdf2eaccdffb74f1b10c165f3ffa5d66a813b42e903b5a08c8fc3b9d6869b5ed1a11f1835607939103dbb8fa6f6173ff82861fd3edcc579ad5325889a08c489538400c4cd10de29dce34dada3c2b0be64528089d612881badcfda12f2f1d0b8117bb41267ebb3f7b512acf7ffdf27714d1047ffe66588324846c4bd308f442673f8bc6105621bbb5c36ce464a5f835c9a26db056adc861cb3b936036b6f5bcb6cfc7cacce52216df313b008b7aa7d2c26a257a5536cc461de95a1c24c74d9a6a59e3a27101f4b85315cd749124e92ecc5dbb5b4868d1ed80a0f0a1171bcb9b3c37aa81e319ba7eedeb275cab6756d8d2e1e2c342cd59c530d57cc4757d1850cb2e6ca2e336b96e7484ad0170c33c2faeb887bfe0fcc2f77bd510d46852e90da2f24405864854b0f09ecdbf2391c95e2d8e4957d2bb7bbb48c42dff0ac5b0cd2c89a960a8cec419f5de3dbb7964f4e56bc5535d3af20a41eba0769d6429b4f53a9386987badc954f80e408612882c336976ad82c5e787f1fa1f2e283ec95e7c969c18388ab37661175ff2c4861d35d19ba6ffce472fe67a2612986b741b2a17741b82365ec90f68600d878da496979c44fa873871a79caac8cd37f56122618111efab24b068148f909d7174bc7acc83d80d8525129d5166c58d039db1933777aece11c0df28dfa52471d53e39f80346097e7f5de64227137b934c7de82ea84a3c357f686893105fd0e5360c0646eee846f56693db5d978f2cd27ac8a8b9802d833a8488acd7ea23be54eaf3502a8548d77ab67e57f60b788ea16ef19d2e6e62d10f63b90c5bd4e9a06195ac49932111a5cc69508e0999a1b193a1016e74de1f935eb0103d2676fc02e7b6d5cd5e871bad4e57b528a6f7d21de439edee7c4e094d7b7820d8dd8b1905c5c82897904d4dff2cabfc26471b113659b87c751265cb19dbb33c9f451284485aed6297af27006c9c141f97874aca355dbeb6bcb1a228b4003badb73ce7180bf38ca7e363998652266fa98b18eb49040ce9548db0cd33c363d3957b4459172a22616833a9c8f11a0c8e686e979a9ae0b7d20bf53fb4ba15c1494c431858f644a6a3c7f890016ab461afd49f34d92e492b015ac343e159323a97e7a5c015eaa4fa471bfd91e84c8b3e85dce18eb57ac4bef6020f1bc5c18081fca9881264e953a5fe0a58f3f74154b3c2b686561115cf1d360b1961f3ec30026f4c8737681e266e9511d4aaa48cd82b1ea11d002de2d113cc1f28b66c3a1df153edfd8d67e860dba35d7fa7ca6b8796c35aec5488c3ed33c4c2fe485d69d7a88d54baea5100ff740531d169f7c1906d38ee3ea996fe24bef8519c4ca451a3f3249fbd60dc32c885d3c14ed8f51b9f518301854f3ed1272a1bcb7131d030227a6efa5d018a02a8f6d17f61b39258dab3222ac561be7f29b29de5736dc13d0cac42ed317dfffaa8784586a28cdc09a49d09bae3dfb321c37c9c14ea6a11235a5f86603cb3b479cbcaafbdd58fc7b966b75fba850736db77a887f8af2509871a9cff6505b133d9eca9ed300a1251cf400fdfe2ebbf25d08c9023e638f13e3376d41c3b4996b5f20af5293c42085a3ae1a6a64a9a1ec684e0a1274ddb54c827b76ca3cb890723dc37bc071c49ae0f43b4c46fbbd408f5f689dfcd307bee1aab7afb4fdfa6c13e293572d01e661f5a033630f90b5e448c1294908573a6bf899b10508d7604a59599e5db84c5b0236851affba84d46b542fa26f273c24d9cd2328717826bdf105844a6ff52b35bbe7fdf5cde6685416812c06c51734691c78eac348dffc16fd7f606da17153594aa7e3dd920cbea647c383558573ef24844a58009e03ab0f7cae7bf1550247f7873f07359c9f90189280cc876b51f3d7ea2c39b2d3a5cdafede1e510dd910cba26816239399055dfc905c1491cea5d26fbecc7790894c230b34a56a8720581c763a6be29526a8bb7022c50f2d0c5fec7033518c75899e5c1ab0096b7f37bd14dfb3a153664d49954a4e71f89b3dbe16381f7f9fc5a16de7ce38f249ac87ea2624732f6f5f4da1c635c7e70d466b7de9805a0b9a05a58d8042c652b28139b25a2e4b3c51c63ef1aa76328866ada1faad7c1c5d7642f3d9a5daae9db3c5ca5ff36a180869d95a626eb057d435787bc2410bb9284787da23217f92790244718344a099891f197d7c3e6b06c61ab5d268b18248fc2220fdb0895b30bef0cb2c287dcb3d5044d19ce1cff026ac1ee9311b95b158b412fdb8b45613133ab5cf483480f1010b9e5e4f55124cbd5d4813abce842963a522cfd67636cbfc9b049cd745586f3bc871049a442ff2ce5678e713454286976db6321b96e57f349c90c9ccca357c47fcb843d5341363418b711407205c49e94acbe055a24f567e285ea2786db82899eebf9fa59449a6e4197ee9c06e131752a6a6337b88fb6cebb9e1f26f97cff1da94ed40bbe027af094b4353a8878dbee672f3be79fa7aa1aa1ec022b4ce345b8b50023aa2afadaec0951783930adbd174b37355192a192ffe8109b8488a286055bc5e8880e58165fbb51d92c9e539f42a34a97fa6f380d400a0abf64a9818d4ea9a9c1dd94af73e9e2ad5f33efe661aad6fe75c53f8c0d0587b531e4be46744313800f1644df5ce25d39717429ec6487fbd402c4e00c4ea32b4275f38d1632ea7917e439bc0dab30431e36bcbc98d9d04bbc2513f5b3bfaea8d7bc90b92cdc6770ab7703b2d201d7c0d1355e90a38d83fd319f290a032e171a2995a24c2c2c4600cde54f5b3aeefb292ba1d485acd76f5017f38dbc89f8e5c5e90af41ece45d73354bdcec26f91e31fad6ee525c17f343571a66df080ad7b874ca7b00cd57415049d931080f34c913a2a9fdd0caf643db1b25b3a89a6de6a11a31af6db92f4f00e402c0f6ef5fd106fbd77536321a826bffc1f406113847c8be364755140375308bfad8614179b36c675e5de0e814353250ed9ff78f15a"}], 0x20e0}, 0x0) mknod$loop(&(0x7f0000002400)='./file0\x00', 0x6000, 0x0) 16:06:03 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xffffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:03 executing program 5: io_setup(0x0, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2000, 0x1}) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000080)={'raw\x00'}, &(0x7f0000000100)=0x54) preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:06:03 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x8100000000000000}, 0x0) 16:06:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000001c0)={r2, 0x50, &(0x7f0000000100)}, 0x10) syz_open_dev$vivid(&(0x7f0000000080)='/dev/video#\x00', 0x1, 0x2) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$video(&(0x7f0000000040)='/dev/video#\x00', 0xff, 0x240000) ioctl$VIDIOC_G_ENC_INDEX(r3, 0x8818564c, &(0x7f0000000340)) 16:06:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x12, 0x0}) 16:06:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0xfc, r3, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x854}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6246}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x80000000}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffffffffc01}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7f}]}, @TIPC_NLA_LINK={0x60, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4000}, 0x800) 16:06:03 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0xffffffffa0010000}, @addr={0x5, 0x7ff}}], 0x30) [ 684.606119] binder_alloc: binder_alloc_mmap_handler: 29492 20001000-20004000 already mapped failed -16 [ 684.645631] binder: BINDER_SET_CONTEXT_MGR already set 16:06:04 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x88a8ffff00000000}, 0x0) 16:06:04 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = memfd_create(0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x101600, 0x4) fcntl$setlease(r1, 0x400, 0x1) fcntl$setown(r1, 0x8, 0x0) readahead(r0, 0x6, 0x2) execveat(r1, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, &(0x7f0000000280)=""/102) r3 = dup3(r1, r0, 0x80000) r4 = socket$inet6(0xa, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000040)={0x20000000}) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) [ 684.695900] binder: 29492:29493 ioctl 40046207 0 returned -16 [ 684.751023] binder: 29499:29509 ioctl 4b47 20000180 returned -22 [ 684.781086] binder: release 29492:29493 transaction 1534 out, still active [ 684.795787] binder: undelivered TRANSACTION_COMPLETE 16:06:04 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x9904000000000000}, 0x0) 16:06:04 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) sendmsg$unix(r0, &(0x7f0000000300)={&(0x7f0000000080)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000100)=[{&(0x7f00000001c0)="b3c8fab7ab73f816290ba093f6606098d0bcb5de4c535b3e484637bbb39776763c1a63daad2c4a3b897c85fe00b9aefaae26b5c532988c19b6d17408c2c3a2ee34765b2e17245126b98f380228", 0x4d}, {&(0x7f0000000240)="7f23152001ff4020d80d081f5b7277e49e25c4b9af8fe470cf623e52749307de43db041830c11eeced2c2f9f8244a74c2ebf313c22c8a031c25439f95348b904fa53dd63ae3e583ab2f03dd31865c626bd7f297a9be463c5908fd45dccb0140d0a5ebb95d44cad1fdd48b69947b0e7da129507c7c5c53b491e0bf3e46c6e79bb6fb53ba4648082c0dfa64322ad4a5f15803ef93ddfa17b2815be5755e7b8b5cbe2a5f6616df491efa50b27af7140a7f6a1c9d2fa46", 0xb5}], 0x2, 0x0, 0x0, 0x1}, 0x20004014) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:04 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x2}, @addr={0x5, 0x7ff}}], 0x30) [ 684.824336] binder: send failed reply for transaction 1534, target dead 16:06:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vfio/vfio\x00', 0x705400, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000002c0)={0x0, 0xfffffffffffffffb}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000380)={r3, 0x22, 0xe4, "f7b5f1a2c94f61c66110663b2344b7b513733b494cfabe0a50adc6558ee15cf8221e1b6c2330cb519ed49433e9d283ffa050d763382a314ec5572b83af779b62d97cf54adab515499beab646d647cba26ad58ea648059f1d9fb596632a05a2d000a6da91a57eb9052f0c65bf78cbf040757f4e93f04cc12ddbc744d9d6cdeba5081640b86d2f1ebd28ce9ebcd08b667bb9bd613ff1f6be848f5d53eb898766cb2b8635b6c76732ae3235bda9b4ec9c6b38f69e5fc254d74da54a4bf62c9d67110ee28e7a320b04c8ac496d28e5c4963b7433b7fc2ece6b4105a2ad38dc3842b136c0da62"}, 0xec) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x80003, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000100)={r5, 0x5}, &(0x7f0000000140)=0x8) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_GET_NO_NEW_PRIVS(0x27) 16:06:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x14, 0x0}) 16:06:04 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x9effffff00000000}, 0x0) 16:06:04 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 685.088378] binder: 29528:29529 ioctl 4b47 20000180 returned -22 16:06:04 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x3}, @addr={0x5, 0x7ff}}], 0x30) [ 685.138866] binder_alloc: binder_alloc_mmap_handler: 29530 20001000-20004000 already mapped failed -16 [ 685.184410] binder: BINDER_SET_CONTEXT_MGR already set 16:06:04 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xc00e000000000000}, 0x0) 16:06:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0xac, &(0x7f0000000140)='1V\x87\xb7\xc8\xea\x88\xca\x16\x16\x8a\xd5\x88B?/L', 0xffffffffffffffff}, 0x30) sched_setparam(r1, &(0x7f00000000c0)=0x30) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$SG_IO(r2, 0x2285, &(0x7f0000001a00)={0x53, 0xffffffffffffffff, 0x82, 0x7, @scatter={0x9, 0x0, &(0x7f0000001780)=[{&(0x7f0000000200)=""/231, 0xe7}, {&(0x7f0000000340)=""/130, 0x82}, {&(0x7f0000000400)=""/18, 0x12}, {&(0x7f0000000440)=""/10, 0xa}, {&(0x7f0000000480)=""/219, 0xdb}, {&(0x7f0000000580)=""/194, 0xc2}, {&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/105, 0x69}, {&(0x7f0000001700)=""/116, 0x74}]}, &(0x7f0000001840)="2b32e5586914e8b712cf5294bc97c60dbaf6a4529ac8061a39b68a6d41ba6395be2fae889791ef965841d738b9e6212455c4d4b22832ccce615644fae6969d3c448ce47b8a72db891704b7ca6a0ee57787a32c6a01d9fdc3dd203e441838659dea7f35f235c3c6a48658a54c67249fc44145237a3267cb749393a15e4f7f2b27542a", &(0x7f0000001900)=""/139, 0x7, 0x2, 0x1, &(0x7f00000019c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000100)={0x15, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 685.239244] binder: 29530:29531 ioctl 40046207 0 returned -16 [ 685.259713] binder: release 29530:29531 transaction 1538 out, still active [ 685.264818] binder_alloc: 29530: binder_alloc_buf, no vma [ 685.266739] binder: undelivered TRANSACTION_COMPLETE 16:06:04 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f0000000080)={0x1, 0xfffffffffffffffb, 0x2, 0x8}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'veth1_to_bond\x00', 0x0}) recvfrom$packet(r0, &(0x7f00000000c0)=""/12, 0xc, 0x120, &(0x7f0000000200)={0x11, 0x2, r1, 0x1, 0x2}, 0x14) [ 685.299346] binder: send failed reply for transaction 1538, target dead [ 685.341256] binder: 29530:29531 transaction failed 29189/-3, size 24-8 line 3035 [ 685.411108] binder: undelivered TRANSACTION_ERROR: 29189 [ 685.428461] binder: 29549:29550 ioctl 4b47 20000100 returned -22 16:06:05 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x9, 0x301100) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0x8) r3 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0xc0505510, &(0x7f0000001000)) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={r2, @in6={{0xa, 0x4e21, 0xfff, @remote, 0x9}}, 0x7fffffff, 0x2, 0x5, 0x3, 0x20}, &(0x7f0000000200)=0x98) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001240)="2e0000002800813ee45ae087185082cf0124b0eba06ec40000230000000008000f0000000000000051894dd65b2f", 0x2e}], 0x1}, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000240)=0x0) write$cgroup_pid(r1, &(0x7f0000000280)=r4, 0x12) 16:06:05 executing program 1: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0xc6102, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x9, 0x0, @dev={0xfe, 0x80, [], 0x25}, 0x5}}, [0xa500, 0x7, 0xcb, 0x5, 0x7, 0x401, 0xfff, 0x35c9, 0x2, 0x20, 0x3, 0x1, 0x9, 0x3db2, 0x40]}, &(0x7f0000000080)=0x100) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000000c0)={r1, 0x1}, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x3402, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r0, 0xc034564b, &(0x7f0000000100)={0x9, 0x20363159, 0x5, 0x8, 0x1, @discrete={0xfffffffffffffffc, 0x6}}) 16:06:05 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x4}, @addr={0x5, 0x7ff}}], 0x30) 16:06:05 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 16:06:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x6) ioctl$BLKALIGNOFF(r2, 0x127a, &(0x7f0000000100)) clone(0x400000008112003, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x81, 0x0) write$FUSE_POLL(r3, &(0x7f0000000040)={0x18, 0x0, 0x1, {0x1}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1200, 0x0}) 16:06:05 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x5}, @addr={0x5, 0x7ff}}], 0x30) [ 685.861575] Unknown ioctl 35090 [ 685.867922] binder_alloc: binder_alloc_mmap_handler: 29568 20001000-20004000 already mapped failed -16 [ 685.880691] binder: 29567:29576 ioctl 4b47 20000180 returned -22 [ 685.888578] Unknown ioctl 35090 16:06:05 executing program 1: lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000080)='./file1\x00', 0x5, 0x2, &(0x7f0000000280)=[{&(0x7f00000000c0)="90b8e85f3d1a2aba9558650267c0f9beef47ea0d41d5c63cbe8b28145ae0743f271b830729258c2a2762ca345124a70a089726b02b8fb41f03004265bb23eaee96dddc669e045bb261ac4968448a2dc13f1ca937a5233ba0d95c6824ca698c65277fe12014cb7591", 0x68, 0xe72}, {&(0x7f00000001c0)="0d5b82193550f183b82cc5c5264b9d0c2f1c188987ed94535fac5e15c079980f67ba1b901b60fbe43b91e344409a7d7049eded8102730ffcba118932aedf68d160413ca141257c0e3cd528bbc6278cf8428284e347c62d08284f25be60b1fe28057d27bd5e74125ed000998f520c5e137ab66153ce3fc36e12d8ba46d9b5999b8c3714843a7d37112b128d5ee2a5515f", 0x90}], 0x400, &(0x7f00000004c0)={[], [{@appraise='appraise'}, {@smackfstransmute={'smackfstransmute', 0x3d, '-md5summd5sum$'}}, {@obj_role={'obj_role', 0x3d, '%systemposix_acl_access\\md5sum{'}}, {@uid_gt={'uid>', r0}}, {@obj_user={'obj_user'}}, {@uid_eq={'uid', 0x3d, r1}}, {@fowner_lt={'fowner<', r2}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'em1nodevlo'}}]}) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 685.912764] binder: BINDER_SET_CONTEXT_MGR already set [ 685.913304] binder: 29567:29582 ioctl 4b47 20000180 returned -22 [ 685.925064] netlink: 26 bytes leftover after parsing attributes in process `syz-executor5'. [ 685.949920] netlink: 26 bytes leftover after parsing attributes in process `syz-executor5'. 16:06:05 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xffffff7f00000000}, 0x0) 16:06:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1400, 0x0}) [ 685.957754] binder: 29568:29574 ioctl 40046207 0 returned -16 [ 685.965795] binder: send failed reply for transaction 1543 to 29568:29574 [ 685.986006] binder: undelivered TRANSACTION_COMPLETE [ 686.000411] binder: undelivered TRANSACTION_ERROR: 29189 16:06:05 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x8}, @addr={0x5, 0x7ff}}], 0x30) 16:06:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000d00)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10010174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b19eeb299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c888c9ff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008aec1, &(0x7f00000002c0)) r4 = dup2(r1, r2) sendmsg$rds(r4, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x9, @remote}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000080)=""/117, 0x75}], 0x1, &(0x7f0000000240)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x7}, @rdma_dest={0x18, 0x114, 0x2, {0x5, 0x9}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000000180)=""/84, 0x54}, &(0x7f0000000200), 0x50}}], 0x60, 0x40010}, 0x20040010) 16:06:05 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xffffffffa0010000}, 0x0) [ 686.130492] binder_alloc: binder_alloc_mmap_handler: 29598 20001000-20004000 already mapped failed -16 16:06:05 executing program 1: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video2\x00', 0x2, 0x0) execveat(r0, &(0x7f0000001740)='./file0\x00', &(0x7f0000001940)=[&(0x7f0000001900)='smackfsdef'], &(0x7f0000001b00)=[&(0x7f0000001980)='-wlan1eth0@vboxnet1ppp0ppp0{selinuxkeyring\x00', &(0x7f00000019c0)='data=ordered', &(0x7f0000001a00)='ppp1wlan0+vboxnet0/vmnet1(vmnet1\x00', &(0x7f0000001a40)='^loGPL\xfe#bdev^\x00', &(0x7f0000001a80)='/dev/video2\x00', &(0x7f0000001ac0)='ppp0\x00'], 0x1000) r1 = geteuid() quotactl(0x7, &(0x7f0000001780)='./file0\x00', r1, &(0x7f00000018c0)="4814ffaae28327") ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f00000001c0)={"79fae1ceb39b90cee70bc4dd45e2dd03973efa34ad93980d8a05d8260409216b6ab2026c3ad7ed58d99d5377da6fe39b23031b02546a472d3641a362edaa152df2524e252dbb1a2735cc07cac8c1a0c36b7013df6e894df76b25354253c44de2a1cfa352872c1953f1ad712e15328dbf8bd6e599d1c5c96916204bff03bfe324e57b1a334e1ad58db69aa96ba458c7c15ad87a3cdb31d5ffd3a3bf1f7d73b9cf3be2c61f8974200a989cc8d8b7ea845fc7e757b53bc0687d7482934ca5c32eda0d63ec65529a2adffb6770ede6f4863147f6bd38aa4132625d28bcfc243edd8e888e3acec57f2940d3a7f5fed92a04287c6a8996a43356a092556b715d42dd0e0a87fae43012afdb992e090c794471da4cee56c41fb15121db428dde1295d360bbc303bf5af831a53da61e62adf19e75cb1710172cb470fcc093b9e3923a6ac7d6b5e75f42efe8b776232e256460b911e804dc81d30d24eb887608a80bee3eae004198cfa596154639eea9198a1af2560bf1f562b2392a42596fd52f8d8a45eb8f8b7074ebde24dce3cd819ece43825136bd36610d04b47019edae2ea6228fd9ec6d66d91f818234cb0baed4cabf1fc3ac698ed6408b96aa9a548d047bfbc1521f6c61c7503e8c4c234eadb95ddf192da18aa74f2a2ef7c604b0be3187363aaf8c701c65e8b724ad25463b2abf157435b60b6e465d162f66cb913526ede08ce91871ab8b0fd9bdcaf10934f2e2ac272c9f8f6555e6f48a0f226188d46b49c234465ff18deeeae8c9b148b3adb7a1dbfbe0659e9452bdee72fc372495042924a0b9d78e822eb09c8ec10eb55be744ddcdf7515894e69ea6f5acb728e1c648b9330bc9d28f1d64db0bf64c544d8be8f1d5ecfb7546623ea4a04c1214ae23ac855d080d5d2f3aa09203e0ace6af9e712569efaa8ec4df330b5b1e862f6f49e37175a485e3631c272ce93c21b777f046e6fb4a004cd5626c78ee5a014e019917a1c1934fbc160259df88580c83a23708bb4c290405338d1aa8a36c6f4eb1794104fea8bcbef66affbbad60ae1b638a4ef7948807acf796bdb6f750e565b99d79e4af177d2bf8bb7e21c8029369ed11723f54d16f26e64c7856324c8555d9b61087358f8bf4b8f010d48576924f6ec8f27a092a03989bce204c45f26d44d7eb942f648a1b3363147bfec21af235fdbf0951a10a436d32b584512ee42d80129ec553e754f23689a7967a3f23b6c3a22538230621628df2406e86b64d842a67e35e49ac99f0bad03f94e4e1466a74c29fc121507518258ae3aa9c5297999079e90939fb1ed70ad0b4c7ea827f4cac94cf02f559798007b7714112b46045cac3652ef5e73ce3cff26b78b3b2dc031ad91b8c6dadb388b16e4f2d9c38f82d3c102c7cf44ad89a79f011b1f78b70ee0e1cf4fb933bbcdf1dcbfa1e6fd59b0fdcc2851a28e4"}) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x10001, 0x0, 0x1}, 0x0, 0x0, r0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000001c00)) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x30, 0xffffffffffffffff) syz_mount_image$gfs2(&(0x7f00000000c0)='gfs2\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x6, &(0x7f00000017c0)=[{&(0x7f00000005c0)="28bb1d8f97e4e9d2c55fc033367725d8c57a81fa3eb2b9cf3d28bf36db1fe6e7d7d83635c4d6a403a2077a47698052f3ce728b2d9803ed5fc9e670f861917a43e2c953501823dd4cf36913b6ce7d0c734f43", 0x52}, {&(0x7f0000000640)="ba481c7d31a59da1ac8a2febe76c696512ef7cdc283838fe0031e108bf5a2a1238850d8e2e06e0186bff79ebc461db28039b543b80395e604cf578bec6d7304d776cf16f5abd9639a72d72dd893501234b10241b4c4c0901b59355ac5704e2e2b22932300f18ffc5f1b13d85a1e975ba10b8eb0ee2317ce5dedcda8151e5e4f5665f59231c0d15129f5d5700667137c09f433af32608acf65387cd086c1572e44ec44238f1064c82520053471a7ed0e0d5bd55c562da81c8a031ceeda41fef64c566c491cd7b32eacfabb7f3bdcde6e57d2d461ea195388652984e259c982b0e263eff3e08eb1e57f1e6357dd20ee1639bf11d0f9c0ce45cbc3d29961da0c4d83a9c1af663a69cc88cf2d57246fa807e6b73382d51b71c30f01b522266f1976dfeaebe9c296e2ba542d81c763823e545469c99898cf021d24d68bf823d666c1e963650d98dae1e8be05f933d11ae2c2383001387ea9ae14dfd4953ab008f5763b03d5093a2029a8d2b1c76b4f6049ed29d8368c614f05f6939b451ffa6f25e8ee09b9c96ab34c8167658c6e4ba4d04bc003713210e9f8c62be342d5af5c0eab8c856b47b05db68f2c016ecfcfd535255b44030bbeba4e3509d2b1cdfb5c7315992440d82619bd3af04b05e4be2eff789ddb677758958eb20f8eba0b387f889c6024927658e77314763141e684d809a1aeef2b718308aef1d11215ef3ba632887b606756f38582974f3a027fc5b7c61f70fb1c2f3bbdd2796073faba5b06fbab75a8a5a20052aed51f4c6c056c56d6bded67f00b16b9bfa583e46c67c401e94dea7d816dd6b554371eb71460b75a67922ed1342c428d0e637ab421e582e0425e76ca07e452d873b8dd72d353b186af56a522c1a79cbda009abe0d25360f2016d657aa1196cdf509cb69b2a01661811a622935d71cd00a95150bee168dbceb9a7b28f1a66ddea5d833903112b690f6e335c8ec7200c80fdc1e8515c34300e036047fe67140d4eb69d501dab0bec82b8242117e53efb4de81b18cdf31af31c6e55de836da93839f6b8b7e50eb0624beb929093d3c4e6d3b6d84cf301c8a7ebf65e8df312ba91f7d0c411d646878718a44fd450ccbd74aba20c9a6c28dcc1b4be0275dd3438f6eedc8f642bf336872975437e4a0a9fcb53db040ea43ec5ceef07c921dd6bd099c8af3eb3e73c4988a21822fcfc4e8b2e950b1ffaf150763ac3a7eb3bf080aa56ac599732980b56552af83905aa4ced0fd49b82ca82a509c2dafd7f31810c943e8f6804373db845d59f4655d72f0339e86eec856342835dd7ccda0b0987a0e64cbef9676749e2b283ce80e1e7c3b799107bff2d67de4dc1245e7599473197f1403629c083afccab9489fb2d388e7ad86303454a28953da57b027b963deae15fe237cf4f70a52c4ecfc3582e594fb57e9330f0129c0abaae1c60f778180beb9422ad62d2d9bbb2c1aded01519290fec174e02cda96d3a431e40a3e3d741528f2d731d69247a040e70bb12d4beded449cce85a0ec0e2e273ba60fc5d57810c053873e685135408ac39dd880b6b85d5eeee938ba7040c9d677efcb3a939364434210a13c4a59fd61163e00d318e6581fbc683925ca0b2d42566d50d67dd1bb4c4d3faeb9bacf36880150a998eae7219c134dfe24fbe8a3957c47cedd20c3589ce9ff3c95fb4c87a34ab83f5f08ec4da3f3734b22641b993f65a2c61d07abffa81a619434cc904b31ff57c3b52acc08e934bef04fd5b165f32d9d95e760a7e997e7a7c3affbe55296a3bd9cb89e398b5cbe609b992ffe520e080d797b1abd63b69368e0b43925ad2623bd7a945406df3bf815106f4b3435eff2dfa14d594ff9a50c102b7d8cf841df80b49c2e6f5569441430bf4cff504acb43f36a070bdf5b868cc6c54e58d11cee8977919266795bd5b7373e06b544471932af94271ea9cb17f0d6ba0ccc5687516d90940b0ee45021c7edb2bdd6b682da32caec0358e61a8116ab34b899e5fe63c98fd2a444c7ec5b07a10aa2b85f0dfc46e05862cab842f235dbed2ce8d324ed2e2e6ff1da1d11d3cb7efa5c90ec9d0dee0e502a9af96cf80aafcce254fc26ef9490aaff22a1f8dca7ef0d16ff4f4544f4da4542e6abc8ad17b426f4870369abd8cce3fbce8fbb2370568449033e68b06e6087a7c225ea61996d59f2f069e11481c69e6b52de74fcc71f680e2c17637e5a823313db85aed08c2e4ed0f2eaf0d1847cdade75e7bac2181f5575a61225e75a9330325c5a36b9365c000ebd948c898b175b98604b84da19bdc6d7da638bcafafa6f09aa6264eff8549a00d0610718c71fb0e5b9afa89c8cd10384a39ffab93567ced18f241d42f8f9c454f576f769d5f3f837e1363aa75fac4c20c6b80d2a19c955b81c65984fd236095be7f8d9c18a2f710f1b181721eb7e966d7da2b99cdce958f3853e6053e46cbb34b69e5da33beee17900e319295033c596ed824e8d4ce56728d0edfe460c4698b7e625d746a5ae63302a0847ebfb15e912dd2aa8e5e3a7aa04cf272c9512bcfc8f859ae1b368adcf90841fd9ddd4e49fce1e89a946c757e3961742868f6e6b4424ae775962c62e375defe46ed39f7c7e149258ee2e7f2a643b766f8fa279dbbf515af8b8d9a4e74bde7bd7a6e529d1e5200d1fa2948704826645c40218330a71f00d8789bf78759ec300899e5d0508c3d535165109f8686d1a25b354a4bca84e807cf57f8b7dd1863e36e8782183b846c3a530423b6d400b04073cccc77e14eaa4f1d3a696a1ab6bbc31783b4f77104cbea03f021c711e468fb8e6200808957b52c3f504172d70f467e7d5502841a71a81eb4968907e27f24a5f2b743fc484fc5f7cebe6081d2f89bbe0cd3905e716f94106e4122e36fe012df87d0a8dc7e842c1f5f217d70443997421d0fae8140d198d7c2298cfc1c8d85a89e107d48da1c6e4ba35793de762571648102f2e6e6b723373e3cc4e3d1b611e09b8918697b660f527fc04c6eb531632cb2182fff8fe24b28fc3b9273a3c8f1df46649405273c4d599ee34346b257fe544cac0d9279b18ae176105e431ab997a48af6a1a8b43e9b6c035e7e576c346e2f1e0756cb4022de4a2a2ecda1ebe03e2887d91be7d83b7045831c9dd42c8e86b5f9c06d68534fcc5088dae918110a5162e966833a411112d2fa747d93c3203f02f5182bcd90c1a2ef2cebe498efc42738c0528492215fc1008e2b34e84766fe37099c2d3dc10b5b3178a15ffd162d7a611891d1b4bf072e149e0b5ac4da80d2c460faee5fc5e55b074af8ef4b06d471ea28224ef54cf41c01bd9d5d4beb331d94da31a58184338b47708c2c6234e8b37f436563b75071358694b3a61fc905b9b2651949cac70d93e2fd0e1e86e8557e559e7c695bce57dba5d617711c509cd132dce441e34f231e35f3334fb9c4ecb8737cb4a3f347bcfb71560d3dc026909796eb782f996f9687c1fbe64570feafebd427182ff48635378ed5b7c81b16a8c8fba3f62bb8052a3b4240ac650d1d52f3e3f51a449e0f734fa5c923d27172fd3b59fcce36d3c67e6563380a14041995c29b384063f65279c8714724a3c1b152a895c0426abf168d9a1505b2e109e8f7a67203d6130f8c6b5a796be10c7ab4d2f092e5cd8842b88af13105bfd26ba8427c6127617a78b77b119b578c6ac65a4c53ef402aa76967f513d09846a540cb0fd90f4b1d2deed0492b5a05d00dfe5ad0a7bf53d3c3d426e482a4c7b79616ffdce440830df6c74ef32cf3037a7f63bf80979b644cfdaa2c662f9dce63138da9d64470435a2c1c00bd6fc28c8711c5de355039766f9b89aa6af33aae1bf00e773770321f04e1abff7ee807814754fba261db9eec5718bed6d25e33c9672b6be407880e5f38fb53f55383da2583f217641ca73f8f02adbd4f9a54c6b52767ec2a09a2c6509e76eb1262eb69c2b662803888c5e1a38e0ba41830c3f2a014c58fa2ef7b2f6fdb2a43fb87d31d31a2870d976eaca033713e675e59bce35355fa1d840534daf86807c954ca5deca68252968be8457179522e0b39596b3d873c245a8b82851341c5bcc8c828f5a2fbcd2eeca6ca46e2ac795beef92c7ba3fb65ce242cd531c050248782db54f920af217b7096d2a0453b726cbbadaafb77ebf2c58538306bc0beb341499e4968ec3a2caffec0c76a1fa1e8dcb0508b04df4eb8e946ae91b5949ed926ebfbe0f088ed543aba1430ead54c69cea8b89360e515a0cd3d5020b6791b56b3e616b177354b3b847b07b63a65f2a11b4b771388770d743cb7031d9023f333f5f47a4b0caad3f2e78d7dc2a08d3e7f37e6819a24e64f07276030245cecfad28392d94fbf99aa6830dc376aeb1e259a93306d37c913ca97b0a5608b51a2bb780f4edaaefe850725c66d1bc05f31a82f3cce48ba2d96f6ba866c2b4e837db1dd48808402cbb2612bfdd5ad33174556ac85d355623efb54ddd617e44d3c4ab8c088e85a54a5e68507df83f61d67168dd966400dcd86fee0828d23b21233c7a6b5ea2337be46520456b820d28c1fabea651ca93fb21a0032df6c7b0d99d7b63ccfd6acfa7ce50ab05cb744165651086762ad4dd07d85b83f846a3a96f8716de242311d9ce486646095038cbee8bb1bc61800e04d454e46995fc92e514c267dbf1ebe1b08e6d515fe1e3a1bed545706928ebca05f6e85bac6c4015ec5edf5c0921f2a366469a1a52da402c9c20bc349441291596438838901d5d415e3bf784b5721ee8883f111ee97bdae15c107cae1a468355ee82e75b4ad6e12f176be86afcf1f1a4e303324ef4d583abef4f02f260cbd8160b148f56cc727baa0c52862862180f0805a2980709ddceb6e8691ed70bbf727e7411637f93b802564882bf7607f94a3bb0b6bb92c813219190cf784ad19d4c1247da2fbcd8e29b044a257a06171a72de5d2355416cd61cc1345547c832f97bed0d87520e1707f80e4194816a22defe589a2c99e34dabbf4000c363dacdf4ffedec8975c7157261b3cbd29a879cf08629e29b5328973485e89f5bc6bc7659cce0fa70dc623cee764e9ada2e8f6dfb97ab88150f6730e007e158fb0c2422960c8e2c9c54fb745fae253e97985de9ff8f9a70bdc6dcfc48550dbcb1e246aec726c659c0b681e62d475b232512bbe149a5db0a9f4d949a795fc8fb4174bc42f06059be8541a73f774b96be350dd2af88f4f5bb071e29fd4f703f10ab0478721b4b15eb7233c4b074e814bf9d733a9e8cb450295409c3e1f02ed4124e75ca08fbb62ec753801afe6079e44688f74368a6155462749555df98cff5d77ba9df60ef67a83481030a9f3a478b161829e3544b87f18247e5ca5e850027701815ea37b9430f25628c87eb767dfa71340fde362ca73359c0eea60c80f46edc8ddd593dfecb1a15144b56468dfc36c23cc73a8973c48c98b8d18767f862b7b3ffeab50588c064a35060836f7783a150e011da5845a7e65c75029b04c4987a03ca5944cf69fd846ed5923062e8db3a228f19be489ab8e754b7121663d9cef62068a57be4dd13abd1e2faf9f0da8f4c17da9d7dee35a3d6a058afa4718fa3d7c76a699223c89e8b49333fbe375a90de7b183fb9ea80f3d344fc811d408b6634253c3b9d8121e2a2d300af449ad31f364ffaa972cc0a90a932099284e0821c6933598b680f30bc2078e1db51d85b32cc486da41be77ff76d5acc881cd85df12fe424ff25a2c6c9fc12e5c7798260eb48ba2f9e1de381f4f3b5e0f5549b0d081eb9e98ed17b823eff1d898dc79897854e945683e463a", 0x1000, 0x2}, {&(0x7f0000001640)="c535f309c09f50a33f550d213fab6e88f6006a45c356a1d83f3d15a913d43be3f2eb79474c4badfdf4833946fc23c180d6678644cae41f6454593e02fb1fe3964f8c17a95e94b9018058ba36821295f04ea2859d05ee803678c789bc0d15a3bda08cbe83713fec003fac3d072f55414042fb4e27f5fc84391a3531f4900102c069c584", 0x83, 0x4}, {&(0x7f0000001700)="75da40b8e774a87d6896947f82ce7270ced3220a54", 0x15, 0x5}, {&(0x7f0000001740), 0x0, 0xc1}, {&(0x7f0000001880)="20c3c2de51de817ac823c2a99391f3f28a352ca3019b710a746672", 0x1b, 0x1}], 0x204000, &(0x7f0000001cc0)=ANY=[@ANYBLOB="636f6d6d69743d3078303030303030303030303030303036322c646174613d6f7264657265642c6d6561737572652c736d61636673666c6fc33553be16cd944e6e757827737461747573002c736d61636b66736465663d2f6465762f766964656f32002c00dba2cc848fe4715bbd11045759058e8ac99c8acc8a487bd8f27b1f4eb408314e1d68adcaa1ba77939f8ac14b611f241198e06e20ec3dcf9fad2dec03d1aa6144d26b3e5152295220702f4a7de281251b003f034f7d35fe38f9f8f9a574543233227056ba6f6c0a72b15cadf70abd1d3e7f497ecf904f0af94f9f9f3ff51448c88d784e840a2b5a19a32e2b5e9dafc75e07e24a81319400d64cb38a3ee215d5d32d393d29a47eba0201fa809c8d173377658d841a65a800323cbcab8e7a272503c3ccbc31257561e733b758926e30600e02e4069ab660e6b30c2189d260f232247f15e0bfe01c3d897e16d9282693fdf93e86b022ee18328dd9f494040e2819dadbf6100e666febee9dd516000000000000000000000000000000"]) r2 = getpid() lookup_dcookie(0x7, &(0x7f0000001b80)=""/82, 0x52) waitid(0x0, r2, &(0x7f0000001f00), 0xc0000002, &(0x7f0000001e40)) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f0000001b40)=0x10001) [ 686.237622] binder: send failed reply for transaction 1547 to 29598:29599 [ 686.274463] binder: undelivered TRANSACTION_COMPLETE 16:06:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2000, 0x0}) [ 686.295048] binder: undelivered TRANSACTION_ERROR: 29189 [ 686.347319] gfs2: invalid mount option: measure [ 686.389631] gfs2: can't parse mount arguments [ 686.444799] binder: BINDER_SET_CONTEXT_MGR already set [ 686.451355] binder: 29624:29625 ioctl 40046207 0 returned -16 [ 686.477276] binder: release 29624:29625 transaction 1551 out, still active [ 686.495856] binder: send failed reply for transaction 1551, target dead 16:06:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f00000000c0)={0x0, 0x1}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000001c0)={r3, 0x77, "062950a774973baf1c5b62ff97db0368a69b9eac84804a76a549805f90f3bee38977a0f4e166b020c8f6b08c65f079ec47af7c9c25d73ab885ec9cda2ffaeb7f7f878f5acb8f5693870998a8b452ba36565ba3ed22849d6d2214f3f09b2959d5dd09b4bb720da7873a49269c160425acdf17617c3010f3"}, &(0x7f0000000140)=0x7f) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x4}}, 0x18) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0x89, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r2, 0x28, &(0x7f0000000240)}, 0x10) 16:06:06 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x42}, @addr={0x5, 0x7ff}}], 0x30) 16:06:06 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0xfffffffffffff000}, 0x0) 16:06:06 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x4) clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000180)={{0x2, 0x3, 0x3, 0x3, 0x4}, 0x80000000, 0x311a, 'id0\x00', 'timer1\x00', 0x0, 0x6, 0x3a, 0x1ff, 0x7fffffff}) 16:06:06 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0xc010, 0xffffffffffffffff) 16:06:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x3f00, 0x0}) 16:06:06 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x2}, 0x0) [ 687.068090] binder_alloc_mmap_handler: 1 callbacks suppressed [ 687.068108] binder_alloc: binder_alloc_mmap_handler: 29639 20001000-20004000 already mapped failed -16 [ 687.102966] binder: 29637:29645 ioctl 4b47 20000180 returned -22 16:06:06 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000080)={0x70003}) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000100)={0x40002}) 16:06:06 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xbf}, @addr={0x5, 0x7ff}}], 0x30) [ 687.145341] binder: BINDER_SET_CONTEXT_MGR already set 16:06:06 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000100)=0x240) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000080)=0x6) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) [ 687.201626] binder: 29639:29642 ioctl 40046207 0 returned -16 [ 687.207697] binder: send failed reply for transaction 1555 to 29639:29642 [ 687.223180] binder_release_work: 1 callbacks suppressed [ 687.223185] binder: undelivered TRANSACTION_COMPLETE 16:06:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 687.267611] binder: undelivered TRANSACTION_ERROR: 29189 16:06:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1000000, 0x0}) 16:06:06 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x3}, 0x0) 16:06:06 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x1a0}, @addr={0x5, 0x7ff}}], 0x30) [ 687.480998] binder_alloc: binder_alloc_mmap_handler: 29666 20001000-20004000 already mapped failed -16 [ 687.501678] binder: 29665:29674 ioctl 4b47 20000180 returned -22 16:06:06 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/168, 0xa8, 0x0, 0x0, 0x0) 16:06:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:06 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x4}, 0x0) 16:06:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00000000c0), 0x4) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f00000001c0), 0x4) [ 687.555399] binder: send failed reply for transaction 1559 to 29666:29672 [ 687.565263] binder: undelivered TRANSACTION_COMPLETE [ 687.590082] binder: undelivered TRANSACTION_ERROR: 29189 16:06:07 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x300}, @addr={0x5, 0x7ff}}], 0x30) 16:06:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2000000, 0x0}) [ 687.695819] binder: 29685:29686 ioctl 4b47 20000180 returned -22 16:06:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:07 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x6}, 0x0) 16:06:07 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockname$tipc(r0, &(0x7f0000000000)=@name, &(0x7f0000000080)=0x10) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r1, 0xc0845658, &(0x7f00000001c0)={0x0, @bt={0x7, 0x6, 0x0, 0x1, 0x0, 0x100, 0x3, 0x0, 0x1, 0x0, 0x8, 0x1, 0x6, 0x9, 0x6, 0x30}}) [ 687.873483] binder_alloc: binder_alloc_mmap_handler: 29698 20001000-20004000 already mapped failed -16 16:06:07 executing program 5: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) dup3(r1, r0, 0x0) listen(r1, 0x0) connect$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x16) 16:06:07 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x500}, @addr={0x5, 0x7ff}}], 0x30) [ 687.939280] binder: BINDER_SET_CONTEXT_MGR already set [ 687.968957] binder: 29704:29707 ioctl 4b47 20000180 returned -22 [ 687.986451] binder: 29698:29701 ioctl 40046207 0 returned -16 16:06:07 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x8}, 0x0) [ 688.020323] binder: release 29698:29701 transaction 1563 out, still active [ 688.020811] binder_alloc: 29698: binder_alloc_buf, no vma [ 688.033164] binder: undelivered TRANSACTION_COMPLETE [ 688.056550] binder: send failed reply for transaction 1563, target dead 16:06:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x3000}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:07 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x3, 0x2) ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x3) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0e85667, &(0x7f00000001c0)={0x80000000, 0x102, "98e43556911eecfbd6f3db1e34ae571d95c6916226d3b25ccabcaf0ba32fbbf0", 0xc9e4, 0x5, 0x81, 0x20, 0xd0, 0x2, 0x2ca5, 0x5, [0x0, 0x9, 0xffffffffffffff81, 0x80]}) 16:06:07 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x4200}, @addr={0x5, 0x7ff}}], 0x30) [ 688.207182] binder: 29698:29714 transaction failed 29189/-3, size 24-8 line 3035 16:06:07 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xa}, 0x0) 16:06:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\xc7\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r1, &(0x7f0000000040)=@known='user.syz\x00', &(0x7f00000002c0)='/\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xaf\x1f\x02\xac\xc7\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\xaa\xd9U\xa3\xc9?\x9d$\x8bF\xa7\xc9\x9e\xb3[@k\xf9\x18\xff\x01s\x9eV\x18{-\xb8\xf1\aD$tRq\x06 B\xfb8\b\x18n\n\x83q2\xf9\x10\x8cX0s\xa4\xca\x94\xb3\xe4\xe5\x87\x17\xfe+e\x9f\xa3\x90<{s\xbdf\xb8?^\xcc\nsa%x\x96\x88?\x1bC\xffN\xc0\xa1\xe36\xb9/pTa\xaf\v`\x82Zx4\xff\xd0\xa73\x9d\x85\xc5\x1b\x8d\xb7\xb4\xc0\xe4\xf4\tS\xdd-\x9f!\x10\xf0L\x9f\xdf\x84\x89\xea\xa9\x96', 0xc3, 0x0) syncfs(r1) fremovexattr(r1, &(0x7f0000000000)=@known='user.syz\x00') [ 688.254673] binder: undelivered TRANSACTION_ERROR: 29189 16:06:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x12000000, 0x0}) 16:06:07 executing program 1: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) write$selinux_create(r0, &(0x7f00000000c0)=@objname={'system_u:object_r:dbusd_exec_t:s0', 0x20, '/usr/sbin/ntpd', 0x20, 0x2, 0x20, './file0\x00'}, 0x4e) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffffd, 0x8000) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f00000001c0)=""/165) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 688.304461] binder: 29726:29731 ioctl 4b47 20000180 returned -22 16:06:07 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc}, 0x0) 16:06:07 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xbf00}, @addr={0x5, 0x7ff}}], 0x30) 16:06:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x208000, 0x0) ioctl$VIDIOC_G_ENC_INDEX(r2, 0x8818564c, &(0x7f00000001c0)) [ 688.495896] binder_alloc: binder_alloc_mmap_handler: 29747 20001000-20004000 already mapped failed -16 [ 688.557105] binder: BINDER_SET_CONTEXT_MGR already set 16:06:07 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xe9e, 0x8000) timer_create(0x4, &(0x7f00000002c0)={0x0, 0xd, 0x1, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) timer_getoverrun(r1) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e20, @rand_addr=0x1}}, 0x8, 0x0, 0x0, 0xffffffff, 0x77294cec38a11010}, &(0x7f00000001c0)=0x98) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000340)={r2, @in={{0x2, 0x4e21, @empty}}}, 0x84) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000200)={r2, @in6={{0xa, 0x4e24, 0xf92, @loopback, 0x20}}}, 0x84) 16:06:07 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x1000000}, @addr={0x5, 0x7ff}}], 0x30) [ 688.591723] binder: 29747:29750 ioctl 40046207 0 returned -16 16:06:07 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffefe, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) write$binfmt_script(r0, &(0x7f0000000180)=ANY=[@ANYBLOB='#'], 0x1) 16:06:08 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xe}, 0x0) [ 688.633419] binder: 29758:29759 ioctl 4b47 20000180 returned -22 [ 688.650002] binder: release 29747:29750 transaction 1568 out, still active 16:06:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40, 0x0) accept4$rose(r2, &(0x7f0000000040)=@full={0xb, @dev, @default, 0x0, [@bcast, @bcast, @default, @bcast, @netrom, @null]}, &(0x7f00000000c0)=0x40, 0x80800) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r2, 0x800442d3, &(0x7f0000000100)={0x8, 0x0, 0x2, @remote, 'ip6tnl0\x00'}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f0000000340)) [ 688.707402] binder: undelivered TRANSACTION_COMPLETE [ 688.718596] binder: send failed reply for transaction 1568, target dead 16:06:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x14000000, 0x0}) 16:06:08 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x2000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:08 executing program 1: perf_event_open(&(0x7f0000000080)={0x2, 0x179, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd5ac, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x14901, 0x0) ioctl$GIO_CMAP(r0, 0x4b70, 0x0) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x80) 16:06:08 executing program 5: creat(&(0x7f0000000400)='./file0\x00', 0x0) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0, 0x300}, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='xfs\x00', 0x0, 0x0) 16:06:08 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf}, 0x0) [ 688.853309] binder: 29779:29781 ioctl 4b47 20000180 returned -22 16:06:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x7fffffff) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = open(&(0x7f0000000140)='./file0\x00', 0x400000, 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r2, 0xc4c85512, &(0x7f0000001080)={{0x5, 0x5, 0x8, 0x30e, 'syz0\x00', 0x800000008}, 0x0, [0x7, 0x1, 0x6, 0x4, 0x9, 0x8000000100000, 0x10001, 0xd5, 0x101, 0x7, 0x8001, 0x200, 0x1, 0x343e, 0xffffffffffffff00, 0x800, 0x7ff, 0x1f6b, 0x100, 0x8, 0x2, 0x8000, 0x1, 0x2, 0x1c, 0x5, 0x6af, 0xd36, 0x1f9, 0x8d28, 0x7ff, 0x401, 0xff, 0x300000000000000, 0x6, 0x0, 0x3, 0x4, 0x7, 0x62, 0x8001, 0xcaf, 0x0, 0xff, 0x62, 0x2, 0xffffffffffffa08e, 0x10000, 0x1e55, 0x5, 0x27c6862c, 0x1, 0x200, 0x240, 0x5, 0x20, 0xb497, 0x21, 0x3ff, 0xfffffffffffffffc, 0x9, 0x100000001, 0x9, 0x18, 0x8, 0x4, 0x2, 0x7fff, 0x416, 0x7fffffff, 0x8000, 0x7, 0xfffffffffffff000, 0x1, 0x7, 0xb9e1, 0xff, 0x0, 0x1, 0x3ff, 0xa67e, 0x10001, 0x9, 0x401, 0x8, 0x7, 0x200, 0x200, 0x6b, 0x100000000, 0x4, 0x2c081bde, 0x1, 0x9, 0x36ec80000, 0x2, 0xfffffffffffffff9, 0x9, 0xcc43, 0x7, 0xfffffffffffff000, 0x1000, 0x5, 0x7, 0x8, 0x3, 0x8000, 0x4d2000, 0x7, 0x7, 0x4, 0x7f8000000000, 0x34e, 0x6, 0x1000, 0x2, 0x4, 0xffffffffffff7fff, 0x7fffffff, 0x5, 0x1, 0x101, 0x308, 0x7, 0x79, 0x4, 0x2, 0x4]}) r3 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x200) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000001580)=ANY=[@ANYBLOB="6e617400000000000000000000000007000000000000000000000000000000001b0000001b000000400e00007003000000000000820300008004000070030000700d00e86f0d0000700d0000700d0000700d00000500000034843d0e1e78601c272eedf5a406aa2f03f4384cddc8052fd5b850a9b0662be78775644a6b71aeb6600fd19a8a83bd3680e2bd12fbd9ca2ab69cdb6240093c3a630894fe6b07d95f6a67", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="ff020000000000000000000000000001ff02000000000000000000000000000100000000ffffff00ffffffffff000000ffffffff00000000ffffff00ffffffff76657468305f746f5f626f6e6400000065716c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000000000000000000000ff00070744000000000000000000000000000000180260020000000000000000000000000000000000000000000000005001686173686c696d69740000000000000000000000000000000000000000026261746164763000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000007f00000000000000010000006400000006000000c70000007f00000040200000ff010000000000004800444e415400000000000000000000000000000000000000000000000000010600000000000000000000000000000000000000fe8000000000000000000000000000aa00684e2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c800100100000000000000000000000000000000000000000000000048004d4153515545524144450000000000000000000000000000000000000000080000007f000001000000000000000000000000fe80000000000000000000000000002a00658600f800d3a06ee95e72a3b9ce8cc471f88500000000000000000000000000000000ffffff00ffffff0000000000ffffff00ff000000ffffffffffffffff0000000062617461647630000000000000000000766c616e3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b000000000000000000000000000000007700fd0410000000000000000000000000000000c80010010000000000000000000000000000000000000000000000004800544545000000000000000000000000000000000000000000000000000001000000000000000000000000000000007465616d5f736c6176655f3100000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a808f008000000000000000000000000000000000000000000000000e0077533320000000000000000000000000000000000000000000000000000000600000001000000d8f3ffff00000000ffffff7f0300000009000000030000000700000003000000a5030000030000003eb700000300000009000000030000000900000003000000fcffffff03000000fbffffff03000000000100000300000002000000ff0100000800000001000080030000000002000000100000000000006c930000f90000003810000004000000050000001603000001f0ffff040000000900000008000000010400000200000007050000a25c0000020000000100ffff0200000009000000030000002e0200000300000001000000020000000400000002000000250000000300000008000000020000006480000003000000fbffffff03000000ff07000000000000890500000001000007000000ff030000ff030000dd62ffffff7f0000ff070000040000000900000050ffffffff7f0000000000000004000002000000000000000800000007000000080000004b0300000200000004000000090b00000000807f00000000270000000300000006000000010000002b4f000001000000804900000300000009000000020000002a070000030000000600000001000000f9ffffff0200000081000000020000000500000003000000010000800300000007000000090000000080000002000000010000000000000000000000c829000007000000060000000002000007000000e200000006000000030000000180000005080000050000000900000004000000050900000100000000000000ff0100002b000000030000000100000002000000010000003b5900000200000007000000010000000500000000000000060000000300000006000000030000000000010000000000090000000300000000000000000000008602000001000000020000000000000000000000000200000600000000000000080000004000000007000000f8ffffff02000000fa650000d8000000ffffff7f0000000001000000ff0f000007000000040400000300000003000000080000000300000008000000020000000400000003000000020000000300000005000000000000004000000002000000020000000300000007000000020000000600000000000000050000000300000006000000000000000700000000000100060000008000000007000000080000002460000005000000000000000700000043000000010000000900000000100000050000000104000004000000040000000300000005000000010900000400000003000000090000000000000042ffffff03000000fdffffff02000000030000000200000018efe505020000002000000002000000090000000200000003000000010000000500000000000000e2585574010000002700000005000000070000000400000002000000040000000700000008000000050000000600000007010000040000000300000007000000000000000400000004000000070c00000800000002000000c00f0000ff0000000a00000004000000000000001f000000000000004000000003000000d7ee00000000000000020000010000000600000003000000e534000003000000400000000300000007dc00000300000039e400000000000001000000000000000200000005000000000000000101000001000000ffffffffff0000000200000007000000ff0100004000000005000000018000000800000000020000060000000100000006000000080000000000000008000000070000000603000007000000030000000000000002000000090000000200000000080000020000000180ffff03000000070000000000000040000000020000000101000003000000030000000000000085000000000000000600000003000000f80000004f000000000400000300000000000800030000000000000000000000000000800180000000000000080000000000010005000000030000000000010001000000ffffffff0800000004000000050000003f000000040200000000000003000000030000000000000000080000010000001f000000020000004000000000000000f6b64e3d000000000600000003000000ffff0000030000000300000003000000030000000300000003000000000000000500000000000100ff000000010000001f00000005000000010000005a6b0000f6cc27630200000029000000ff0700009d00000001000000ed0000000300000000020000a6aa00000500000005000000ffff00000100000004020000ff0700000000000092000000030000000100010001000000090000000300000000080000020000000500000000000000c17a0000030000000500000001000000e70000000000000000000000010000000002000003000000001000000180000005000000f8ffffffff000000cc7c0000ff000000010000000180000000010000ff0f000005000000060000002b00000009000000640000000100000005000000060000000000000009000000200000000a04000008000000030000000400000001000000010400000200000002000000030000000100000003000000ffff000000000000fdffffff00000000ff0100000100000001000080030000000700000000000000030000000300000060f8ffff018000009d560000010000000200000001000000000000800600000003000000060000000400000009000000ff000000010000800000000000000000fc0b00000600000025dd0000c1ffffff0500000058060000070500000901000048004e45544d41500000000000000000000000000000000000000000000000000c000000ac1414bb00000000000000000000000000000000000000000000000000000000006600670000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0xea0) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 688.913959] binder_alloc: binder_alloc_mmap_handler: 29783 20001000-20004000 already mapped failed -16 16:06:08 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x3000000}, @addr={0x5, 0x7ff}}], 0x30) [ 688.994759] binder: release 29783:29787 transaction 1572 out, still active [ 689.008491] binder_alloc: 29783: binder_alloc_buf, no vma [ 689.014113] binder: 29783:29787 transaction failed 29189/-3, size 24-8 line 3035 [ 689.014875] binder: undelivered TRANSACTION_COMPLETE [ 689.054473] binder: send failed reply for transaction 1572, target dead [ 689.094490] binder: 29804:29808 ioctl 4b47 20000180 returned -22 16:06:08 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x1, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000080)={0x0, 0x6}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000100)=r1, 0x4) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:08 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x4000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:08 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x10}, 0x0) 16:06:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x20000000, 0x0}) [ 689.103227] binder: undelivered TRANSACTION_ERROR: 29189 [ 689.121243] block nbd5: Attempted send on invalid socket [ 689.126743] print_req_error: I/O error, dev nbd5, sector 0 flags 1000 [ 689.134842] XFS (nbd5): SB validate failed with error -5. 16:06:08 executing program 5: r0 = socket$kcm(0x2, 0x1000000000000803, 0x84) sendmsg(r0, &(0x7f0000000480)={&(0x7f00000000c0)=@un=@abs={0x0, 0x0, 0x4e20}, 0x80, 0x0}, 0x8000) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x0) sendmsg(r0, &(0x7f0000000440)={&(0x7f0000000640)=@in={0x2, 0x0, @loopback}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000200), 0xfc99}], 0x1}, 0x0) 16:06:08 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x5000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:08 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x60}, 0x0) [ 689.251401] binder_alloc: binder_alloc_mmap_handler: 29817 20001000-20004000 already mapped failed -16 [ 689.287688] binder: BINDER_SET_CONTEXT_MGR already set [ 689.292998] binder: 29817:29825 ioctl 40046207 0 returned -16 [ 689.337746] binder: release 29817:29825 transaction 1577 out, still active [ 689.354816] binder: undelivered TRANSACTION_COMPLETE [ 689.363243] raw_sendmsg: syz-executor5 forgot to set AF_INET. Fix it! 16:06:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x103080, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x10001, 0x3, 0xfffffffffffff455, 0x80000000, 0x400a}, &(0x7f00000000c0)=0x14) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000100)={r3, 0x1}, &(0x7f0000000140)=0x8) [ 689.382320] binder: send failed reply for transaction 1577, target dead 16:06:08 executing program 1: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x10000, 0x0) connect$x25(r0, &(0x7f0000000080)={0x9, @null=' \x00'}, 0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) fsetxattr$security_selinux(r0, &(0x7f00000000c0)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:pam_var_run_t:s0\x00', 0x23, 0x1) 16:06:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x3f000000, 0x0}) 16:06:08 executing program 5: 16:06:08 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf0}, 0x0) 16:06:08 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x8000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:09 executing program 5: [ 689.626288] binder_alloc: binder_alloc_mmap_handler: 29847 20001000-20004000 already mapped failed -16 16:06:09 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x1a0}, 0x0) [ 689.720986] binder: release 29847:29848 transaction 1580 out, still active [ 689.736945] binder: undelivered TRANSACTION_COMPLETE [ 689.742186] binder: send failed reply for transaction 1580, target dead 16:06:09 executing program 5: 16:06:09 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x42000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xfdfdffff, 0x0}) 16:06:09 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x300}, 0x0) [ 689.934309] binder_alloc: binder_alloc_mmap_handler: 29868 20001000-20004000 already mapped failed -16 [ 689.947000] binder: BINDER_SET_CONTEXT_MGR already set [ 689.954822] binder: release 29868:29869 transaction 1584 out, still active [ 689.962724] binder: 29868:29869 ioctl 40046207 0 returned -16 [ 689.972513] binder: undelivered TRANSACTION_COMPLETE [ 689.992562] binder: send failed reply for transaction 1584, target dead 16:06:09 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x80ffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:06:09 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000780)='/dev/vga_arbiter\x00', 0x0, 0x0) r1 = getuid() r2 = request_key(&(0x7f0000000540)='logon\x00', &(0x7f0000000580)={'syz', 0x3}, &(0x7f00000005c0)='%vboxnet1security\x00', 0xfffffffffffffffb) keyctl$get_persistent(0x16, r1, r2) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000080)={0x6, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}]}) set_thread_area(&(0x7f00000000c0)={0x1ff, 0x20001800, 0x0, 0x2, 0x1000, 0x3ff, 0x5, 0x9, 0x0, 0x8}) fchmod(r0, 0x20) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000100)=0x2) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000600)=0x9, 0x2) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000640)={{0x2, 0x4e22, @empty}, {0x307, @dev={[], 0x27}}, 0x8, {0x2, 0x4e21, @broadcast}, 'batadv0\x00'}) 16:06:09 executing program 5: 16:06:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xfffffdfd, 0x0}) 16:06:09 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x499}, 0x0) [ 690.379548] binder_alloc: binder_alloc_mmap_handler: 29884 20001000-20004000 already mapped failed -16 16:06:09 executing program 5: [ 690.433261] binder: BINDER_SET_CONTEXT_MGR already set 16:06:09 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x600}, 0x0) 16:06:09 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x81ffffff}, @addr={0x5, 0x7ff}}], 0x30) [ 690.461733] binder: 29884:29885 ioctl 40046207 0 returned -16 [ 690.533840] binder: release 29884:29885 transaction 1588 out, still active [ 690.551358] binder: undelivered TRANSACTION_COMPLETE 16:06:09 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3ebb, 0x0, 0x20, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000700)='/dev/sequencer2\x00', 0x80, 0x0) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) linkat(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file0/file0\x00', 0x1400) r2 = getuid() syz_mount_image$erofs(&(0x7f0000000200)='erofs\x00', &(0x7f0000000240)='./file0/file0\x00', 0x22, 0x3, &(0x7f0000000540)=[{&(0x7f0000000280)="4d7ccd9e601d9302b92fd8679baa5de5bc82b1f6a28d610e374c82831be18926a13a00e38c57786e505d49a7bd5521dabfc2d4e174def6a502d1b00fc476c91c5af46e0701e7988fafe6b1458be0d73e80866f3afb08b27c03cf511f33df80f091bcae7ca1639c37cd96047ea5df891f4e499834e84045f8d98ed6b046371a05871a656e62e45f6c551a7eb30c25acac4ddb34735afa03da3bae1bb349eea7f040620de5e8903bd4189424", 0xab, 0x4}, {&(0x7f0000000340)="13d1d4b742c1f90a66d8277da151b28112f39fdfba7b7c65a7605e76d810e3c4a6853e3804b88a49a3d2a211fb5a", 0x2e, 0x100}, {&(0x7f00000004c0)="935b0c09657ef8d1615a50f93d18b495e52b11fc191c4f7bfbc209f266c04b636ed603d6d3fca764e5a21b4cf806044f7734b938b94328feedda09245746228fac4a979a42bf1ca8d1c830651d2ed87a44eb4f4aa56eae5533fd", 0x128, 0x5}], 0x4000, &(0x7f0000000840)=ANY=[@ANYBLOB="6e6f757365725f78617474722c6e6f757365725f78617474722c7063723d30303030303030306a5f747970653d2e2c66756e633d4d4d41d05f434845434b2c666f776e65723d000000000000000008000000000000", @ANYRESDEC=r2, @ANYBLOB="2c00535cf62cd2174c90c5729a33c39bf686be8e86a618ac719b884a34a1ffbf5193279e936dfece1d6099d73ee9d715c97174b381d2ba7a784be7ec78f0a8a63e0bd8ea52bc7164dace3b0452b42421555a5cd3901c77444529bee6400d6c61bcf7e7622e780b140cf2dce43ec7c67c1238c4605ac1e3ea23cf4e84ba8fb0d2736639770b085dafa9423257f9d5afc83bdd8eb75ac5f51ad23a5ae20000000000"]) request_key(&(0x7f00000001c0)='ceph\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f0000000640)=',!$\x00', 0xfffffffffffffff9) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000740)={{{@in6=@local, @in6=@loopback}}, {{@in=@broadcast}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000000680)=0x450) 16:06:09 executing program 5: [ 690.576700] binder: send failed reply for transaction 1588, target dead 16:06:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x100000000000000, 0x0}) 16:06:10 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x92ffffff}, @addr={0x5, 0x7ff}}], 0x30) [ 690.742454] binder_alloc: binder_alloc_mmap_handler: 29908 20001000-20004000 already mapped failed -16 [ 690.799521] binder: BINDER_SET_CONTEXT_MGR already set [ 690.810227] binder: 29908:29909 ioctl 40046207 0 returned -16 [ 690.842037] binder: release 29908:29909 transaction 1592 out, still active [ 690.852723] binder: undelivered TRANSACTION_COMPLETE [ 690.873039] binder: send failed reply for transaction 1592, target dead [ 690.895760] IPVS: ftp: loaded support on port[0] = 21 [ 690.910010] device bridge_slave_1 left promiscuous mode [ 690.915529] bridge0: port 2(bridge_slave_1) entered disabled state [ 690.958207] device bridge_slave_0 left promiscuous mode [ 690.963698] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.108278] device hsr_slave_1 left promiscuous mode [ 691.162800] device hsr_slave_0 left promiscuous mode [ 691.222283] team0 (unregistering): Port device team_slave_1 removed [ 691.233309] team0 (unregistering): Port device team_slave_0 removed [ 691.245827] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 691.271057] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 691.369808] bond0 (unregistering): Released all slaves [ 691.554003] chnl_net:caif_netlink_parms(): no params data found [ 691.595639] bridge0: port 1(bridge_slave_0) entered blocking state [ 691.602905] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.610475] device bridge_slave_0 entered promiscuous mode [ 691.618936] bridge0: port 2(bridge_slave_1) entered blocking state [ 691.625344] bridge0: port 2(bridge_slave_1) entered disabled state [ 691.632836] device bridge_slave_1 entered promiscuous mode [ 691.654455] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 691.664126] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 691.688189] team0: Port device team_slave_0 added [ 691.694062] team0: Port device team_slave_1 added [ 691.747705] device hsr_slave_0 entered promiscuous mode [ 691.796213] device hsr_slave_1 entered promiscuous mode [ 691.888673] bridge0: port 2(bridge_slave_1) entered blocking state [ 691.895066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 691.901775] bridge0: port 1(bridge_slave_0) entered blocking state [ 691.908181] bridge0: port 1(bridge_slave_0) entered forwarding state [ 691.963986] 8021q: adding VLAN 0 to HW filter on device bond0 [ 691.978675] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 691.987216] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.994383] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.022678] 8021q: adding VLAN 0 to HW filter on device team0 [ 692.033931] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 692.042437] bridge0: port 1(bridge_slave_0) entered blocking state [ 692.048851] bridge0: port 1(bridge_slave_0) entered forwarding state [ 692.087765] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 692.102957] bridge0: port 2(bridge_slave_1) entered blocking state [ 692.109356] bridge0: port 2(bridge_slave_1) entered forwarding state [ 692.123554] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 692.146238] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 692.153822] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 692.168499] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 692.185152] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 692.197148] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 692.204633] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 692.248826] 8021q: adding VLAN 0 to HW filter on device batadv0 16:06:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = open(&(0x7f00000002c0)='./file0\x00', 0x2, 0x22) ioctl$VIDIOC_ENUM_DV_TIMINGS(r3, 0xc0945662, &(0x7f0000000300)={0x1, 0x0, [], {0x0, @reserved}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = fcntl$dupfd(r1, 0x0, r2) ioctl$DRM_IOCTL_VERSION(r4, 0xc0406400, &(0x7f0000000580)={0x1, 0x7, 0x2, 0x31, &(0x7f00000003c0)=""/49, 0xce, &(0x7f0000000400)=""/206, 0x5d, &(0x7f0000000500)=""/93}) ioctl$BLKIOOPT(r4, 0x1279, &(0x7f0000000000)) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') r6 = geteuid() ioctl$SIOCAX25DELUID(r4, 0x89e2, &(0x7f0000000280)={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, r6}) sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x110005}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x50, r5, 0x4, 0x70bd2b, 0x25dfdbff, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x40) 16:06:11 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xa00}, 0x0) 16:06:11 executing program 5: r0 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e23, @multicast2}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) getsockopt$IPT_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x0, 0x42, 0x0, &(0x7f0000003240)) recvmmsg(r0, &(0x7f0000002ec0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001940)=""/92, 0x5c}}, {{0x0, 0x0, 0x0}}], 0x3, 0x0, 0x0) 16:06:11 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x93ffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:06:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x200000000000000, 0x0}) 16:06:11 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x3) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x6004, 0x0) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x363, 0x180) ioctl$RTC_UIE_OFF(r1, 0x7004) syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x6, 0x500) setxattr$trusted_overlay_upper(&(0x7f00000000c0)='.\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="08000000001639ee375e396db1a0019f6077f54352486aa9ab6cbb2d334bf33d94c143d60dd1ccf7932ce0cc178aedc2c28d87d4ac5baed8252532aafb242b2d587bf402195f9222c4eb9084a11bf4b12a8a2c65e61d31492307cd741013ad3a847d0292ac1b89ed7d5c34d49b22be0ca726603c5b86882777d6766b1fe9b5c25db2d16dbebb2578b21fb31ab9c8e2e10e76ba5fbcb44cbf19b40465e4a68738735df58795cbdae41a94ab3545a72eb00825adff47e0bd9388e65842db2807c083abc19cd07c3925da7962cbbdc322a04c08b55729654c20441354eae472a8bff00bc28b27b86367d86251b4cd9e78544944f6678253a15fbb2533c1f44db0c6407e9e507213ec47118e7841c78ce06fe2228a015ac3e7fc6591f0b86fa9251e5dbc0649e06eb1bdb05db91446623301c68497c1baf42fc62bedaa0e5dfb491b495c420815ddbe9429c0d2e5d44faabcde0c5ee82976acf9308465669601386448adc444c8fc178010b2f9ccea62f5b2fa98c079458952792916b3e8"], 0xdf, 0x1) [ 692.329540] binder: 29929:29930 ioctl 4b47 20000180 returned -22 [ 692.444527] binder_alloc: binder_alloc_mmap_handler: 29938 20001000-20004000 already mapped failed -16 16:06:11 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc00}, 0x0) [ 692.486193] binder: BINDER_SET_CONTEXT_MGR already set [ 692.491521] binder: 29938:29941 ioctl 40046207 0 returned -16 [ 692.519309] binder: 29946:29947 ioctl 4b47 20000180 returned -22 16:06:11 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x94ffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:06:11 executing program 5: io_setup(0x0, &(0x7f0000000740)) clone(0x802122001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x2000000001, 0xe, &(0x7f0000001000)=ANY=[@ANYBLOB="b700000005ed0050bfa30000000000000703000028feffff7a0af0fff8ffffff71a4f0ff00000000b7060000000000012d400500000000005504000001ed00001d040000000000002c460000000000006b0a00fe000000008500000007000000b7000000000000009500000000000000"], 0x0}, 0x48) write$input_event(0xffffffffffffffff, &(0x7f00000001c0)={{0x77359400}, 0x1f}, 0x10) ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, &(0x7f0000001080)=""/4096) exit(0x0) setsockopt$inet_sctp_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000640)={0x0, 0xffffffffffff8001, 0x0, 0x1a0f661, 0x0, 0x3, 0x0, 0x6, 0x6, 0x9}, 0xb) [ 692.535814] binder_alloc: 29938: binder_alloc_buf, no vma [ 692.552409] binder: 29938:29944 transaction failed 29189/-3, size 24-8 line 3035 [ 692.570296] binder: send failed reply for transaction 1596 to 29938:29941 [ 692.595636] binder: undelivered TRANSACTION_COMPLETE [ 692.600765] binder: undelivered TRANSACTION_ERROR: 29189 16:06:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1200000000000000, 0x0}) 16:06:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 692.665626] binder: undelivered TRANSACTION_ERROR: 29189 16:06:12 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000100), &(0x7f0000000240), &(0x7f0000000280)=0x0) r2 = getuid() mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='overlay\x00', 0x81010, &(0x7f00000002c0)={[{@xino_auto='xino=auto'}, {@nfs_export_off='nfs_export=off'}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@xino_auto='xino=auto'}, {@default_permissions='default_permissions'}, {@index_on='index=on'}], [{@smackfsdef={'smackfsdef', 0x3d, 'securityvboxnet0#'}}, {@smackfsroot={'smackfsroot', 0x3d, 'security'}}, {@pcr={'pcr', 0x3d, 0x1}}, {@smackfshat={'smackfshat', 0x3d, ')@}['}}, {@hash='hash'}, {@euid_eq={'euid', 0x3d, r0}}, {@obj_user={'obj_user', 0x3d, 'wlan0wlan1'}}, {@dont_hash='dont_hash'}, {@euid_gt={'euid>', r1}}, {@fowner_gt={'fowner>', r2}}]}) 16:06:12 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xe00}, 0x0) 16:06:12 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xa0010000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'nr0\x01\x00\x00\xdf\xcf\x00', 0x3001}) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x0) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x1b, 0x1) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f00000000c0)=0xc) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f0000000100)=r3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0xfff) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$DRM_IOCTL_AGP_FREE(r2, 0x40206435, &(0x7f00000001c0)={0x12ea, 0x0, 0x10003, 0xa5d}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UI_SET_PROPBIT(r2, 0x4004556e, 0x1e) [ 692.829249] binder: 29965:29967 ioctl 4b47 20000180 returned -22 [ 692.853833] binder_alloc: binder_alloc_mmap_handler: 29966 20001000-20004000 already mapped failed -16 16:06:12 executing program 5: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) getpgid(0x0) tkill(0x0, 0x0) get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000fff000/0x1000)=nil, 0x2) [ 692.932824] binder: BINDER_SET_CONTEXT_MGR already set [ 692.985302] binder: 29966:29968 ioctl 40046207 0 returned -16 16:06:12 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x880, 0x0) ioctl$SIOCAX25ADDFWD(r0, 0x89ea, &(0x7f0000000080)={@bcast, @null}) 16:06:12 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xec0}, 0x0) [ 693.036049] binder: release 29966:29968 transaction 1601 out, still active [ 693.043096] binder: undelivered TRANSACTION_COMPLETE 16:06:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x1400000000000000, 0x0}) [ 693.078033] binder: send failed reply for transaction 1601, target dead 16:06:12 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xbf000000}, @addr={0x5, 0x7ff}}], 0x30) [ 693.143509] binder: 29985:29986 ioctl 4b47 20000180 returned -22 16:06:12 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x4) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@loopback, 0x0, 0x1, 0x2, 0x0, 0x7, 0x7ff}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:12 executing program 5: r0 = socket$inet(0x2, 0x3, 0x6) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0x1f2) 16:06:12 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf00}, 0x0) [ 693.282782] binder_alloc: binder_alloc_mmap_handler: 30000 20001000-20004000 already mapped failed -16 16:06:12 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x4, 0x3, 0x2, 0x5}) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) dup2(r0, r1) bind$x25(r1, &(0x7f0000000200)={0x9, @remote={[], 0x2}}, 0x12) [ 693.327091] binder: BINDER_SET_CONTEXT_MGR already set [ 693.373178] binder: 30000:30002 ioctl 40046207 0 returned -16 [ 693.373668] binder: 30007:30012 ioctl 4b47 20000180 returned -22 16:06:12 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xfdffffff}, @addr={0x5, 0x7ff}}], 0x30) [ 693.461949] binder: release 30000:30002 transaction 1605 out, still active [ 693.479148] binder: undelivered TRANSACTION_COMPLETE 16:06:12 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvfrom(r1, &(0x7f0000000080)=""/172, 0xac, 0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") recvmmsg(r1, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000200)=""/15, 0x7ffff000}], 0x1}}], 0x1, 0x0, 0x0) [ 693.506360] binder: send failed reply for transaction 1605, target dead 16:06:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0305710, &(0x7f0000000040)={0x0, 0xffffffff, 0x51, 0x1}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x2000000000000000, 0x0}) 16:06:12 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x3, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0xa0002) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) linkat(r1, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000100)='./file0\x00', 0x400) mknod$loop(&(0x7f00000001c0)='./file0\x00', 0x6004, 0x0) 16:06:12 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x5865}, 0x0) 16:06:13 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xfeffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:06:13 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x6000}, 0x0) [ 693.734167] binder: 30035:30042 ioctl 4b47 20000180 returned -22 [ 693.755999] binder_alloc: binder_alloc_mmap_handler: 30041 20001000-20004000 already mapped failed -16 [ 693.795503] binder: BINDER_SET_CONTEXT_MGR already set [ 693.848174] binder: 30041:30045 ioctl 40046207 0 returned -16 [ 693.848225] binder_alloc: 30041: binder_alloc_buf, no vma [ 693.854170] binder: release 30041:30045 transaction 1609 out, still active 16:06:13 executing program 4: syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) modify_ldt$read_default(0x2, &(0x7f00000000c0)=""/133, 0x85) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x2001, 0x0) accept$inet6(r1, 0x0, &(0x7f0000000040)) r2 = semget$private(0x0, 0x0, 0x8) semctl$GETZCNT(r2, 0x3, 0xf, &(0x7f0000000340)=""/4096) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0xfffffffffffffe28, 0x0, 0x0}) 16:06:13 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8917, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 693.925306] binder: undelivered TRANSACTION_COMPLETE [ 693.930531] binder: send failed reply for transaction 1609, target dead 16:06:13 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000fe3)="441f08e30700000000000000fe36cef3e26def23000200000011000013", 0x1d) getsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)=""/37, &(0x7f0000000040)=0x25) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f00000000c0)={@broadcast}, &(0x7f0000000100)=0xc) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x1000, 0x101000) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) 16:06:13 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x6558}, 0x0) 16:06:13 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xffffff80}, @addr={0x5, 0x7ff}}], 0x30) [ 693.988499] binder: 30041:30057 transaction failed 29189/-3, size 24-8 line 3035 [ 694.063944] binder: undelivered TRANSACTION_ERROR: 29189 [ 694.114578] QAT: Invalid ioctl 16:06:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x3f00000000000000, 0x0}) 16:06:13 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xffffff81}, @addr={0x5, 0x7ff}}], 0x30) 16:06:13 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x8100}, 0x0) 16:06:13 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400, 0x0) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:13 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x1000000000006004, 0xffffffffffffffff) getsockopt$inet6_dccp_buf(r0, 0x21, 0xcf, &(0x7f0000000380)=""/173, &(0x7f0000000040)=0xad) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@mcast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@mcast2}}, &(0x7f00000002c0)=0xe8) recvfrom(r0, &(0x7f0000000080)=""/181, 0xb5, 0x40000003, &(0x7f0000000300)=@can={0x1d, r1}, 0x80) 16:06:13 executing program 5: mkdir(&(0x7f0000000300)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x5) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000011000/0x2000)=nil, 0x2000}, 0x1}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000800)={0x1, &(0x7f00000007c0)=[{0x100, 0x4}]}) ioctl$VIDIOC_G_MODULATOR(r1, 0xc0445636, &(0x7f0000000080)={0x4c, "c16cc1fdbe591939cb26532dfd605a41d8d07f86c6d803813306ce1e682217d9", 0x88, 0x4, 0x3, 0x2, 0x1}) r2 = getpgid(0x0) sched_setscheduler(r2, 0x1, &(0x7f0000000100)) r3 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r3, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) mount(&(0x7f0000000a40)=ANY=[@ANYBLOB="7865fdb9625a2969d62649e84c3e56bba0e41b43d62957b2afd16839f2015e0d7bb1468a8627740497367b66c4a289ebb4f91e8d1fd0155f8d5a665c24d7f77ce89720dfcaa159df984c21e8d8bd4cd4d33167336aa9e3076afeb73677243708b24168956e01c614e662dacb79fa56ee2ce11b2c03cbc9c68f58da927833c8f6a7de2df5ca7a85932faa02824a62fffb4fe3c901181f5886fd5b84e8b1977bbe45a15a6dfbd24d965fbf9c085a76ad97151299711ff1efbfcf6b33bfe216488c2c5579b1794e2050165ff42bd2e066fe7cef97a004783389ff655105ce5820e6cd47a73cc9dcae98aa25faeb0c7c711aa4ec7abd71773f80fee97a300e5e8aad7133daead7a54faf61e822a929cae9d66167c47a1261e4d7088aadd50521f212fe88603e93ed7bb248c16eeac29d1d3ee63fce3f4669b2172c01f2cb99551de6418505332128eda4494bcb30651c7d6658bf290d4e10dc46ec361245c8cbc7922ca3236e7fe2853eaee35ab0b1fa5d40714e376435b0747a368d3e140d0a9d0bf95071013fb5d23cd00b2aad7104708f77933f2a9363a649483d273330816b6f79844219081750fc38ea43d632fdb28323e80909c929c2a9caea2fb3ef291df5febd61128e994acb92c2f9a77eedebc41a2017b881fd2ad8cc89e0"], &(0x7f0000000240)='./control/file0\x00', &(0x7f0000000280)='tracefs\x00', 0x2000, &(0x7f0000000340)) chmod(&(0x7f0000000180)='./control/file0\x00', 0x0) prctl$PR_SET_FPEXC(0xc, 0x10000) fchown(r3, 0x0, 0x0) lstat(&(0x7f0000000340)='./control/file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000400)={{{@in, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}}}, &(0x7f0000000500)=0xe8) getresuid(&(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0)=0x0) r7 = getuid() stat(&(0x7f0000000600)='./control\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f00000006c0)=[0xffffffffffffffff]) getresgid(&(0x7f0000000700)=0x0, &(0x7f0000000740), &(0x7f0000000780)) setxattr$system_posix_acl(&(0x7f00000001c0)='./control/file0\x00', &(0x7f00000002c0)='system.posix_acl_default\x00', &(0x7f00000009c0)={{}, {0x1, 0x1}, [{0x2, 0x3, r4}, {0x2, 0x2, r5}, {0x2, 0x1, r6}, {0x2, 0x5, r7}], {0x4, 0x2}, [{0x8, 0x2, r8}, {0x8, 0x1, r9}, {0x8, 0x4, r10}, {0x8, 0x3}, {0x8, 0x2}, {0x8, 0x4}, {0x8, 0x6}], {0x10, 0x7}, {0x20, 0x2}}, 0x7c, 0x3) close(r0) [ 694.322613] binder_alloc: binder_alloc_mmap_handler: 30079 20001000-20004000 already mapped failed -16 16:06:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x80001, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000040)=[@mss={0x2, 0x81}, @mss={0x2, 0x2}, @mss={0x2, 0x1}, @mss={0x2, 0x2}, @timestamp, @timestamp, @mss={0x2, 0x3}, @mss={0x2, 0x8}], 0x8) 16:06:13 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x9904}, 0x0) 16:06:13 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xffffff92}, @addr={0x5, 0x7ff}}], 0x30) [ 694.391272] binder: 30087:30091 ioctl 4b47 20000180 returned -22 [ 694.424762] binder: BINDER_SET_CONTEXT_MGR already set [ 694.430070] binder: 30079:30082 ioctl 40046207 0 returned -16 [ 694.498234] binder_alloc: 30079: binder_alloc_buf, no vma [ 694.498294] binder: release 30079:30082 transaction 1613 out, still active [ 694.541059] binder: 30079:30082 transaction failed 29189/-3, size 24-8 line 3035 [ 694.574255] binder: undelivered TRANSACTION_COMPLETE 16:06:13 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 694.590835] binder: undelivered TRANSACTION_ERROR: 29189 [ 694.609856] binder: send failed reply for transaction 1613, target dead [ 694.630362] binder: 30105:30108 ioctl 4b47 20000180 returned -22 16:06:14 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) 16:06:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000fdbff8)=[{&(0x7f0000000000)="290000002000190000003fffffffda060200000400e80001040000040d00140000100000c45591b100", 0x29}], 0x1) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0xa0000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0), 0x106, 0xb}}, 0x20) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000380)="2d331509cfb66b1340c709fbb7df66886051af0f8066f0172a8fe5a90975cd0c5ea9277c2d9a09afdcf52e30fbb9b8664230aceabd32a045007089128d0836f74f6864d02557ffb1a3b9d5ad93d1fc3ea449d4ffa2284cbcbd66be0bff73d2946bb4a7e9da781895a414b38ff1db20dda347ddd4e34dd8e79678ca4b5e873c92224d0cbc3dcfe57f94662f9b0a3e922ff661e9a200fe14a107d491ba629c15530fce3605ff7814cc10a1b1f74b9bc6e70cc54e566eb8d5979595f8092485ebf9eb9405d22b00232d7421f49eec8792175a83cfd0f6bb8983d06e7f56ddb994694e889d4315171feab45c8df96c5c3f70d051f903a5f1414df30c9e91958c58efbce750fe29370c88c02a6d8616f853650491d95f510cde9f43c13279743c21809177a2ab486aaac749274169ccf27ed6d6886cd04717c9bd9e0513232eb81bcbf4dc7a787d7f2c48c3ee5b4e2dad1fef794d923d9dae37d290cb904e169f42b74daf500766baed899c981813f23e8ad57f1e05935ade2f14d840e38731c560170928eaa7b0feb163249553b21673c848a4d0548c3d18519c6fe22f80263ef787e6e23b3377c2eb1ca076cbaa164970b4e85f5b97d28b10ac0e84eea09d6bcd968560a9b2b52541efd733824c6bcccf93b6f870ec95016bbf7339cacc6ba06b921c257b4238c2bc3c2378d1930bf2357524a13e54e8f665237e6dc1e9f115229b0d0e93b0e671ed812815ee9d775a57c406e9c90556264611fff9be36f02003c6598e9c5dd68f148157077249eb700ac79896ded670826d0cf702224f71d98d1f5b5ff8d0d480fdcbbd24a04f0a1c354c49b635a75a58cf5345bb8dc062671f4c228e5661f308c177999ac7472e7d28a209fcbfd06e57d1181981412288bf4be97fa69b332d638e0b0a0770de40ea2ca347b613a7da5043b2d3aea8e1ba4d6a17b009a079e33dcaf5554590c252227c9bd0bbe2de5cc37ea8825e82cb1ee8dddc6990493510eb21b5c1c114df7cbd4871dd62348cff8e0dd767a17fe0d4a85ef2e0c2b4aebb7a81ff25a2d5d50bfdd061f406c77c414d63c411b532342f204545435ba73dcdfdc375c530640d85b7fc2e605b650168bb098316211f1223625342580bbbf4057953ba32f497abbd83375d49285f93186013e4efd75d4f0380d9594f35d9f3ee906d216984fc8fabb04a5d7055629ec215cdf1d75cb635dc630bf1349ab55fdf67e1907db241a4b8b5cd23defbeea86ed1a80539cc133b8350fdb91aaba7073b181e1b405aeb0d1407962271eb76e34bf7212c111d2b9e975cb6207fc22e9127079907a02ffcd58eda3ce46542463d281b0f5ac1e694a66194d9c94b21c24998494d1a409b71740aa8bd5dfb6f23a3143ffffaf5a44946a5dcd4529ac70ae58bb1f1316cbb5396539cf003c2354ff2c60d17f0e15523fb130285b64430393e3e2c69033bdc5f487ea0d52ea59ff27ac9dea9d1fab3d10178524d828e0a0d1a27a9abe0b7986e8adef3f50a3bc9f751f57038c6f4fdc0034c29165483c56b9855d59c365dc16b684138f5fefb8e8ac2ea53b3eb8e2b6deda4cd4b576c04054810af97f607c5f92d90332711dbfd9f0c852579e0893ce932c5bc7c26b27a58c5388253ff0cab15feab8e17954ff8821789a825151e62a95ce7a127f28169bc4a6349c2de51b16d35bacda800d7b56a89e9f75adec22ef05f3dad275e73bba33946ea92a9f4882dc2248937e3c50af131a06a62669c81bdfa3456913c0397a35007a24b0a0165838a31d1801c08ae6fe435cf63c5df159c0ee3beb4a00c62af333090026d357217751e8f9e5672270e9501bdd5ec62bda87e315c7d3ebeeed50265ea936b930f924dbec1c42be4c3960da934811281367942333de5d6ccef77b3cc77705e69c9d2cb011c8b0a5a4a41ace5b999adeb8ff59a89877e3959a2cc57bfadc9791cf238f2a5a1fcacb3d1056e031933ad1726d81c90e3767f1d97f1a486d9e0acd421e7a7b5fd1ac54f120d71254c6742d76afb187e85e767cb29ec70a8f6ca8e9a1af2550c32ff9847e4077e60303a993a07e74a98c5bfdc9a8c1449f1cb87d89104d2a9140ad105596164110beef0cb7508c3b1122143518e6d122d4abf86a2c0878fd202ca7803287a7aee4728cf5c272c041ae6e7f2ffdf373f97eccfd603f5dbea2be81fa319e352a0d74e3febc353c918790af859ea773570a7df4fd71687d432b226eeb978aee292ea4165e4890fdc55382a93135ef3eea822be9b65eeced5cccdde2441a70b1ce23ec0e46752b38cc5e5ce86d3cf3b948980d94ebdd58a4bd8743b5eb624d94b1d9535697fc42cedf3b145f3238bb6c0ec2d18aef9ea4685b1b71086eeb14814e8e715bfa0d4a9952434d0cb519d8abaaa6247c282c50342d33c517483e3f656ebd6c45ce258ba07079622588a6b9c4d2c172ef826425f3435777dc0d79ada3a999a6f6aab11147b3697669031847fb2269d945eeefd778b066f3f2ab7934911859cd66fd5a4056ae3777429bcfa6de4c4dd370a07210d9462bfe78fe8c9b549c1298e46ad9931e53b27d9107e16d5878ce6c2e0e9df4b818c3d0341db1ff56966111241b5749845ce6708b82bbc0f51329a8d8c6fe6ef92668609aab01c0c62d3def1226044036ae4b08c92c54d0aba4f12cfc3529dc4cb02e3756ddd45f7492a8b3dae3a1f9233c909d1b89d7513ae4d8280c9d412d3bf3bb272091e084f4dcd966199c17b21bfc7e4f5f55cbaa1c0c7b55e861d099e7c6125505cd6ace8cc678f1ce1706e54f9dd5cc4d0aedc85c2adab848dd5ff4bf2faac381f043d3da1bb303161a63d683751c65bf43ff431ccdf1f734f168032fc22ec94805680968c244be9fca0c56772a385f5279283bc35812d92a0fe6fbef7bff0a973c104de7462250d72a44229f5defb85a66c8256ca92b2f4151e3f9d048f4f32ab15d777399997d4b2ac5fe70f329e5f4693698d0796b0d198e476fc2717d13181bc5336893f7ac35de89612f3ad4c6efbaa8f534cfabfadc8255620ed96cccf2faca89faa929d52bb86a567dd440cdbcf58547a68f00ada15c4c2f4c5e5f0f78a304b57a6998fe86552e4ef28f76646856812f6f76f8c31c6889050ed8da609369d68d783ff8899c6d9d09664612fac232c1141714c41ded9b6faba2d6d18bb7bf48728a258e315035201ed3fa43fa05baabafd2acfd4df2a4cecc31aef614d49a588091ab4f5de1424c0155630f3b8e61ee13b40ef6b0d6cc1a4083baff5fa780a88d9a80c468975f9b877c58ee24834df5d510a8c901d34b503775f6d5cbb5c4146bdef64021c9f2633bad49cf5e0632f958a9dd62df5c2af23eaee7f72c916dadd7b12a36c20a63ce9e0df9f8bfaee7b2938fb677785cb7ef62b75b395db57c55fd8147588055b61573c5b156fdc4d45812f2b91547e3b9ad227f31a484eb6ee4dbde17a024c8f895d07c32ceda92347409c8a40261c574c417655af0010f6a27575cad661ae920b8cfb349d1939ce83a8232795ce4beb639d9c9847d79d8968235b6cfc8af018f9492e83363fd058f007367525d9adea1625c028f11649bf64f907cbc0306ea1a56dac8bffe457a9044749d1cf137bfc1dc33c767b814f8e9206ada3d00c4c7eda169de59773c5a955904b875391d45e7444ab7272c6014c711cff0d3bbef2c3721d3bc925c850fb5173129c0fd85233205830dcc0307637e3c522aee9bf2a968817958e74749a5b9a9613fd3f360c1e16fae0a0cf49ffbbf35a9e9a2174ea290da7ec0970383c47d91b296bc6699e249bfe5ccbab471af225bcbac9c366072b9b82e25991798fe1207b5554924b9b300685851f945e6f65777ecadc05038305ee5e3523a21efcbb86f5c16f898429d4e82c7a91016d48e5772353b5c4e889d291ca7ae0a423a6f5dde38c4c76d79fb5dbed0f13742ec901a447adcf050d3f00ce064eb88e389cb2d15bf17757f1f7f631f65b3931081af412dcca485969d954ccb3279da628a47ba0d478fae4aee6037994430bfe52eeb9307d33a36b6994266062834fb21222ac076e46cee21ae83eb035382a2a7212f6845a8dc691edec77f335af61d0781795181e06121af72beb3a915245836feda4e3733e1f43c9ac05d68ec06e83177ddf1945642b2b3fa89f2c850659662c957d8e970b8e6ee309c55855d2f8c18caa4a87af5a91f6b929b64e857161cc5a9069be9b8ef9c0b2f2d719e76524aa8e4dea8eaf7931548acf01fc19d4e8b97e75c11a5f0a37f78fe08b2c24888f01debb8e66a74fe40a432324a5b8be9529f2da95439bc5064fc2672912e2b03b011e51104240d2eef621648b41455bfdb99f2f3e274625c7d9068303832c2bf9536ad69e9d35036017a5553df2694c6f7543b10d9ffb407584d4c7df4ca718794acfabdfc167f3597d1854ab4b218a7565fbd186a50f3907ff50bb8eab5dc0370e821c173dcd2b5dda0ce90a3a2fab2be21f07aa9bc5c1d71e66750601d876e9b8481843352efb92b01828214a820033358564eefb1953a0e91d021bbd684e2c22b627e6f0a0331a67c016291d8832932938c38e10a95e4451214fb1cee413e6d666b62affd199ce30cdd008d2fa87356eaa4a41442c4a9ba63fb3dca9e8224421f5c64fdd44cbd1a195b47b8a88f034d71cd0e04a2170124a116ebea787124f0eb8d4fa1199ef5751eaf26daf9701459a7083c98f0d1dd7f2792653ea7769fe1cb55ab534e9b5af4c03da6c2ffdbd2d669c4f4dc1f0eac748a178e7086d49f0921b398ff12b47b64c248aa2cd5bba8da814d04f276f37f866bc1822b199d919ae02aea3e1968691f8f647ec850696f13f29772ff3081685c7b361b6be62cd5153879ba87e14bfa6850469ee9b45e3753ca70249c168d266fc453e8883ced1b24657316b5d42e735bad15bb350f592789f35adac417d67c4085437095fcdea020c40cddcad16bb783c7d0c8a4220299755c40b999d3ef1dc97dcd3a79792680b4deb896486a95875da4fdedf61af428970b67254e6e8d339b4ab5a0cd15d80b1c082665890a5b267cc73c8bd4419e9dfaa9e2192969f92b00943c20c5415bbacd3e85b1278093f7261c17b226cbe60227d917775153e20ad3e2c8e0690b88cbf0c222ab6f511d4f40b6cc61d9fc60273e36db17d2ab6319779b44d9c857e97bcabf9251390f95e2d1acb475a680d9792b9dd40d5e9065e5f987cf9ca19b000ea5c16c71464f6692e2a1cf1531f0ad1429504953aa4bf89447b4ce4b696b3bf2e44e887c3b0b5c2507f50f18aa90e4437ae17ddd77a9749e68676600710102ca1fbbb4ceb796ddb41d1f25f72390af8cd2213eb68a16fedd9dfb2840e62b90ae2df6d0740c899d1a1f4bffe1d2998c69e90b1da857dda494193dd6a9c48afdb643f989d62f519033bf9cbd4789404f0aae984107601eeea04881c2596a158ffc04560c921632f6dc37dda4c9406dc4a2a571e2aa03fc3a4e5b1149e240b8f02811743e154bae010c142f2a7188e80ec63dbdd0275d765241f067a2b6ea4b216112bb767c2161a0d83816c22fd3387c3322c2ec3b420add050a7401e32d2d20cb347149374bf9eb5ab6272e829c7d6de6686ac6488044fbeb2cfa303f9c169fb645ece938666ec75d66805efb211504167421537ae33e7ad280d9773a3238227f2395cbbbe6e012942ddce63e50ea7026cca72eb40f390f3a2f533a91dd4065c4b54bdbb697d611573de49a11f54462e478ae1b6c9a99bffcde7334881ecfb4b0cf5c21d37c865", 0x1000) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x108, r3, 0x309, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_BEARER={0xb4, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x7, @empty, 0x5}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast1}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x2, @loopback, 0x4}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xd}}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x81, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xc22b}}}}]}, @TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xf560}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f00000013c0)={0x0, 0x400, 0xcb, &(0x7f0000001380)=0xfffffffffffffffe}) fcntl$notify(r0, 0x402, 0x80000002) 16:06:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x8000000000000000, 0x0}) 16:06:14 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xffffff93}, @addr={0x5, 0x7ff}}], 0x30) 16:06:14 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x80000000, 0x400000) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f0000000080)=0x40800000) [ 694.950596] binder_alloc: binder_alloc_mmap_handler: 30119 20001000-20004000 already mapped failed -16 16:06:14 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xffffff94}, @addr={0x5, 0x7ff}}], 0x30) [ 694.996232] binder: BINDER_SET_CONTEXT_MGR already set 16:06:14 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf000}, 0x0) 16:06:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) dup(r1) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f00000000c0)={0x0, 0x98, "f77fe6c01c73ad16ba98922093adeb6e9e70b2de4df2dd4f2db5e7de2ad97015c71e3da75925f332200e318ed05b46365f074c9f6fc6d573e034d05d51d3928d12c55e627469f8f26e1ce910bc9b864666dbfaf0eb9c804abac978c79ec6da1f1f05c863abe36ccc9b007592c810a85aeeaffc296c694dffef716461c7df3a39adaf7c195242401bd2aab2724f51a16a515eafce97afb30b"}, &(0x7f0000000000)=0xa0) setsockopt$RXRPC_SECURITY_KEY(r2, 0x110, 0x1, &(0x7f00000001c0)='/dev/binder#\x00', 0xd) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 695.028508] binder: 30119:30126 ioctl 40046207 0 returned -16 16:06:14 executing program 5: r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x8200003) kexec_load(0x5, 0x4, &(0x7f00000002c0)=[{&(0x7f0000000080)="7e3590f4ffd44d1873378a98c83d8e19c56c9dfe79760f32ade64135931b8accf092ce3770878e91c0b04c49fe62a9ca17c643787612ef33", 0x38, 0x400, 0x8}, {&(0x7f00000000c0)="f032f48945bf8aa8b3df4bf4d7f17979e15496ea88b162599ad844ca1f96c0a3bfc3dcded10f4bbe3c9783ef8bb5a27431a80cec616728c8a79115c7f455f2dbb0bb14e1d07a32a4c5cd61c1bed6997c960e915e8391864f365dbe1ebfe686c827a648f150e9f8602806a591c0c3ff37d31374732f11a5677e6beb7e1ed8bdf28f3032f923d39a98ce114c", 0x8b, 0x2, 0x20}, {&(0x7f00000001c0)="4cbc9fb0feeea30e3e3e4c2910d61f022d7a9646d805a40921c1aecfc18c91c30031f601c59e6eac7ced0d7849f066ff8b93d8cc5ca02c3cafafb2580cd4ed8de141c912904116937d67ba1c31f6b83682058e540cb865d9c8864ed721796dad2ed06c47f213d77f535c1a8bb5452880ff6145d147b0476e1af2b30ccc27144488c3a08ee67f0a08f9cdb871c78b273abebef74a444b046556d6d5089539d262d84a1a045badb2d5fcf5db391b241b487678e2bc081387c4adbc6f5cf563", 0xbe, 0x1000, 0x80}, {&(0x7f0000000280)="e71a8a9ef50f8ec1c2e047", 0xb, 0x53, 0x4}], 0x2) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x80b) truncate(&(0x7f0000000000)='./file0\x00', 0x0) [ 695.113543] binder: release 30119:30126 transaction 1618 out, still active [ 695.122949] binder: undelivered TRANSACTION_COMPLETE 16:06:14 executing program 1: r0 = getpgrp(0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000080)={0x3, 0x70, 0x13444cd0, 0x10001, 0x3ff, 0x1, 0x0, 0xff2, 0x0, 0xe, 0x2, 0x0, 0x9, 0x0, 0x6, 0x9, 0x3, 0x842d, 0x101, 0xffff, 0x15, 0x8, 0x3, 0x4, 0xc5, 0x3ff, 0x1000, 0xa00000000000000, 0x3, 0x7ff, 0x6737b509, 0x9, 0x8000, 0x7f, 0x100, 0x3, 0x3926, 0x1000, 0x0, 0x8, 0x2, @perf_bp={&(0x7f0000000000), 0xa}, 0x200, 0x9, 0x3, 0x5, 0x6, 0x2, 0x2}, r0, 0xa, 0xffffffffffffffff, 0x2) fcntl$setown(r1, 0x8, r0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000100)={0xffffffffffffffc1, 0x6, 0x6, 0x7ff, 0x2}) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) mknod$loop(&(0x7f00000001c0)='./file0\x00', 0x0, 0x1) 16:06:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xfdfdffff00000000, 0x0}) 16:06:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) gettid() clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 695.158244] binder: send failed reply for transaction 1618, target dead [ 695.182580] binder: 30142:30144 ioctl 4b47 20000180 returned -22 16:06:14 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x34000}, 0x0) 16:06:14 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xfffffffd}, @addr={0x5, 0x7ff}}], 0x30) 16:06:14 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'bond_slave_1\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="25000000f916917be174b7226c56de9108e5ffffff"]}) [ 695.322484] binder_alloc: binder_alloc_mmap_handler: 30156 20001000-20004000 already mapped failed -16 [ 695.388044] binder: BINDER_SET_CONTEXT_MGR already set [ 695.405602] binder: 30161:30163 ioctl 4b47 20000180 returned -22 [ 695.414502] binder: 30156:30157 ioctl 40046207 0 returned -16 16:06:14 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f00000000c0)) [ 695.462186] binder: release 30156:30157 transaction 1622 out, still active [ 695.484275] binder: undelivered TRANSACTION_COMPLETE [ 695.489493] binder: send failed reply for transaction 1622, target dead 16:06:14 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") socket$inet6(0xa, 0x42088721e7cfd2b6, 0x101) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xd, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18006301040000000008ebbaed5b000000000000000000000000000000000ca2d18f6f4fb5ad20e0b5e95ffeca6d41b462e3bf2e68c33924a7b99401dc1db02f676a64f3248166a00b0f01dcb60ba22c9c8998f2e7898357d5fab81300fe59f012da2caed71c715e290d6f1d7b6a70341d5d8cd98adf2c68a309d4ae388eb1f80bc4c4384957dfd3a64a7e1db6f1ffaf8bdac11dd6d5fef740b131135fb18e267c92"], &(0x7f0000000240)='GPL\x00', 0x7fffffff, 0x276, &(0x7f0000000380)=""/251}, 0x48) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f0000000100)={{0xff, @multicast2, 0x4e22, 0x3, 'lblc\x00', 0x10, 0x80000000, 0x56}, {@multicast2, 0x4e20, 0x10000, 0xce, 0x3, 0x7fff}}, 0x44) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7e4, 0x800) ioctl$KVM_S390_UCAS_MAP(r2, 0x4018ae50, &(0x7f0000000080)={0x2, 0x6, 0x5}) 16:06:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffbfffc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0xffffffff00000000, 0x0}) 16:06:14 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x400300}, 0x0) 16:06:14 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xfffffffe}, @addr={0x5, 0x7ff}}], 0x30) 16:06:15 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x1a0ffffffff}, @addr={0x5, 0x7ff}}], 0x30) 16:06:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x3, 0xa0000) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r2, 0xc1105518, &(0x7f00000001c0)={{0x7, 0x1, 0xa96a, 0x100, 'syz1\x00', 0x3}, 0x4, 0x10000000, 0x2, r3, 0x8, 0x6, 'syz0\x00', &(0x7f0000000100)=['GPL\x00', '/dev/binder#\x00', '\x00', '/dev/binder#\x00', '/dev/binder#\x00', '\x00', '/dev/binder#\x00', 'syz1\x00'], 0x3f, [], [0x80000000, 0x9ab, 0x10000000000005, 0x7]}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:15 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) getpeername$llc(r0, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x10) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x7c40, 0x0) link(&(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)='./file0\x00') open(&(0x7f0000000240)='./file0\x00', 0x400, 0x8) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) 16:06:15 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) [ 695.778492] binder_alloc: binder_alloc_mmap_handler: 30189 20001000-20004000 already mapped failed -16 [ 695.809267] binder: BINDER_SET_CONTEXT_MGR already set [ 695.841896] binder: 30189:30195 ioctl 40046207 0 returned -16 [ 695.914514] binder: release 30189:30190 transaction 1626 out, still active [ 695.921628] binder: undelivered TRANSACTION_COMPLETE 16:06:15 executing program 5: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000140)={0x0, 0x0}) sched_setaffinity(r0, 0x8, &(0x7f00000001c0)=0x101) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x26000, 0x0) setsockopt$inet_dccp_int(r1, 0x21, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x149600) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/attr/exec\x00', 0x2, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f00000000c0)=0x201, 0x4) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000200)='nv\x00', 0x3) sendto$inet6(r3, 0x0, 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000002000000, 0x0, 0x801000cf00000000, 0x0, 0x0, 0x0, 0x0, 0xd9050000, 0x0, 0x0, 0x1200000000000000]}}, 0x1c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) r4 = gettid() getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, 0x0, 0x0) timer_create(0x2, &(0x7f0000000000)={0x0, 0x10, 0x1, @tid=r4}, &(0x7f0000000380)) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e23}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e24, @loopback}], 0x30) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(0x0, 0x0) 16:06:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYRES64=r0, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="fe5b5fb279a78bf4949de949b5341371"]], 0xc2, 0x0, 0x0}) [ 695.959715] binder: send failed reply for transaction 1626, target dead 16:06:15 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 16:06:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TUNSETPERSIST(r3, 0x400454cb, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000600)={{{@in=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@multicast2}}, &(0x7f00000002c0)=0xe8) sendmsg$nl_generic(r3, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000740)={0x4a0, 0x33, 0x710, 0x70bd28, 0x25dfdbfb, {0x1c}, [@nested={0xa8, 0x6f, [@generic="a3d88649d8cad46a844b4c8fd008edcc751c6278aa60d49857243dcd8eec8ced0fed755f770a47ced5cd0ab5b0414aebe93c3f22db6d1119fd28678a84a9e7ac483a50f6e53092f839ac77a4baca1c5b1624021778af", @generic="8f6697ed3eab85cfebf9dbccc55639ca7c1ae32014d2841fc19ab2d1e0db57e72ab0abd6ada061619fc3f52ab7c3ce9fdf76f1", @typed={0xc, 0x5, @str=':eth0#\x00'}, @typed={0xc, 0x8, @u64=0x7}]}, @nested={0x3a0, 0x40, [@generic="c045e980fd3e8c3cd6f885cf4cf92d0df0991e464e9a8f9cd8c509d7aa29557da8e9e6ffd23e63be510a661dbff807c8616d69a844da912674d882fb6d3ef0d3f1968bb2fc6cffbc33e15e47bea9ac1db2544dfbbbb68f53d822b1a6fea90c2ca3855172afdd0e0dc85b78e887a4d2ff9c21071104abedefef5409a44229fe82eb70fc667b5115a5ecbed9131cd87b88a9bc07f2d62a0cceb3394d5c6d61197a0de62c26", @generic="157b8127a6c70d53d295ca3fdd0d20250f8e9c36395061683767990b71315eeafb300e8ce2c0e96809766554eaffdebe461de5eea901a11e10cbe7f8c935b6711d991542da86329fe1a695ddec79d2eaef589a02db84ccf0087a6769ba290e4f7b807342d30c703a45f63f94278c9c545174878d429eeb1f801952a3c095895cee5a72ac7397373213ea2139527784c88059c8b55ffe9136ea5f018ef4e43d73fbfdfa85406454db08b120761cd9713fe7743ee1b9c3538a179d62e40d5b303f4aa4c93001e7e04795e626fbfcc35f88191d38afddd58797f40ce1e4232bbc7d0a58f0f6f17429656bf7ee57a5e1769d81ca0f147deca22154537e278b3e23", @typed={0x8, 0xf, @ipv4=@remote}, @typed={0x4, 0x2e}, @generic="dd9914aa18d6d650d9871f75908343a479b3099a99e96ea518bad51d11e04e39095e8e97778379103a4005cd03b896bf3ec52b589b4e5e5b459a11c57f0e6ca6fdcea86894b60b032a1f219c1e7ec2e955be51e5dab9252920d5a373cf6564fcba0d3306028ecac57bd0d0b2770bc70b2d41e24a3ddb9844b5cc9f472819573702da17cc4e344bccc1b2bff08b910e4d29b49d1c2f37d71d735ed2fba4f99c4e9aa0735b66ae15e0fa0e2db2f0617ab1bca933a8eacd170fada0db2b3d5ef07fcd25cd3b261eda2384556ed6dd50f961758a29febce3f1e2daeb632f64", @generic="83", @generic="e133d1632957d32698c0d4a8a079e242cd", @generic="8747036c85fc7e492c542e625a50d0e97af0f6db663c09ece4ee9dc09808c52a5a7ec94974126eb3a0e02f5aaf3ed52c7f2bd7ad999a8a0b41fc34b8a34536b25e97ae67e67ec67dec64cb6558b1c9e083eb621e1852a337e6dadcc88ea345a73a6370820456e65cf4c7efafcfd5ea33b503958ddbd9dcca51a40d12c549acafb425d271d088d7ae04f67798bb5b74ad878f52d2e70abfed15ee54eab63d8de6cf9d368be0940b75b7e4deab6babb74a5f466b4335e9efdbe2c22d10b0b7239d6d3cac19d2717acd547c3fbd04d8278abc2137125e514811b91f9d5203a677a3d9e354ff0dc7b0fbf06a6e6671b8e0eb671a50b70b6dae7778a079c651c9"]}, @generic="e21a26b0af5d378daed41382181a5b2e892fe4b41be3a54429178eeb736d099858c57e735b48ebd108195a3da260b6204bf2f3afdf0a5c0b46c2a5f83109e541fc177acf"]}, 0x4a0}, 0x1, 0x0, 0x0, 0x40000}, 0x24000000) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000700)={r4, 0xe4f, 0x0, 0x9, 0x8000, 0xe8f, 0x4}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:15 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x100000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:15 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80) write$P9_RREADLINK(r0, &(0x7f0000000080)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:15 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 696.204995] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 696.225421] binder: 30221:30223 got transaction with invalid data ptr [ 696.232074] binder: 30221:30223 transaction failed 29201/-14, size 24-8 line 3053 16:06:15 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x200000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000000)={0xfffffffffffffd4e, 0x0, 0x0, 0xfffffffffffffee0, 0x0, 0x0}) [ 696.295161] binder: 30224:30228 ioctl 4b47 20000180 returned -22 [ 696.324208] binder: 30221:30223 ioctl c0306201 200003c0 returned -14 16:06:15 executing program 5: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000140)={0x0, 0x0}) sched_setaffinity(r0, 0x8, &(0x7f00000001c0)=0x101) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x26000, 0x0) setsockopt$inet_dccp_int(r1, 0x21, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x149600) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/attr/exec\x00', 0x2, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f00000000c0)=0x201, 0x4) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000200)='nv\x00', 0x3) sendto$inet6(r3, 0x0, 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000002000000, 0x0, 0x801000cf00000000, 0x0, 0x0, 0x0, 0x0, 0xd9050000, 0x0, 0x0, 0x1200000000000000]}}, 0x1c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) r4 = gettid() getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, 0x0, 0x0) timer_create(0x2, &(0x7f0000000000)={0x0, 0x10, 0x1, @tid=r4}, &(0x7f0000000380)) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e23}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e24, @loopback}], 0x30) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(0x0, 0x0) [ 696.362567] binder_alloc: binder_alloc_mmap_handler: 30221 20001000-20004000 already mapped failed -16 16:06:15 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x3000000}, 0x0) [ 696.423777] binder: BINDER_SET_CONTEXT_MGR already set [ 696.442486] binder: 30221:30223 ioctl 40046207 0 returned -16 [ 696.458438] binder: 30243:30245 ioctl 4b47 20000000 returned -22 [ 696.466882] binder: undelivered TRANSACTION_ERROR: 29201 16:06:15 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x300000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:15 executing program 1: openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/validatetrans\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000000200)) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='fd/4\x00') getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) syz_open_dev$sg(&(0x7f0000000240)='/dev/sg#\x00', 0x400, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4, 0x400020011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000100)={'filter\x00'}, &(0x7f0000000180)=0x44) [ 696.585543] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 16:06:16 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000040)='/dev/input/mice\x00', 0xffffffffffffffff}, 0x30) r2 = syz_open_dev$radio(&(0x7f0000000200)='/dev/radio#\x00', 0x1, 0x2) write$FUSE_INTERRUPT(r2, &(0x7f0000000240)={0x10, 0x80db3c3839ed6041, 0x2}, 0x10) r3 = syz_open_dev$radio(&(0x7f00000001c0)='/dev/radio#\x00', 0x3, 0x2) perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x0, 0x8, 0x10001, 0x2, 0x0, 0x1, 0x10000, 0x0, 0x8, 0xffffffffffff0000, 0x8001, 0x5, 0x101, 0x1f, 0x40000000000000, 0x9, 0x7fff, 0x0, 0xff, 0x200, 0x80000001, 0x3, 0xe2, 0x9, 0x81, 0x4, 0x1, 0x7, 0x2a, 0xfe64, 0x80000001, 0x10001, 0x98c2, 0x6, 0x6, 0x67f1, 0x0, 0x101, 0x2, @perf_config_ext={0x5, 0x6}, 0x8000, 0x3f, 0x4, 0xf, 0x4, 0xffffffff, 0xffff}, r1, 0x1f, r3, 0xa) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400000) ioctl$KDSIGACCEPT(r4, 0x4b4e, 0x2) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:16 executing program 5: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000140)={0x0, 0x0}) sched_setaffinity(r0, 0x8, &(0x7f00000001c0)=0x101) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x26000, 0x0) setsockopt$inet_dccp_int(r1, 0x21, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$sndctrl(&(0x7f00000002c0)='/dev/snd/controlC#\x00', 0x0, 0x149600) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/attr/exec\x00', 0x2, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f00000000c0)=0x201, 0x4) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000200)='nv\x00', 0x3) sendto$inet6(r3, 0x0, 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000002000000, 0x0, 0x801000cf00000000, 0x0, 0x0, 0x0, 0x0, 0xd9050000, 0x0, 0x0, 0x1200000000000000]}}, 0x1c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)) r4 = gettid() getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, 0x0, 0x0) timer_create(0x2, &(0x7f0000000000)={0x0, 0x10, 0x1, @tid=r4}, &(0x7f0000000380)) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e23}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e24, @loopback}], 0x30) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(0x0, 0x0) 16:06:16 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x4000000}, 0x0) [ 696.744201] binder_alloc: binder_alloc_mmap_handler: 30258 20001000-20004000 already mapped failed -16 16:06:16 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x400000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80, 0x0) ioctl$TIOCNXCL(r2, 0x540d) [ 696.789588] binder: BINDER_SET_CONTEXT_MGR already set 16:06:16 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xcdc, 0x200800) execveat(r0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280)=[&(0x7f00000000c0)='{(&}vmnet0em1cgroupeth1/{(^:selinux\'self{systemem1ppp1/$:nodev,,\x00', &(0x7f00000001c0)='-@-*security$#-\x00', &(0x7f0000000200)='trustedkeyring-\x00', &(0x7f0000000240)='\x00'], &(0x7f00000003c0)=[&(0x7f00000002c0)='\x00', &(0x7f0000000300)='\x00', &(0x7f0000000340)='posix_acl_access\x00', &(0x7f0000000380)='keyring%\x00'], 0x800) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 696.853039] binder: 30258:30262 ioctl 40046207 0 returned -16 [ 696.892605] binder_alloc: 30258: binder_alloc_buf, no vma [ 696.916309] binder: release 30258:30262 transaction 1634 out, still active [ 696.930094] binder: 30258:30264 transaction failed 29189/-3, size 24-8 line 3035 [ 696.939099] binder: undelivered TRANSACTION_COMPLETE 16:06:16 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x500000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:16 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x800) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000100)={0x0, 0x7}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000180)={r1, 0x1b, "990f97de3bc688f4ea019abf5810cd57542b24ea291fcaf30811a2"}, &(0x7f00000001c0)=0x23) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) syz_open_dev$radio(&(0x7f0000000200)='/dev/radio#\x00', 0x1, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 696.981969] binder: send failed reply for transaction 1634, target dead [ 697.006529] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 16:06:16 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x6000000}, 0x0) [ 697.052821] binder: undelivered TRANSACTION_ERROR: 29189 [ 697.076510] binder: 30279:30281 ioctl 4b47 20000180 returned -22 16:06:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet_udplite(0x2, 0x2, 0x88) 16:06:16 executing program 5: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) 16:06:16 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x800000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:16 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = shmget$private(0x0, 0x2000, 0x40, &(0x7f0000ffd000/0x2000)=nil) shmctl$SHM_UNLOCK(r0, 0xc) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:16 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x8000000}, 0x0) [ 697.227001] audit: type=1400 audit(1548777976.561:149): avc: denied { map } for pid=30295 comm="syz-executor2" path="/dev/input/mice" dev="devtmpfs" ino=17710 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mouse_device_t:s0 tclass=chr_file permissive=1 [ 697.246464] binder: 30298:30299 ioctl 4b47 20000180 returned -22 16:06:16 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x4200000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r1, 0x800455d1, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x7b, 0x191182) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3f, 0x440901) setsockopt$CAIFSO_LINK_SELECT(r3, 0x116, 0x7f, &(0x7f0000000040)=0x54d, 0x4) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4100c600}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0xf8, r4, 0x320, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x28, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@initdev={0xfe, 0x88, [], 0x1, 0x0}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xffffffffffffffff}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6f}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x21, 0x20}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7fff}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x100000000}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x34}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x31e}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x8040}, 0x20008000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000003c0)=0x0) capset(&(0x7f0000000400)={0x399f1336, r5}, &(0x7f0000000440)={0x5b2, 0x9, 0x1, 0x8, 0x10001, 0x20}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:16 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x800000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl$SIOCRSGL2CALL(r2, 0x89e5, &(0x7f0000000180)=@default) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000100)) syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x10000000000000, 0x100) syz_open_dev$admmidi(&(0x7f0000000200)='/dev/admmidi#\x00', 0x80000001, 0x10000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB="0000008000000000"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x4, 0x4000) sysfs$1(0x1, &(0x7f0000000340)='\x00') utimes(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300)={{0x77359400}, {0x0, 0x7530}}) 16:06:16 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xa000000}, 0x0) 16:06:16 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x80ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:16 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x80000000000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x3}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x28000, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 697.549576] binder: 30319:30321 ioctl 4b47 20000180 returned -22 16:06:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x3fffffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:17 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r0, &(0x7f0000000000)={{0x3, @netrom}, [@null, @default, @bcast, @null, @default, @rose, @netrom, @default]}, 0x48) [ 697.634318] binder: 30329:30330 unknown command 0 [ 697.639218] binder: 30329:30330 ioctl c0306201 200000c0 returned -22 16:06:17 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc000000}, 0x0) [ 697.706740] QAT: Invalid ioctl [ 697.730522] QAT: Invalid ioctl [ 697.733961] binder: 30329:30330 got transaction with invalid handle, 0 [ 697.740694] binder: 30329:30330 transaction failed 29201/-22, size 24-8 line 3126 16:06:17 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x81ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:17 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = socket$packet(0x11, 0x3, 0x300) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000000)={0x0, 0xfffffffffffffffb, 0x1000, 0xffffffff00000001, 0x8, 0x1, 0xffffffffffffff9b, 0x1}, &(0x7f0000000100)={0x100, 0xeb, 0x6, 0x1, 0x4, 0x4, 0x7, 0x1000}, &(0x7f00000001c0)={0x7000000000000, 0x800, 0x10001, 0x6, 0x4c, 0x0, 0x5, 0x1}, &(0x7f0000000240)={r1, r2+10000000}, &(0x7f00000002c0)={&(0x7f0000000280)={0x3}, 0x8}) recvfrom$packet(r0, &(0x7f0000000080)=""/70, 0x46, 0x40010062, 0x0, 0x0) [ 697.794021] binder_alloc: binder_alloc_mmap_handler: 30329 20001000-20004000 already mapped failed -16 16:06:17 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc1ba3a2}, 0x0) 16:06:17 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x92ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) [ 697.891439] binder: BINDER_SET_CONTEXT_MGR already set [ 697.937366] binder: 30329:30330 unknown command 0 [ 697.983642] binder: 30329:30330 ioctl c0306201 200000c0 returned -22 [ 698.031343] binder: undelivered TRANSACTION_ERROR: 29201 [ 698.038317] binder: 30329:30351 transaction failed 29189/-22, size 24-8 line 2896 [ 698.049538] binder: 30362:30366 ioctl 4b47 20000180 returned -22 [ 698.055997] binder: 30329:30345 ioctl 40046207 0 returned -16 [ 698.073868] binder: undelivered TRANSACTION_ERROR: 29189 16:06:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000100)={'filter\x00', 0x4}, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) syz_extract_tcp_res$synack(&(0x7f0000000180), 0x1, 0x0) 16:06:17 executing program 5: sched_setaffinity(0x0, 0x3bd, &(0x7f00000002c0)=0x3ffffffffffffff2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000500)) r0 = socket(0x10, 0x3, 0x2) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00000004c0)={'sit0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x4000, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000340)={0xf, 0x1f, 0x2, 0xfffffffffffffffb}, 0xf) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000080)={'ip_vti0\x00\x00\x00\xed._H\x00', @ifru_ivalue}) connect(r0, 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000380)=0x1002, 0x4) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r3 = gettid() wait4(0x0, &(0x7f00000003c0), 0x80000002, &(0x7f0000000200)) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x1b) ptrace$cont(0x18, r3, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3e}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r3, 0x0, 0x0) getsockname$inet6(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x1c) 16:06:17 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xe000000}, 0x0) 16:06:17 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x93ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r1 = syz_open_dev$media(&(0x7f0000000180)='/dev/media#\x00', 0x3527, 0x111800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x10000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000340)={0x8, 0x2, 'client0\x00', 0x4, "a8c08a2492321bde", "fbc6bb545fccf85d9d6ca1bcc62b2d696440d83015184f41000000000000e8e1", 0x72, 0xf0}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000200)={0x0, 0x2, 'client1\x00', 0xffffffff80000004, "ed85945974f49510", "dcfc9bee234131eeb0709aad7cd769da458fe41340f4b117e7fcec5614875ffa", 0x1, 0x8}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2, 0xc1) getpeername$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000000100)={@dev={0xfe, 0x80, [], 0x1c}, @rand_addr="8bb1ba0c906acc0b2a8bfe46965c6697", @dev={0xfe, 0x80, [], 0xa}, 0x7, 0xffff, 0x1, 0x100, 0x9, 0x80100}) 16:06:17 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400100, 0x0) write$selinux_user(r0, &(0x7f0000000440)={'system_u:object_r:mtrr_device_t:s0', 0x20, 'root\x00'}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x10, &(0x7f0000000100)={&(0x7f0000000080)=""/118, 0x76, 0x0}}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000380)={0x0}, &(0x7f00000003c0)=0xc) mq_notify(r0, &(0x7f0000000400)={0x0, 0x5, 0x4, @tid=r2}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r0, 0x10, &(0x7f0000000300)={&(0x7f00000001c0)=""/232, 0xe8, r1}}, 0x10) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 698.237480] binder: 30375:30379 ioctl 4b47 200002c0 returned -22 [ 698.270551] binder: 30375:30379 ioctl 4b47 200002c0 returned -22 16:06:17 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x94ffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:17 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf000000}, 0x0) [ 698.299597] binder_alloc: binder_alloc_mmap_handler: 30380 20001000-20004000 already mapped failed -16 [ 698.387785] binder: BINDER_SET_CONTEXT_MGR already set 16:06:17 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) poll(&(0x7f00000000c0)=[{r0}], 0x1, 0x0) tee(r0, r0, 0x1, 0xa) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x83, 0x2fa5cef39c924802) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000100)={0x20, 0x18, 0xc, 0x10, 0x2, 0x6, 0x1, 0xa3, 0xffffffffffffffff}) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r1, 0x40045731, &(0x7f0000000040)=0xd041) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f0000000140)) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x6, 0x110, r0, 0x0) 16:06:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x33040400, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, 0xfffffffffffffffe) 16:06:17 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xbf00000000000000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:17 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x10000000}, 0x0) [ 698.410539] binder: 30380:30383 ioctl 40046207 0 returned -16 [ 698.445408] binder_alloc: 30380: binder_alloc_buf, no vma [ 698.480796] binder: release 30380:30383 transaction 1642 out, still active [ 698.489314] binder: 30380:30385 transaction failed 29189/-3, size 24-8 line 3035 [ 698.502964] binder: undelivered TRANSACTION_COMPLETE [ 698.512748] binder: send failed reply for transaction 1642, target dead [ 698.553417] binder: undelivered TRANSACTION_ERROR: 29189 16:06:17 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9, 0x0, 0x0, 0x0, 0x800, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xffffffffffffffbb, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056300549d6e3391d211b2b794861a91a9f84f8b41f74c22e8ec0f42058ac8651234"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:17 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xfdffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) [ 698.584861] audit: type=1400 audit(1548777977.921:150): avc: denied { map } for pid=30402 comm="syz-executor5" path="/dev/dri/card0" dev="devtmpfs" ino=521 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file permissive=1 16:06:18 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x60000000}, 0x0) [ 698.670029] binder: 30406:30415 ioctl 4b47 9999999999999999 returned -22 16:06:18 executing program 5: socketpair$unix(0x1, 0x100000000005, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2000000802, 0x0) setsockopt$inet6_int(r1, 0x29, 0x21, &(0x7f000089b000)=0xffffffffffffffff, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x40, 0x0, @local, 0x6}, 0x1c) unshare(0x400) getpeername(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, &(0x7f0000000280)=0x80) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) r3 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0xc000000, 0x282000) mknodat(r3, &(0x7f0000000180)='./file0\x00', 0xc084, 0x80) 16:06:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f00000002c0)={'lapb0\x00', {0x2, 0x4e24, @rand_addr=0x401}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x1, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r3, 0xae45, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000240), &(0x7f0000000280)=0x6) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r3, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x404}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x78, r4, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x27}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}]}, 0x78}, 0x1, 0x0, 0x0, 0x4}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:18 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x200000, 0x10) execveat(r0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000300)=[&(0x7f00000000c0)='[selfself\\\x00', &(0x7f00000004c0)='[)(&)\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='loppp1\x00', &(0x7f0000000540)='#eth1\x00', &(0x7f0000000280)='\x00', &(0x7f00000002c0)='[{vmnet1/proc!(\x00'], &(0x7f0000000480)=[&(0x7f0000000340)='em1systemcpuset\\bdev\x00', &(0x7f0000000380)='cgroup,selinux&\x00', &(0x7f00000003c0)='KselinuxGPL\x00', &(0x7f0000000400)='(!mime_type$.\x00', &(0x7f0000000580)='{-+wlan1\x00'], 0x400) socket$inet_udp(0x2, 0x2, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000080), &(0x7f0000000100)=0x4) 16:06:18 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xfeffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) [ 698.828547] binder: 30426:30429 got transaction with invalid handle, 0 16:06:18 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) getdents(r0, &(0x7f0000000280)=""/135, 0x74f) perf_event_open(&(0x7f0000000440)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x843, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34dc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xd, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) socketpair$unix(0x1, 0x8, 0x0, &(0x7f0000000180)) r1 = socket$inet6(0xa, 0x803, 0x3) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000640)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000001740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x10004080}, 0xc, &(0x7f00000006c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="000326bd70042fc1020f6278fbeed374db68022d3ddbdf25100000000c00020008000700000000000800060000000000080006007499dbe11496c586bea5d6a509f31268c0a046fcbdb35805b9585fa8334895ead9a4815559cd0e6299fccf709b92f3c3919e1d5e6ffeffa02ea17fbfb392a7a7db944aa9c8b12155b0aef4b8146c9e069bbe64887be6dbfd8a746d243301f85c394e303492d2571ed5b3f48899885f1c8d61a879eda4fd"], 0x1}, 0x1, 0x0, 0x0, 0x8000}, 0x4000005) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x78, 0x4) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40106614, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x2, 0x0, "a77760f5a7645bc43c241d69912dda0c63c2a66726f8cfafd6c8fe2c98de7ba44947a79015f0fe57917cb62a93987a938fdedfce7bbba4fec2d8a09c41fb233245f2604b9e07b8ab79ec15ef2818a179"}, 0xd8) bind$inet(r2, &(0x7f0000000180)={0x2, 0x4e23, @dev}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e23}, 0x10) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f00000000c0)='lp\x00', 0x3) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000100), 0x4) pipe(0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000700)='IPVS\x00') prctl$PR_GET_SECCOMP(0x15) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0x0) dup3(r2, r1, 0x0) recvmsg(r1, &(0x7f0000000240)={0x0, 0x10000000, &(0x7f0000000080)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, 0x0, 0x4f}, 0x100) fsetxattr$trusted_overlay_upper(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) write$binfmt_elf64(r2, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) [ 698.892543] binder: 30426:30429 transaction failed 29201/-22, size 24-8 line 3126 [ 698.901878] binder: 30433:30436 ioctl 891c 200002c0 returned -22 [ 698.936686] binder_alloc: binder_alloc_mmap_handler: 30426 20001000-20004000 already mapped failed -16 [ 698.981070] binder: BINDER_SET_CONTEXT_MGR already set 16:06:18 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x65580000}, 0x0) 16:06:18 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xffffffff00000000}, @addr={0x5, 0x7ff}}], 0x30) [ 699.001839] binder: 30426:30429 ioctl 40046207 0 returned -16 [ 699.022138] binder: undelivered TRANSACTION_ERROR: 29201 16:06:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) sched_yield() 16:06:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) delete_module(&(0x7f0000000000)='+\x00', 0xa00) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:18 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000600)='/dev/vga_arbiter\x00', 0x1, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f0000000640)={0x7f, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) syz_init_net_socket$llc(0x1a, 0x3, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000500)='./file0\x00', 0x45) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000540)=""/147) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) syz_mount_image$jfs(&(0x7f0000000000)='jfs\x00', &(0x7f0000000080)='\x00', 0x7ba, 0x5, &(0x7f0000000440)=[{&(0x7f00000001c0)="a8ce67a807a609cde7567358740ade652d916f13ab60d646c76be57ef35ab703a3c94e31be8e98229f6baa2d1ebac41d0e99bee8ed2ac5bf4c2558e160df32b53a9f441f9b5e95a1fc9d27d5d00426fdc353c819cb3eea7831275fd05595d7f81ddbd0a56b7236be9aa50ed2df61145448e0ec3fe98257868ba8b0c86bd839bf267d345868d19ffe4aa8091dc4b10aef6de060806c060de8ada65ac483eb0301892478d82f4bfee6ab5fdfa2610d26fe289017f76ed2763b6c1d93f2f12ea694ee7384b841d4e7970e12736f971b883b0f8866a9dc2b", 0xd6, 0x1ff}, {&(0x7f00000000c0)="99f596c4eb0d20c6bc3e73d5fe0c64d86d8e58410b64f9f24b8cc474a503933a6d348b71cac3fd3ae02e7ed1f990221ce6fd993e2abd4553f43a9c42d9ad", 0x3e, 0x40}, {&(0x7f0000000100)="692335b453958b5cbfcecdc24cf478bd852d4da209389f1ff537538960a4abfa8bbbde0e06facee8", 0x28, 0x7b}, {&(0x7f00000002c0)="458703d39fe22626e0c832652093bb95949f20c7abf79f269da90cf78a2849cbfd9f6b2377b214d512f2bad55a9d85a8f9c63e5a59762545a7077348aafa6ff040a601874f711ac67a41683f52666ad47f05b3f6edec53a0656f83b2a08886c965cb0a7cc968b551128bfa7546062dcc80ca06bbd01d183049afbd873e380bac4eb5769f", 0x84, 0x1}, {&(0x7f0000000380)="3e77099c678e2a019881ce4d3d2d1919a6227d2a8f3051beaf8c2aa18670742700e28f28fab073aeac70e9cba78de114c3475cdec8b558d5be07e3155389c8d7d8b93580bbd8f577988ba3f426684f425fc4d3f815de9592dbe29899182319831c68cf511e65f0f3e2f84d566e96b9c702460bbed24542fdcfa863b9bef1a095794f2e250d6c9bfa5c47aac08c54713746108069015c", 0x96, 0x1000}], 0x800008, &(0x7f0000000680)=ANY=[@ANYBLOB="696e7465677269cadd5b2a742c0057297ace27a956d757c7e4f00fd80af6f6be9463fab0b373ebe516ab7e1684153585c61b6dd14ec65292f1d56e7b113a8f0000"]) socket$inet(0x2, 0x2, 0x8) [ 699.196365] binder: 30452:30458 ioctl 4b47 20000180 returned -22 16:06:18 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40800, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f00000000c0)={0x0, {r1, r2+10000000}, 0x4, 0xffffffffffffffff}) r3 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:18 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0xffffffffa0010000}, @addr={0x5, 0x7ff}}], 0x30) 16:06:18 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x81000000}, 0x0) [ 699.274136] binder_alloc: binder_alloc_mmap_handler: 30455 20001000-20004000 already mapped failed -16 [ 699.342617] binder: BINDER_SET_CONTEXT_MGR already set [ 699.375535] binder: 30455:30461 ioctl 40046207 0 returned -16 [ 699.394946] binder_alloc: 30455: binder_alloc_buf, no vma 16:06:18 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x88a8ffff}, 0x0) [ 699.418825] binder: 30471:30477 ioctl 4b47 20000180 returned -22 [ 699.447789] binder: release 30455:30461 transaction 1649 out, still active 16:06:18 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 699.463754] binder: 30455:30476 transaction failed 29189/-3, size 24-8 line 3035 [ 699.476163] binder: undelivered TRANSACTION_COMPLETE [ 699.490120] binder: send failed reply for transaction 1649, target dead [ 699.532257] binder: undelivered TRANSACTION_ERROR: 29189 16:06:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000002, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x400000, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x98, r3, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x70, 0x1, [@TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x3, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x9fa3}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x0, @loopback, 0x8}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) [ 699.713386] binder_alloc: 30496: binder_alloc_buf, no vma [ 699.748099] binder: 30496:30499 transaction failed 29189/-3, size 24-8 line 3035 16:06:19 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r0, &(0x7f0000003000)=@abs={0x1}, 0x6e) listen(r0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/unix\x00') sendfile(r0, r2, 0x0, 0x10001) utime(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)={0x0, 0x80000001}) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000000000)) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000100)) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000180)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000240)) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000280)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0}, &(0x7f0000000300)=0xc) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r3, 0x6, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) fcntl$lock(r1, 0x25, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) bind$inet6(r5, &(0x7f0000000600)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x2000000c, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x1, @loopback}, 0x1c) setsockopt$inet_tcp_int(r6, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_int(r6, 0x6, 0x18, &(0x7f00000001c0), 0x4) r7 = open(&(0x7f0000000000)='./bus\x00', 0x100000141042, 0x0) ftruncate(r7, 0x10099b7) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x5}]}, 0x10) sendfile(r5, r7, 0x0, 0x8000fffffffe) [ 699.766470] binder: BINDER_SET_CONTEXT_MGR already set [ 699.772467] binder_alloc: 30496: binder_alloc_buf, no vma [ 699.778107] binder: 30496:30499 ioctl 40046207 0 returned -16 [ 699.785391] binder: 30496:30502 transaction failed 29189/-3, size 24-8 line 3035 [ 699.793725] binder: undelivered TRANSACTION_ERROR: 29189 [ 699.808784] binder: undelivered TRANSACTION_ERROR: 29189 16:06:19 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x10001, 0x103040) ioctl$BLKRRPART(r0, 0x125f, 0x0) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000080)) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) 16:06:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x80000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:19 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x99040000}, 0x0) 16:06:19 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="852a971c52bb47c8b37a04cc46a78ddd1169e9d77cf206b84b8f2ad4b60cfc287b962435c0cbe247501c4690d1ae5239f3c525b4eafbdd6521328c6503929dbf00098a809de4d16e6ca31161987f311d0c22fd5b1acf076ed9099db7654d5413fa86924e60dcb0dce763ea3ac719757e070a96888b48a48f", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 16:06:19 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:19 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x9effffff}, 0x0) [ 699.992980] binder: 30520:30523 got transaction with invalid offset (0, min 0 max 24) or object. [ 700.039100] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 700.039361] binder: 30509:30517 ioctl 4b47 20000180 returned -22 16:06:19 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x280, 0x0) [ 700.081930] binder: 30520:30523 transaction failed 29201/-22, size 24-8 line 3097 16:06:19 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 700.147731] binder_alloc: binder_alloc_mmap_handler: 30520 20001000-20004000 already mapped failed -16 16:06:19 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xa0010000}, 0x0) [ 700.215274] binder: BINDER_SET_CONTEXT_MGR already set [ 700.231049] binder: 30520:30523 ioctl 40046207 0 returned -16 16:06:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x101000, 0x0) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f0000000100)={0x0, 0x32, 0x0, 0x9, 0x8, 0x3, 0x3, 0x112, 0x1}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCLINUX4(r3, 0x541c, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 700.257051] binder: undelivered TRANSACTION_ERROR: 29201 [ 700.274654] binder_alloc: 30520: binder_alloc_buf, no vma [ 700.313302] binder: 30520:30532 transaction failed 29189/-3, size 24-8 line 3035 [ 700.364323] binder: undelivered TRANSACTION_ERROR: 29189 [ 700.449453] binder: 30546:30547 ioctl 4b47 20000180 returned -22 16:06:20 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r0, &(0x7f0000003000)=@abs={0x1}, 0x6e) listen(r0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/unix\x00') sendfile(r0, r2, 0x0, 0x10001) utime(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)={0x0, 0x80000001}) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000000000)) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000100)) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000180)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000240)) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000280)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0}, &(0x7f0000000300)=0xc) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r3, 0x6, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) fcntl$lock(r1, 0x25, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) bind$inet6(r5, &(0x7f0000000600)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r5, 0x0, 0x0, 0x2000000c, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x1, @loopback}, 0x1c) setsockopt$inet_tcp_int(r6, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_int(r6, 0x6, 0x18, &(0x7f00000001c0), 0x4) r7 = open(&(0x7f0000000000)='./bus\x00', 0x100000141042, 0x0) ftruncate(r7, 0x10099b7) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000200)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x5}]}, 0x10) sendfile(r5, r7, 0x0, 0x8000fffffffe) 16:06:20 executing program 1: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x2a) write$P9_RRENAME(r0, &(0x7f0000000080)={0x7, 0x15, 0x2}, 0x7) ioctl$VIDIOC_QUERYCAP(r0, 0x80685600, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:20 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:20 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xa2a31b0c}, 0x0) 16:06:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x0, 0x6) getsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000100)=0x6, &(0x7f0000000140)=0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x800) r4 = dup2(r3, r3) ioctl$TIOCSBRK(r4, 0x5427) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000000)={0x1f, 0xc05, 0x8, 0x4, 0x8}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x2080, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000040)=0x80, 0x4) 16:06:20 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc00e0000}, 0x0) [ 700.803821] binder: 30561:30562 ioctl 4b47 20000180 returned -22 16:06:20 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 700.853557] binder: 30556:30565 ioctl 5427 0 returned -22 [ 700.877944] binder: 30556:30565 ioctl 401c5820 20000000 returned -22 16:06:20 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x3) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000000)=0x4, 0xfffffffffffffe9f) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x200000, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f00000000c0)={0x1f, {{0x2, 0x800000004e23, @multicast2}}}, 0xc) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 700.938830] binder_alloc: binder_alloc_mmap_handler: 30556 20001000-20004000 already mapped failed -16 [ 700.984779] binder: BINDER_SET_CONTEXT_MGR already set 16:06:20 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 701.017048] binder: 30556:30565 ioctl 40046207 0 returned -16 16:06:20 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) [ 701.061094] binder: 30556:30585 ioctl 5427 0 returned -22 [ 701.133349] binder: 30556:30590 ioctl 401c5820 20000000 returned -22 [ 701.158387] binder_alloc: 30556: binder_alloc_buf, no vma [ 701.167201] binder: 30589:30592 ioctl 4b47 20000180 returned -22 [ 701.178392] binder: release 30556:30565 transaction 1664 out, still active [ 701.191916] binder: 30556:30565 transaction failed 29189/-3, size 24-8 line 3035 [ 701.195087] binder: undelivered TRANSACTION_COMPLETE [ 701.203515] binder: 30594:30596 ioctl 4b47 20000180 returned -22 [ 701.239403] binder: undelivered TRANSACTION_ERROR: 29189 [ 701.247041] binder: send failed reply for transaction 1664, target dead 16:06:21 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x100000000000106}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000580)={0x13, 0x10, 0xfa00, {&(0x7f0000000380), r1}}, 0x18) r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x5, 0x200) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e24, @broadcast}}, 0x4, 0xfffffffffffffeff, 0x5, 0x1, 0x40}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000100)={0x101, 0x1, 0xf4fa1d696fca531d, 0xa71, 0x4, 0x4, 0x1, 0x305, r3}, 0x20) 16:06:21 executing program 1: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7ff, 0x4000) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f00000001c0)={0x0, 0xfc, "54c8d1d7e471577a9583d4454ceefedfca0f8f115f0019b1f77e0e057ec02af4db2a377d1653968ac82c73b26f0d37be4a0432795b37e1dc450cfacac6ec632baa76d3249c80862d6d88d7beb6cfd90f5489a40410c7932c4e6714ea192977d6f951a68b504c6752ea6c3e275bcb0ea735a536aa9774ca061201f8bb89cee17bce7b3d1ea85c721059d7d583b13414a6b7e572efa40cfaf7d5821cd9751d0968946398f5b8505a0fbfa06a77fe1399830b66267d374ec722c9ed36b3c230e997f3a81dbb079103deadef6bcf8ed0be674d7052600c90566020d3cd7da761731c9ec9dd02d32ffa71924df817790ad0e9190443ab7ec883e508c52917"}, &(0x7f0000000080)=0x104) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={r1, 0x3}, &(0x7f0000000100)=0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8097, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$CAPI_CLR_FLAGS(r0, 0x80044325, &(0x7f0000000300)=0x1) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000680)={&(0x7f0000000340), 0xc, &(0x7f0000000640)={&(0x7f00000003c0)={0x244, r2, 0x401, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x20}]}, @TIPC_NLA_NET={0x68, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xaa98}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x80000001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x400}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xd69d}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x100}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, [], 0xc}, 0x77395699}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @remote}}, {0x20, 0x2, @in6={0xa, 0xc, 0x3, @remote}}}}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x90a0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfd6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc00000000000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NET={0x44, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffffffffffffc0}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7fff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x81}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}]}, @TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x401}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x10000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}]}, 0x244}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:21 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x7, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f00000000c0)={0x800, 0x200, 0x3, 'queue0\x00'}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:21 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xffffa888}, 0x0) 16:06:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xfffffe05, 0x0, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 701.764237] binder: 30604:30605 unknown command 0 [ 701.785802] binder: 30604:30605 ioctl c0306201 200000c0 returned -22 16:06:21 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xfffff000}, 0x0) 16:06:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = request_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f00000000c0)='wlan0vboxnet0vmnet0!\'\x00', 0xfffffffffffffff9) r3 = add_key(&(0x7f0000000100)='trusted\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f00000001c0)="b9b935d613648e4ff401402b7b727040e59a14a4d7ea544478d0ee64d27c47d66c8bb852a10d57b575efaff2babcb2a7bd5eea25da56312af18705db534a9a2995e3f08c641c786b4e4bb1e2b1563720d7983873f6c62f6c15bbd5", 0x5b, 0xfffffffffffffff8) keyctl$negate(0xd, r2, 0x7, r3) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:21 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 701.831670] binder: 30604:30618 got transaction with invalid handle, 0 [ 701.851811] binder: 30604:30618 transaction failed 29201/-22, size 24-8 line 3126 16:06:21 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 701.945066] binder_alloc: binder_alloc_mmap_handler: 30604 20001000-20004000 already mapped failed -16 16:06:21 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r2, 0xc028ae92, &(0x7f0000000040)={0x1f}) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000180)={0x7f, 0x0, [0x5]}) [ 701.987719] binder: BINDER_SET_CONTEXT_MGR already set 16:06:21 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 16:06:21 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 702.014643] binder: 30604:30605 ioctl 40046207 0 returned -16 [ 702.038962] binder: 30627:30631 ioctl 4b47 20000180 returned -22 [ 702.058140] binder: 30604:30634 unknown command 0 16:06:21 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) fcntl$setpipe(r0, 0x407, 0x1) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x6, 0xc4400) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000000c0)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) ioctl$NBD_DO_IT(r1, 0xab03) [ 702.091968] binder: 30604:30634 ioctl c0306201 200000c0 returned -22 [ 702.126553] binder_alloc: 30604: binder_alloc_buf, no vma 16:06:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) accept$unix(r1, &(0x7f0000000000)=@abs, &(0x7f00000000c0)=0x6e) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x401, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff54, 0x0, 0x0, 0x23f, 0x0, 0x0}) socket$nl_crypto(0x10, 0x3, 0x15) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000140), &(0x7f00000001c0)=0xb) [ 702.175083] binder: 30604:30605 transaction failed 29189/-3, size 24-8 line 3035 16:06:21 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) 16:06:21 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x7, 0x4000) r3 = accept4(r2, 0x0, &(0x7f0000000200)=0x3a5, 0x80000) recvfrom$inet(r3, &(0x7f0000000100)=""/181, 0xb5, 0x2000, 0x0, 0x0) 16:06:21 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mixer\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000000)={0xf, 0x1f, 0x2, 0x6}, 0xf) fchdir(r1) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae03, &(0x7f00000003c0)=""/150) 16:06:21 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) [ 702.431575] binder: 30650:30653 ioctl 4b47 20000180 returned -22 [ 702.447028] binder_alloc: binder_alloc_mmap_handler: 30659 20001000-20004000 already mapped failed -16 16:06:21 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x80) sendto$unix(r0, &(0x7f00000001c0)="992aa103005faffd920c6ed3f0c4719a8546d519f0f4109f9f9c9eaada5d6b1ab2d28a8cb97a091279d1aaccf4e47451642372897023dd589950a11b1d48a1ee4a84df5d85e01abdbed5c3ba5d0dd1764f764140d9b384a8665188b2d77677f43c17ce5686a805c5f90d2d7895d74c5be26c776fcdba6c8c15891964651513523215f4e5a0bd051f57896b62443e2cd10ad422b63ab557c96e8ab8710a132f3d2a292d192188cae84e95cb21c6de9e2fcd8e7b8fdc99f68205adb19204f68763678175d0366e342347c97a112299fc0dc84f52b237e2297bc717117e57676b76bc2257ecfa7b4a", 0xe7, 0x40, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) [ 702.517128] binder: BINDER_SET_CONTEXT_MGR already set [ 702.550924] binder: 30659:30660 ioctl 40046207 0 returned -16 16:06:21 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) link(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='./file0\x00') memfd_create(&(0x7f0000000040)='#\x00', 0x0) socket$inet6(0xa, 0xb, 0x0) r1 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x3, 0x40002) bind$tipc(r1, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x0, 0x4}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB], 0x1}, 0x1, 0x0, 0x0, 0x90}, 0xfffffffffffffffd) r2 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) openat$zero(0xffffffffffffff9c, &(0x7f0000000440)='/dev/zero\x00', 0x2000, 0x0) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) waitid(0x1, 0x0, &(0x7f0000000340), 0x0, 0x0) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) fcntl$getown(r0, 0x9) setsockopt(0xffffffffffffffff, 0x10d, 0x800000000d, 0x0, 0x0) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x800}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x4, 0x7, 0x1ff, r4}, 0x10) r5 = accept(r2, 0x0, &(0x7f0000000080)=0xfe0f) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x28, r6, 0x230, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c0}, 0x40) read(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x0, 0x40000) inotify_add_watch(r1, 0x0, 0xa) [ 702.569749] binder_alloc: 30659: binder_alloc_buf, no vma [ 702.578434] binder: 30650:30653 ioctl 4b47 20000180 returned -22 [ 702.598417] binder: release 30659:30660 transaction 1672 out, still active [ 702.606252] binder: 30659:30660 transaction failed 29189/-3, size 24-8 line 3035 16:06:21 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:22 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x1a0ffffffff}, 0x0) [ 702.619277] binder: undelivered TRANSACTION_COMPLETE [ 702.640265] binder: send failed reply for transaction 1672, target dead 16:06:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x48000, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000000100)={0x3, r3}) 16:06:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) modify_ldt$read_default(0x2, &(0x7f0000000100)=""/13, 0xd) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x881, 0x0) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000340)={{0x3002, 0x4000, 0xf, 0x40, 0x2, 0xfffffffffffffeff, 0x9d, 0x100000000, 0x80000000, 0xffffffffffffff81, 0xf1d, 0x3bb}, {0x1f000, 0x2, 0x0, 0x3, 0x9, 0xb0a, 0x0, 0x670f, 0x6, 0x2, 0xffffffffffffff7f, 0x6}, {0x5000, 0x2000, 0x0, 0x4, 0x8, 0x7fffffff, 0x8, 0x7, 0x9, 0x30ea, 0x800, 0xf2}, {0x2, 0xf001, 0xb, 0x7, 0x0, 0x4a, 0xff, 0x2, 0x7fff, 0x0, 0x2, 0x1}, {0x10000, 0xf000, 0x0, 0x81, 0xcd, 0x7461, 0x6, 0x80, 0x8, 0x24350906, 0x9, 0x9}, {0xd002, 0x0, 0xa, 0xd6, 0x5, 0x74f7, 0x0, 0xfffffffffffff73a, 0x2, 0xe6d6, 0x9, 0x8000}, {0x0, 0x110000, 0xb, 0xff, 0x9, 0x8, 0xf2, 0x7, 0x100000000, 0x1, 0x1, 0x1f}, {0xf000, 0x0, 0xd, 0x4, 0x64000000000000, 0xa284, 0x0, 0xfffffffffffffe00, 0x1, 0x5, 0x3, 0x8ff3}, {}, {0x2000}, 0x4, 0x0, 0x1, 0x41050d, 0x1, 0x500, 0x1000, [0x0, 0x0, 0x5, 0x3]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xee) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00feff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)=0x0) sched_rr_get_interval(r3, &(0x7f00000001c0)) 16:06:22 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efa, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x10000, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000200)='/dev/cachefiles\x00', 0x100, 0x0) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f00000002c0)={r2}) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000080)=0x8, 0x4) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000300)={0x0, @reserved}) [ 702.799780] binder: 30688:30691 ioctl 6609 0 returned -22 16:06:22 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x40030000000000}, 0x0) [ 702.871339] binder: 30688:30691 Acquire 1 refcount change on invalid ref 0 ret -22 16:06:22 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 702.929887] binder: 30688:30691 transaction failed 29189/-22, size 24-8 line 2896 [ 702.938713] dccp_close: ABORT with 80 bytes unread [ 702.968356] binder: 30696:30703 ioctl 4b47 20000180 returned -22 [ 702.977781] binder: 30688:30694 ioctl 4008af22 20000100 returned -22 16:06:22 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.events\x00', 0x0, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f00000000c0)={0x2}, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) faccessat(r2, &(0x7f0000000000)='./file0\x00', 0x44, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:22 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000000540)='/dev/admmidi#\x00', 0x2, 0x8000) ioctl$KVM_GET_ONE_REG(0xffffffffffffffff, 0x4010aeab, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x14) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x401, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@multicast1, @in=@remote}}, {{@in6=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000180)=0xe8) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x4e23}, 0x1c) linkat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @remote}, @in6={0xa, 0x4e22, 0x7, @remote, 0x9}], 0x2c) listen(r1, 0x18) r3 = socket$inet6(0xa, 0x6, 0x0) fchmod(r0, 0xd) openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/udmabuf\x00', 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}], 0x10) 16:06:22 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$SIOCAX25OPTRT(r0, 0x89e7, &(0x7f0000000080)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2, 0x76}) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 703.004433] binder: 30708:30708 ioctl 4b47 20000180 returned -22 [ 703.019936] binder: 30688:30691 ioctl 6609 0 returned -22 16:06:22 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf0ffffffffffff}, 0x0) [ 703.096268] binder: 30688:30691 Acquire 1 refcount change on invalid ref 0 ret -22 [ 703.130442] binder: 30688:30694 transaction failed 29189/-22, size 24-8 line 2896 16:06:22 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 703.147853] binder: 30715:30719 ioctl 4b47 20000180 returned -22 [ 703.169600] binder: 30688:30694 ioctl 4008af22 20000100 returned -22 16:06:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x20600, 0x0) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0xa1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r1, 0xc040564a, &(0x7f0000000040)={0x800, 0x0, 0x1002, 0x8001, 0x4, 0x100000001, 0xffffffffffffffe0, 0x1}) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 703.206602] binder_release_work: 3 callbacks suppressed [ 703.206609] binder: undelivered TRANSACTION_ERROR: 29189 16:06:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) flistxattr(r0, &(0x7f0000000100)=""/111, 0x6f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 703.250251] binder: undelivered TRANSACTION_ERROR: 29189 16:06:22 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000200)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80000, 0x101) write$FUSE_POLL(r1, &(0x7f00000001c0)={0x18, 0x0, 0x7, {0x4}}, 0x18) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0x40405514, &(0x7f0000000080)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) 16:06:22 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, @perf_config_ext={0x2d, 0x800}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x102) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000080)=0x20) 16:06:22 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) [ 703.361057] binder: 30731:30733 ioctl 4b47 20000180 returned -22 16:06:22 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) 16:06:22 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 703.428608] binder: 30735:30736 Acquire 1 refcount change on invalid ref 0 ret -22 16:06:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SIOCGETLINKNAME(r2, 0x89e0, &(0x7f00000000c0)={0x2, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 703.504995] binder: 30735:30742 Acquire 1 refcount change on invalid ref 0 ret -22 [ 703.505544] binder: undelivered TRANSACTION_ERROR: 29189 16:06:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x100015) write(r0, &(0x7f0000000040), 0x0) preadv(r0, &(0x7f00000007c0)=[{&(0x7f0000000280)=""/94, 0x5e}], 0x1, 0x0) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp6\x00') ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r1, 0xc0305616, 0x0) preadv(r1, &(0x7f0000000480), 0x1000000000000047, 0x0) fcntl$getown(r1, 0x9) ioctl$DRM_IOCTL_FREE_BUFS(0xffffffffffffffff, 0x4010641a, &(0x7f0000000040)={0x1c6, 0x0}) [ 703.552979] binder: undelivered TRANSACTION_ERROR: 29189 16:06:22 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) writev(r0, &(0x7f00000031c0)=[{&(0x7f00000001c0)="b7e39ffda2891a20f2e068ccf103a01d564910971c632322dd9a3efa617be9a9383a0c92eb97ec2f56bb38841bac1098f86a2d9cef5005b5f7d9f26f41e7aeb499d183218571edb18f3bbdcbfbc108de02e85e96bb38c1aeddb4223ab94b2b4e3a89831ecf223c536f05758cacf3ecccdc9611cef4138486b68d0205c506d53c72b2eead9d57d7006fa33d2be1cdfb3b6e2b14624054d09e3b1a9bc1fb1e70ce812427233e136337fce8af220729d6f4ca89c913ce6985197006048f2e778549be5c5a3e03e90f87d981de839433ee5132cd273a1ec57eecc3442ccc5a0d0952eb8ead87e9588adede28a4dbe473934017a417bbabaaa529d539ed311f3be5afdf2f7862d4eb055e8ad0258d1f60e0a522b3bb1f12ed38721a22ea6636c930268e5778a2f91ee651ab01210cb583b3ea2cc087bac671e0417f40233448217fb8cd0f62c490ff6d7f11f604ce5a029a1125f509f1c4e1ca6ac8836e09fddbae20a556013aea56645a0b93f5b68a38e2625a6dc51c77f20a239b2fae8717fe153e098375c2330c6db39ec962cf00a7151906192d4d227d3c46c85729adce9b5d5929e109f48a9e9069a32d33f8a2c5799dccbfd98ca1bbbfad4f7ac32cbf5ec42c2ce5f9343203976044ff531727531ce1b1c4f4eb1cf62a392f2c164f9c632aaa98daa1f0f533e73422702cf90a139a48d952c7a19397e91049c204fca6051a66d0751bb7d2396339235138278b3fcd28e895687824c7f865762ec529aee1171ff0c3dbfe9851ffea9af0f594090740ee9da70cade40e82fdd3ede987d7a749a4c90441b797d8359bd649f3e95ed5aac236b499219979b7249033e7b38b7f0a52f5c4f2ab7adf02bd4a30505f0d9ef8056ab6ee1e9d0d7941f54a8d563173e21a9d6600b1b4642261dfd4b3c93327970da8361f641339c2648d9139a3b6ae5baeeb893ab2be0f2ecb818622256fd67a5f428777c52c4c4c6d1dc568ec43ce13b3274fdda9afdd0f2fb2c4066f1fac2aa0c23db3ee48b6894eed4604191dfc8f8e93a0719142f3f69adc6c58f81d979e98d5ac3de144c6d1224ebd3227177be21b6d007605b4f6cee5f9f9e40c267cf9e5ef9a89ea205752d43f28e0669f10898b8442d36b61334ed2e654b2595c9c334aec17fefac4173ec32fc6bc50a213592c7c4b2ff6056eed602678c8cefa6ae86149e1c0ec623d010ad4c37a122444858af2ae176e0c9fd741f5b5c006136c242c05b0e40599b3511ce0349786293ec5865de258e73c835e2543165642dae55e0eda2421c62294a5a2a10308fcebb3e0641c0bfbb06381b9d35a916093a651c080a4f47aff948879f74eef8f20001ef720b644c1611c90a75800127bf22525306e21ed6c559cba01aa5e614b1d6e34ea34243700e7fab56a2818501605c0321696a8c1ed930e7e3abff1061a26947af1c779dfa1c87fd52f755081b6d4ec9119aeda468d17c174a41d5fbc25a46beaa826cae9cebbedb8b897d3933f07babbf23a4f782df0628c6d7dfffda44ebc8646cc258d07f42eab4b60335cc0c7633c5b327e43ecc28eee7e37232a756fd315d0b8d764989226c676255c0ceb0652f26c6d205a273b3505044e6fbade6ee82b8b15f0e1af7c56999eec0dd5c9a18e692c622e6a8f3df6be8032132d9e2de9238928131cdcb89f582f7cec94ec67d295751619b62c95291aa649064144ec13b1a3b54597a0f5de9646c4279e4f9dbff92361d6a4625e6e95d29ca28d68ad660840cdd5229e20b9bf1be07e122a7e450541936b439c1320bd19f7ba51f4ccb41be10220e274aba33d4abb45142c89fd0eda344ff0a5cd14cc424c3ab96ef9a2004540fdb8ef3df5d0a357e2662c4451958b6b637ed717727606a6ddd8ac5d044a4a86dac10a70e359264aea57f5c1e65b1e1c78626f4cbaffce991e6583d8424657c833f548a1b95cd3773008379ceccdfbc052604fb8ea799ab64e3c738a17dc7df1aff3c6886f83d7eba222143b0b1b75772defdc7394955dcdb3c9256bb4e796a9ae5d6094ace41ea6abdcfb9897d184d309d3093ff6a063043f66a711ab572067c531243934015b9bffc748585837dda966299c3aa830b326f9bf2579db847f81442f8c9fe2cdbb15b3f9d04392c4161af2f6e9c1b45e61bce3870f1531256a5e9e66f4ff95d99074891ae59b1e749b85f69be109341d3498abd5352ca7f42e90781052c15dbb25435eb6ab931ed36f662e6a0d8bf7f67a01b82d849b783bcaafa36465d2cddd9e1ff6f4dd6d901be0f248c75518ee1d181750047e893cd72298fc192bef21e9741f1bd53a70695bf5320fc10d0a155d7a333455aca28695f3c5aa211c3c70a2106e4a8d442e460916cd6adde42914dd01d7e84771d1c152e79b0534e30a1fdff6912a739189a70f1a14ec9a20ee822b1b42d1204bcfae688a5b37a1662f056cc5bf112b6cfa0318c440c2ec6d5a3e3850cb56de363083e34dcd8a15a5f3d4471dc0fcc260b4e307e7aeebd46d835d62ffce425126ba661ced2937cfaf8819e4db4d51d0eee1aba73c8314cbfb1e1a3b2397b6ce07f84cc129e01c9791c0a07ae15c37fb72f426cb560535db6fc1563058c8d1c763129b5fa04488cc8ac74b13d7f914e3acc9a0bacf35f33f788690e7d55970ebc19188711d01d4bc72f95639d95e2c7d8d7b98160b7188a1e73fbb6436afd889cedd71ae9cf3eafefe02dab9b55c99609afd381200574482388fb37748ee46f7eb49789090f18f744ec7823b27eb2ede09572ce06f60fe75819e0aed7915f7ae4bd3d0ffd84e0a353cd94b56a24c4a08bc389ca928dcbc875a51a8a02314fb84b583d6810974348975dcde1623f2ee6b19414cf95b7abc66893a883114d08a222d149c79b1950b4c6919677c09abaa3eeabe8cebeff6fd400ea5287de81ab4f9e19a38cb0f02b439042f1f76d7225efe265f30296a9009b9d239f153a1da1c5d744d79a64d9b34c27a528e11450bc1a10af6d7b27a923b718e3f26acd0bb8023f9ddef0b186e9be73e0d60205b5e745686df0523f7149cb6c6a7168bd1843361aa356fc6a78482db6245fbe1a89465841dedb0e015ca5df88af6f955bb6e8a1dfc123902c2a3bba954066c52963fe223647b645982d8b9e58d3ce59a5378f0ac68452f4f786b7a2964a3887f0c94ea311eb52fc531e70f173f5237c689d7a1f7ab43cd906fd3fed9c3caf3b90e6da13fb3fb8ded4e735218b28abadfed0c3a5f3cdb94339461afa070a8197ec33f431bacd524b68e9e302b3beb4483bedbcbf60d982616462798646f1412ee3cf94621f4e4b2fd0bd1ef219443686f412e00942fa9437df7f5a6afaca6800e149d9d7c1158556154386fa146d7b58ee0885ce85b7112c4dcb162ebf9a72301fa228b6f04a5852b8e2d3a9606584884b8112d7b4fd3a02f0414ac2d776621f8e7097fa556d001c6cbdd5ff29cb97554a9795bc996b94c51259e97e7bfd50ad04ecf5136e79ccd0937b5e23330e4ed41ab072ba3b4eced825a57952cdee375bff87ff57d28005c3ac1010c61692008be2ee41db80f9063ccb81ce60e191a0bec2322383cf5e356cde7b355376876423ca754658d892b8c1ddfdee8a0e034c5e1cb1cea43b669bb039493d6303e7b959293baed8eef7cd4fc0599d36c058642e7cf09e3882eaa424ff303aef2b518b43502387efba5cb65bc723f5a64fe72598b6230991ad67ba39ef7b35b2fe934d895de9ebfcb91add206f66084d8bbae54be398bc647a6e85c02bbd9f1709022240c1cae1b6c093d70942e43673ec625ce20a6161053da7ffd0bbf0ecd7e6768bac2d30366f4f3cf764e6100a0da442bcbba5f6a1b66bf6e6bc6e361102526e582da8ccff34b14d6a8e578d39d2140910548a01f5eb182ba10e497f60d5bd3f56e47432ce19fb397c703bf43dd6fa66501b05294683ba6bf70799615147105136fc65aad40344f2fe61871a35da93dd5c8d97c8978c908ee850ef598c375ddc6ce1859bbc95288e5b8346f0ebc3bd4c7faa2277dec0b431e4106e315b013be3c4dcbbe71008fccfc3ab122f1dc72bda9d2c3a3a47731f732b8b430c4570cefb85147989c8fd5f56aae3700a654ccd803b29bd522b96ba0b56461a4278cbfc4ff3112990581d4dfcdfea32a533d6185a310610562cf1051bb3b7c661d65fb812e95104ea7ab3ffd1dfdf40065be7925e877ce607180784c4930ca87d0a2e6b2f9b9ab43bc5277d8d2324877454c0acd4ae67cfd173ef7f099023713b26aa37a8915be5acd9aad8523e915f9442484c1f4ed5651c3d23770b55d93e11f3679281bb9aa29ae5dfff4f21096182dfdd3470fe4be96ace327d11c381dce54d68d8e2a1774e1a72d2db6f570df658bc5a1595385c7984f39f152e42079367c6f255bdc8528874536fb9ca7eafa22ca24ca2eca2970eef7adf57222ca2265782845e8ffe579180831015d8350989218643840b49a1d6482e0463eb16e42cad7d792476e964655c2b0a9e775b269fa7893914606e6011b7d8eb07f221df1a6d846f37a39d81399845e74dbb677adbcc082646ddbbaf840e7c281baa0bcf5a85c95a7aefd7e556c1f3c11261f50272a0ba85d9406b8f2360a03f95f34d5ee2169b6dc2df256022b18834735602d307a7af030c948a9bcd46a21752d822fa923c6c38bed7bb7c15ab8b7c506e604be9381f97aa5f3d6181544151d6d60b9f4f7285323b9c9ea708d89f7f7fe7902b0f06c75171e9472b7933f59afe7c6da08d673e69896c89ac8f379efed891ae8e0bd13eb168b5d8cd8bdef80dcbb0d21810f363b29dd9d90841d2f2bfc24583b3bc5c221651ab1d8610390d23aefe3924630558d41fe0fcdf4d82ed5682bf7e5dd518712ab5a4210bdc441cef4c7297b967eaa8c52ce93d2a5731b0c5aacb9d440e2834b039c4cfd7cb711b655a7946aa77114cd711dbf235294d0bdb7ec69d8bd9bfc296dab61985377268bdcc78a80f54eb6cb6d5cc61951f8b8dee3c75dd8ff425fcb3b803e535c65fa29d40370dd944de075725f5f59f86480aa1e932a762f0ee140e873644a1732da30040f37b18b8f3568ac735e9f1ad568bbedf0a0a8313a4433206e9f46e787cb80e79100b015635b10efa13452cd852eedded3d1dbd34dfaf8a88d841eec8cc5b05fa2e7adcafff38d14324407b6871bef75cfcca339af0c0a8239c15c26310156fc195d7609909b50b08f3225ba0931bd882f5fc2f8d1f6f7e79483d66543111f284d4c701c59c1ad6e88df6a9703fa3d6a9cb2239d60a274ba1cf804c09c20117f7d76db39b80ac8330382c61585e91213d9f72cfdc0d54c0e26b7dc87d57516fc685aaca394738f71db41a7ee1528d073527af47a6de248127343c834cf86685e05e44f7ed8885245755851ece0c36f048b7a1e9a54d045e34e1a579adf260165bf4f1f1e8ca389eee6f1bab7376eec57235f5fdc973892fdb22c51d524d8611b22c68eca9af1216012c4a271000b12b648bf302b8f548bd9384bf02738a6a31a61027afe9a1086e524454578a4438bb746a7a6404bf96d3208095d1dfb9d395cd688c09b620230c34c2331e9af28f955751b0e677505b36e4502eab9f962e1a54e0a68996bb78e8daf2f4ccade33ffa942362c2d2f45d738cb14b8288784d6f877bd3433d49bcc5258ad7c22f0c81d35d8b8b2a0fbda70e3e5dce4caa5572301f66b3d5d534e174a1df3abb5b5aadd42f34e38fd2aa71fe9b3ecff6b30e41d979ccd107325fa3517a546e93b50dce11517d925310223", 0x1000}, {&(0x7f00000011c0)="72d509fd96191698f6228fae224162a2716cec6a9dddeece980dbb1bb611354f7f4531dec24bb4e1a454ad9363a5efc3cb7e498e03bb2978fac6d02a652ca19e6520076c29e0152725537e0c05c6eb39924354a7e2c53644d73288e0daf9f9496e5c7853d5489aeef8333576b4a5e190a7233285b78b29fd7fb9fbdf95239e62920ab9b430108a55263071c286f554a397cf6fe7e640b4762adeb594645f1c12cd1bd8908f92a191ef002c21bc59097cd3cb404377faa6c41bf7e340de1d0514b4d4ad2346c437924fc2423c4b8bff150b96edfc63df5361b9640f534a35abcdf459efc7d5d22b8e646b91bed816a7c91e8303666d4eba4ac06b70169ab5520fa906855b615c5f8bf312dd3ccb578f7159885af210aaf20dc4f4e265fb30681a7ff84261809946487b3ba12eaa28ec77f66e5a5aae359d2ed51ec290db7518328b004dd0f661c10dc7799e597daba2faef5200cadb2d6b9045c0a84f51e81405902c237aa947848664f6bf2c6ac8e0eb032594e73f2c6cf94dd4ca6d09b1580de27d480ae7d2adf08b4a54ec00f5356305040bc4c7e758498651c0c54e602ea093bf08158b00a1b7f02978c61a4984615846c01c1c46d94937304c258eef6213d9f0c6dd7cd3d02e85b659e571a26929459e83d61c9c3a52a0b73848f0bad00200c58f50dd082e5eca53d0c6e2d8e4db1abf3722c67f1461bb929ad79610e1bb81460b873d66c5787ef4400ce2ec0dff8ccbf64d799735183d930eb7acae3d6b56242db11611a05e4b2247317c454d5cc634aeec3fc28d95817866494d93dbd876629e3e7846d26b3e4944bcc5f21b5e1cc7502ab10c799b32f97cc2e56c3e14cff95097e4f2c662b3d56eca90b48b86727c96c05897161d931f11753e9f175f3035045632f40e104efb672e12f875238b2c0b4bc6104ba8b65c74ba19a2939b830c7034a4dd0f7e9c055dc68c3a99c1e3e767eadbc24579e9790952c01493f2bed0999664b634d17c6da600cb707f09360b767e68a6d150e88096ee081005fc33ff52b4e6a7f16083127abe3e445d68d16fad7690927e583c80e73426feebb2f7f24fc6b568100361e8b35731a08cb587c1898281e32be16f62341f29e800c2d33aef3d12b02a84da80d05943acc44801442091916a725ac25a759266281342b5b6fb84bf6a51f10013373e5ff55cfa5c7ac90c8d329193d7af5fde711802c465a223b28611976cad1035471974de989d29ec6041d6ff8a56963b6afaf9ce0a7fb4de17599fe09158354ebb9d2a160ecd8b90b28cd022e42f108b43a32b2b0123d9fc02ad871e122255b6f166bb9c83ee84d74c62106d553e4554afafa03f29ed066210326048a970a8a6731ba0ff971852b7d9c3d0b082a547dbb0b1237e62867e165d5016965c9a3c6d97e43e730a003fc3199b3ff178b244d7c81e6ce4f027da85387732496f81b446027eaa5f43f8b70e6b0d8fb14834ad0d424693b366a64e9f06565212b097c947a5c19311466057100cda4d03ca3c12c8c01413aec40e9194fe99bfc83cae9321576b4b042d01edd9c103d3cc0d839beacd4f41b0de416801067253aa0f8717bb41ca7f178e905cef9c49bb29d500bcc8e2f557e035bccbdb0272e2354bad9dc7b8af4755953e2da11ddae634610abf7e9c4f79038c716cca08f85f3b602d73cc5136be8a47c87403ae0e2622510c9e189b5da4d06b7c3e1cbb3e2873212aad0fe5633a26b2a684c7bba8497ddcc9821ee41233ff2fcd1ca8e9cdd1e1ff7e0d75eda92747098e92cadc6e9cbf4db90ef6873977daf717717368f7abbd8e7e100b6303b82ec8d88ec460fabcac32e88b070616119d1d13924d732242602db5dbaed9b2c69cea721dcc08ac27a2fa312eb750b5c6904545b30cf7b3ccad87ddb6d10605717b8034bb072590181704bc96c7485556fdfb2050b48f2914d72ef537f21b6ddcf638a0cbea83ea9d341a71bc36e529cb42ebc8809a024d73400356d0160b8fba9fe179dd5c6c6de53df8a622302de1c38a0a4b39b260882cd8347542fede91ab7460073a78573b89f312108c513e693983f0e9eb2789bfa692d06141e632103c3c6d95689f5d923eb3c9b7661709de3244a567849b205a89dbd511183ebb0f2842cdbb5dcf35baefb5110f0a511819d4286be38b9477648caee2a36fff5c42d5fac87cefbed5796500fcd3d2bfba0443e11bcf3b9ff7c043661ddb8efe22a716a9b670ca6b1044d3c40675908b5ffc30282368887a1d1e43843c369fc59b8f29d1918409cda836a44460cbb47ff073ea62a35ab9f37f57d98799b8039845f3b599f6b32ebcc11eda5c0cdb037939af21429d863fd141d5fc4dcce3b962f8793a12a243d88d744f513e7d161e912a1e3d7fad730ddbf62b3522eb8bc77a9b79e5f18bf724fab63454395cd05f104d1f4289b5c80841eaaae6997b2acbce1cbd81c7144dd9887045e87c938c2a24db89f071f938706b1140c78960677e1ec75133c783d308a276078eebe69590b48d3512b5b4398566c894f650e385dc5b88d7a41cf1dfe639a39e87ddba80bb0a5d011341760798abfcfdec862aa9e2b723f52bf588a096f647413d1f30a0f9731156a74676d319b438e225d24314ea7e3487433ab7b63365e9b9de903d4a2d26fe136920e803f771c453f332c270d61882a8a1b23b321f19ee3c040c7024c00aaf5790d3ac8800a2de037e0812e78adc2cff4b0bb5ba53477d6877f67ffa9b0a17be098058564fcf4040fdd81c33e824969c9abeb3697b326c0f4339df81520fd0f176e011dcabb324cb0c822f93c27b7d29167a2a80b38c2b87df000b3760b0f8e8006d8f94e7dcd6e486ecd263a335b39629d1ead795ddd8f67ec0308297acff8bdb3d12bc86692aa2e0c36028936e4639a973bceeb1dca15288096070d61ac5c15a9406dc0670f94a31583ffc66ed1a9a3e80d6dfa6f63d3bb0b53d90c1eb96553ad15c0d3cb751d11c133148deb5823a987401d3a24e6f289837e14d66039809b0ae1e424babca7668c033ad4a8a69d40e329dd7c1cceb2953f0069530911dc58abd8177d217da31a222e8ff23e3b1c500474377f311e6b1c8857da372e9d95d286f743e357166c0ecb42d1ec03799418f9a046123f806e5855da4d1b2d89880ff3e196c5cfa8a4597dcf2e21a9802858a6c9340986cd2ff27185e330dfc2a9f6cb3016951f46128d5abe4c599582933faa3b168215c2b27230302f1f5cd54f115d745f8b38b090d18694bf7fc3225e57c663537b73c9e7edc3c93bf38e08d88c35e3bc5309c8788eb03332b3ef3d847896ee1e06577b6e1c6c4e5692142760b0b37b9474ab83705c4101cbcaf883dca1cbda565afb2bedfbc02a8c1fd6ceb95f04cae863a6be365787bbcbda9eeda3c25a18e047cee4952542341eeb8a88b7c1585393582bdcad7b07e9ae84d538648bb135d176e1a581851d3c2e1723539590b761a5d2b2cf40b840b996821a6711d97df25a7a41e2a44512afe5b44bf4a0362789dfbd3e84bfa1848ce7be9348139333b7138864b368f520701b2edc9ef935937f594e2777050073affe80f39fc76aa216e54b1cf5cd91f55a57fcfb11733b353f90038629d29003f37eb168b6aefb0c840c02a1f9a4c47f7eb9e07cd239cc68e43e1ebdc07aa000cd0563bb609a403eddfee525c236689f73a94dc36dcd9b51803c9bc3b5c3dce9928889fd5d99fdcf60f4e2422aeb5c5f593b468af1318072f7a2bcfd9549fa31c2b3b2f43a69508ac3b6062dbbd6b6ed9eb93d86eb034d12b7d957575397aaa9320a8dcd342c9fdec64df2cc0f87b8ded0f5bd4e3a8c01a182099cebfeb752b821ca097f56fd2cd0c4abdab9b548c436558ff6bb9af21ccb62271526e94930484d849e5ae935835ff4f5fc8bf119fea1eddfe0c07fa0bf6b4b34350607dd8b13a0725959f8ff0da9daee9a6c82938d685dd72d2e99624e61e5fa3c6178f498d4c7366b669f2a7ceb7b51df93e482287a510e9c3ae0c692dc9359dbab56531293ada05360a52ae0959cedc4ebddb2fc35e3fdd5266557558055731e2b484f9116dbcd4ed0669d67c66812526e8627f40d18a1d55f4c6ee7622eec2d92d2fc71e11ec90e68e94907f3d6732686d5831db36dc641bbdcc69f344726cfcea64a96ea2052a86b1b639a3b20be20c2c57ff3e8ffd41eb53de4e01b633ae9863c5bd8ca9aabee411adc57dbf7dcf4b8d9fa778d444190d828a5f1f7c9384288f00cc08ff2301ee46f6d5c25aba9e5f9cc1e9b7457390f1712aa9dd6e35d21c9396c11d84062b519350b51e53cc215ea879cfac731c7a5acff89a66f5fada159bd4ad4470eeff1943062e040bc503c2f05be0748ca8b825016c551f6bb288054438616a5520fa1e45e73fa59f02bbe8f044b7392becc7cf269eace5feeeb154be0ee269c2474f174fdcff97c65a08003f8da44fb7ed8c8505391c2a7567b988c31163be78bca0a9c0e377b7b7e219e2747a77bf0aaff45d0a2a5a1ec21e520e6f17583dac8d181a2562d057d333c5c92050eda1a936e160628a6b52a77cc81e6869259967179d17c4f2bb44110557d146198bb2205e136df82ab5f5f8eb4ca9a02c42c4a310745db317930c5bdcf660e5fa6fa6f492fc709f7bc70140ef301398166b7cd7ed5064343b2795414e6292150e23af2cdfdb0efa536acd3fec9ae1491da551c814b36fcaa1c6a7b0b2a675692817139c6f59b8c964d2e4267d1872578460654cd68d66b859a1546fcb7b4717e3227f48542d011951def358e3521c66c9f5f2405082675e16794994e7957a7df7e46847351938ae73c21ef76a201f90891bf1c21ea4f578ac07d4df9260f8d0e69908cf61804fb5291140ec549cce47a5a3b19a0fe5ffb0b933b4ed9f6c0fe99fdab77d8ae07e709bbad5ae0416794e1a625a5d7d24e7ca3906d1d4cca2b081e8aaf624846d91deb369dd33d3df85000e389c9fb045a10288a9f35c2a53b901d10879a1072c31291d0bd87fc7d8e0c48f6911ab1e18ae26d91e7a0d23fc5c6b9855fa7a19d8a342823ddec8f0e6c658d39bcd59ebc4ecbcc0d12a4b0f382880f1957996e22236fa29c1423b34da3575363016379e5e9fae9e272d9fc4dcb433403ba6d9ddc8ff916137108a41e70eded901a78673a6c051ce7032c07941fa953575690ebaaa525ff97d6e446efc304e2b3b5456464e5c3fdc78cee4fb2d117b70fda8997b43a561cdcc73866897a4313150ee29c980c536f5cfb043a83c8c12ffdece9e62df0c9d5d9e32a39ff32b1ecc099dfecca12f5a7033812fb6045506f2691a48ea032921e7637c388e5466c2e4a722b3c42d2d74556a20bf4db553ff78ce424b940e4fcc5ca76c11af38c3d15a0fb506b9225194f975df0b4491f930b13012488c7f7b38922cc5f6d54165c59032bc1217309d96fdc74ee320c12ddfe386bb2b6c59bc1672b5c91698b8d855c2b539890a3fd64e8d361c1f3194c030e4dc25a9330efd1b769f671dcfd875cb9fbd13942a41fc3ab8f6795fecd4fd1d01882d876182a014bc9caf1f5a5a8a183a863e7dc22974f425a12d20eae46658663fd8c4b0fe17c112c19e4bfc6d8595dcd64a7f27e2fcff03223b3e02b0af8853b1994356ca991615e9279395c4a25608f11f1e20c93d2216a7331938197122023450d217044fa21d8e2aeb4fd694df22e32c38ecdf7cd528bb430f9887254c5ced76833314e357859657755c1cfdf9a22968523193bf090011950c7ebf2162ac128c3fe63792ed4ecf24e321", 0x1000}, {&(0x7f0000000000)="930c8e906c744ab53f6300929986c24d6f8756", 0x13}, {&(0x7f0000000080)="0e50ffdbfb22c2a5c23c1780256b700e5b45c06512f36951baaa5e3b5640b53c69f45a66b5e4f811595099f68744c1e135d739f0ad8b1a2c430e219a382c6ccd837e7796bf6946b22dd1b8cfe2184b4e3e61e5e6e7be5783db7cadb41d209ff9249eb567dc62fb20599c897d76762250adb6e83f606328b1a1c6d182b0274726745d3614ac7d26118e8889fb380ce9171c678647a9a1d5905ad8cb7100d9c97328379f84eba1166968", 0xa9}, {&(0x7f00000021c0)="8b962174442c1aeb722519605205dccb7ca77b914149a19b42aba63db8579d4b163f04f94ad82636d9ffb2e92ffdd871c7ca313d301ca832b434ffaaddee6c491158e015910220cffedbe877c4d17cae55789395953119bc9c8fe7ff49a7f4913a1b6eae1e64bb209b48d716a43a0a5acbb97ac0dab8ec2d77c12c2d2314ba13410f6307d063693a71f975f1420b80ac3e14c43d1ac703ffe682cc7ff1d441ddad505d0a638145c67adf2b7391115773fa4f710765b116affd7f7730d99d31e63e275f7648b2d4d2870df7bc503e78af26aa85206b2356505c303c9e7d4183e416da6843602c54b0749852242e8f10b7829a8f8a2bd804366603fc5fa8955f09efc2033e674dd8cda5d6857cc2cedc361b3b95383556edb9376f939ef62edc264aa38a7790456cddda445b55c60c09368e6d0a9d1060c14eca6ec4543f37eef790e8946f6047c3db4bed4d70cddf23bc1c285d30b8ae914abb4db17d56e7b4a8e641570f6bbdec5ccb35160c4ba5946b156e2f5105a4fa1396f764d50f476473acfd4d39c9dac98239f6814e90cf2646522847f6f41e328d1e93b75404d5180f3daa880ef35a2b049180098fcd615b981e2df96c5a635d40e83d84eeb0a9917ddf6b5dcd4c251729a266d131db37d98827f463c86aa2188ab67f1f500de93500f3e88bbbf7a51303db775c7fad9edbbc1183a8ecc1d8c3141aba4a7ff5e65ff3d0cde8ceeb11bfebf4be87d7db564a7c298fbc27dd1db5b430a1f6df184c4c52ad3e8c43ef1e954e1d5f213564c7b08d4e91c9ffd5c759185b0055e9de500741437784270597a76aef9fff1f2c0ba8efd05a5bbca600ccaf7d6256b50d2b36ae533e9da25cd39a0470d4ae038233b2315062d299590d592e077272ce64e9f0aaaa1a677a2a2cdad31348e093d2e7b82b3ede3b7d56710c7db638a05e3cfc19379f333ed8f915ee3069060b7b2581846d87d1401e3f0c16c89379805236c2f396b38ddb17d01684f889c0532928ba035d37592c388539528febcf94f445954a1b988afb342bd3dd89832c70615c8e967314b826a683fba4fa86a7f74e54ee7b880c6e8d0b6e069e3ef3452edc904d5a594241d54d7f01c0bd6b6bee60750d3c88a3890504d9b2ef3cc2275e461e91fb72fc335ff767456ef27e59fd9e76e8abc667b7d42a2b2a77cdb1ad258479ee0789dcd201af0009cd0e6eecffa7b48b1497b2d498c30a7ecd718503de1984ea6252eae876d3f8498dd1730372a4325f5afdd4dbda63dec6ea347362c839da6d1f7e17b5b778daeb7ba542d79d20cbc1df4814d24d9bc4194d586a04a96d3d5fb83660fd63f6878a60a97e1a836262da296aaedfe1abdc2c68e1fda986ccf8ca2d0904e3dfe1bbca291af0ee9563708d2db05a8493f5124fbb8c856c1d24c46cdc9d43df81f0525d61fb1d3a817537749dd31e9dc61900afff367b8f37c4b0af869ab606dae86fcb47877b7833de8522cb39c59f0f2273962b62233c9dc9974e96647c07516fa7f13ca6bce1786b305392ef5b88ef569c7b484a69dbd9ab3c52a5bc4a0fa39503ef3e9188fc2c1a6bd8e1d756c5a0ecc0bff5c2ccf5c3dbfdfe083e266efc76e0c033fd137ce2f765d03d1090762c66f28e97aa319538d76be2eca88e9edaaf2b38de4534c84ca689e1af62f69cdcbd0f82566b4541f6ca2b73b0b0a2708ff39b90c8cabac1bab799740e0b74fe9fbfca228fd07d2d1e0695150b79cc81783ab8365b70537078eab5e875d8236c5e090e969d3d62d082684b28b86b8e9602e9671fcd72c426ca5920dda47cd081b87a06418eca0128b6a6f6bbe124a45ebb0625167792affbe26d87a3463a28911eaafff3c3d147cfa15c98897f0293f1d7955bc6251631b831e35ee2692eef783b7d42847bc0d22c43d4f9c7c7a6a7812e72514075cff261292d99b8dab12bd71b129ca22e32d7b6d9bd68c53224192b121fee807c602ebb5638e93a87abc72b72d528d0fdf62572c3018960433a43ef6d93ab608016032f33aec017a9546063c806daa30590f25a4dc594906a8b34f84cdcc7dc91c45744e8ab563f0b62843b349a7269024ecd99da3ea1fbc7f8f4ebd1980957f403d3f0d15065f012df55a7e55601a36aced31ba95257d4678d8ddbe439f5893bdf1500f14d292a71cd3edb31c703b57838766e9408b9d914057a3378400466ea0de5858b198120269003850997328ef8743c35c7db38b5ad4b1d0773d975290eb3bfdd3211e9c639da8727e7eae41752ab824fdcf64f3b7fad0e70698edaa47f99fa53a27a49979be5436d9a2f215177f15f2926d9dd1f5290b806c08adde429aaaa0b945fdf33fff7c3284d86b61ae3a09dcb84ee877f9e03b2199a19c76476b9d79dddf4551b509ec232460a0ef4abeaf1ddda6f0165d4f36403f9cbf619358e8c1f74b89e7667c150d5e50d9cbc9e5eba1a20e6a95e7e32d080b1145aa66716cab091400fde0b586e2051c326a00226980bc83d335299a17e2f57108edfe89f971fc1323406365d296a98f3bb4bf480200bca1cc1dada133dcdcfcd57cc7f33f930252d7dc7e588031af343639336683a048b202e8c9af3117cc0c2cd8eff4be4b4207cc4ad8ed0b77b1181701366718442467e3aa231c77089114f0ab28a17d14da8fdd3f4b7502fc6ea6fcf696e81c1b1fa98362bbc3f44ff74c04698e327ec4196ad7d23597b22d6b1bf7ea1b571794b682ce85f3693e89bbea94cdc301558cfaee3d0f0ae8e7cee96dd9e432449e61a72d7bb1dc2f71ff1a5984b84c39d4c1a0a7328db1700cb7f16966d244b0c4466dddc7dd09a81ed63f5d48e191dcc1910530920300a465e4356d9e5589c8c888eb21aa052184f47dcb4fc24a7b70655cbba8854dca6f904463531b39470dbf9e4e556c39f926b5676465fd04d0f4bc509b7205ccd3d5f4f716742365a1a4dcdd46fc62944bfd973d5b2fc9b579609590b55f111406cef9af6d2c165375cd2678d0778502b3b1bab9cb4060aacf27b71758f6fa8ab6f70a3a251140482ea0085665662d6e8f93183a707efd5ba7654064cca7cb85cbbc0c54e97a74e3e0c205db31dcf632a6e778295b026e98c54754fac5c51f32239bdbad086a3c19e88b36435c5fe1f509dbcfee57c71821ddc1f9d8895bb6f56030665ba20c6e9c27522c772f4e8937a6ccf068c0af37a97cef518d8c5bc0f7dc75ea93be9abee72baba989dfeda89bf34bc5ff95d1e3e5c12742a66820735f1f0db828ee6c2f0d092a8e3303bbbee29d00afdfd122c4be922fdfb6d9c83cd2a60e2403b83e21c6fabc966e6ef607edaff0de00186c2e89d70e5fd5e147ea5349c2efac599d89d9d7d2f1522488843aae1ea1ef10761a14ed7f4f229c03b7e87896485448f7051ff2d13873b91514a83bfad3d726fa8e184b6e431aa93d329bc70fd4b76eb6a830b22b058926df908534fcd3c861064354e8af1d47d2fe17cf1fb26f3941620394ffdd9b7952a96f425eaaa47cc1f90554bb659000d3299f2d6a0cc82e9544bdbf09f9ed09821cce72b964705d97a675ecdea61645e20710cedf68fa5b74c8894300848418005ad1c4610b0fa68e535881e87138a4681cfcb374eb0abf6d6fb6162a5f88f9c3d3d25f7e810cc27263147b46ddec3eea4639706299c8a1393805096f56663d84a1a5468ab4e45350f11fb393cc4dabaf0109188205d5136db6c1b842af873b078b5d1be84e40aaec2be8054a3d3fad0ab9d65eaa3e6315423bbf61129d0d8d78083da11f3dfdbcca460bd614bf21c3e5ced1e87e20e1fa5b4a503fcd183b8a171bc18e996e4d2fe7386c11a157cbcad837e397542eac30f47769c9220f17edbf5800cb70da7c2a79a21cc2cca6e4f4704d34264958d4c98e123133f4c3bc0566f0981ec08247489d82a055145a6eb9b14da28a2eb5b959c81c9a56bed4715812d839c7a65782556de3514e9a557f49ed2f8cf5503cb80800ba6d410d2ec484f44a02069f34c96276758193e8242812458ac9428fd4ecaeded10f4bdd63450b7d637de04d5302894060e171f8c0e3f28955a971cc755892ee1fd83b5f4d462d99479d0c6458056ae5419c82df8545ef6b8aea6c1990673f171b28e12fc8704368c99c736f5a0e343806ea4190f253e755b4dae3af3341b5eaec0cf682bb1d90c9fdac81e94c20fa5689d4373e1cfe1cc1f17f1b51790a96cd610233f492b9e0535c7291b6061dbcb71e9c47486121b3f167408961c93eb5218ec20f93f52aae0984e560111d200bb41c2a7ca237ee6532a99c5f2e9549b5ff35c3628029d3859941d2d786f27e2a601b617305cc2c54562a97597a1580c3c76188411c35dec1e34c61db9ff4b97a01160f28a6ad3f97be83677c1367635eb724349b8dc53dba3f13fd82a6f032845544cddde1e3a927029e225d4947be8741c9b3e2067cd8e44d6b1a0a7ccc1bd6e646a1c0bc87e1ae4a960b11e77f0762daab67c6d2687f09c33dda68fd2662d9922b867fbf0bf75a899249ff1d27fb376c4d1059a8072fd8890afb65a88386a2a70aaf90b2d066bc91d3163e97be6f9eb1183216d6c557f5a82f0d57599213f6b2a5664c71344fc49a39bb2cc0292b5ff8667fbee445fea9bc2f185fb76f75f8fb2d64e6bec5c9006ceb7d538103078b56144be794ddb1f581042825bd6bc520ee6b5764ca5be4abcd7ce9270633336291d9e483822db9dbac66e61823e6300a75d42444f8012a4f1f1772ab3474be478c3259f3ec62a2a69846a227fe6aa000e1578948e5ec7eeef7e1ae2c38605a0a90efab7cb2534bbc0f3c55d8a4db9d1c6aa3084e4785b6b603da507a4734d42c815397aeef711cd5e84c9c9a56b0d18de86c3f4feb0a8ac4949c705a4dd9c531aa917753d3040774ce078287521fb13ba85dcf091a8bf9a93e327cb7daf12674b27f460eddf8fdf0043eef7a96ad2954e04dab11ac1cb4b370828b26e7b0c12b01eb869614e177a88e36ad1a76de5d6366d2b810a1382d445e9702b793091560e4f823f791dc5692fe197d56afb20d6e152a5b8a0482fa83f6f01f799ec8028291e0af5c07743c3808401eaf3d13effa713e212cf4a3d1ab42fce057e1629b618947e3c84a12af33d4048783c864807253a6befc3bcad7d54024a5c0cd4810af46a4ba1962c9720830cab9251ea68aca160262a148dea791d6a695dfee25af548de2e424841657aa0275b5f07f00aed542807c4e4c1f18cb695fc8bff1ba1f88b21cf7cd1528b4b9e8921f175a706e1a86787f59477c3b0a02e054cbdf109703055c3fc585e3704704484cf983f6d81ccb544ff296bfa738861f50c6e9ae1ff3f048147d8a2b2677f14afb884d4a8a6356986b45920c4bf14ac835ba426215c9a0872c5017c110b64f59fcab4b19abbc7b9488e6c7f898f876045805051f40be865741224f6c8892b30457691bb2bec528083d10904738d661b36cdec85863e850f0ed0562e34d8dda5b5ca7b7676b969eee2ea28e13231c1f41680886dfefd686af9e53d9fdc058e9785a633c82690f0a9e19746557653f8519f1bf5852192ca40a95e4cf02ba53f8ccbec9b62e201538a237ec35ae5576c17510ea753d483b179c8468b0fec5b1120b87c71aa1caf0d04b65edb99407bc9b86be4787a47b0f0a31f521bc93383a4668c909976c2cf1a61daa775b4ca9742164b2842e6813696063032f73a3959f8522a9a787cb3c08503f980f8804ffcb1461953962128c3504cdec3e4999810a08cd5f87da03adbe176f9046dc117a4ef8cc01d7ac719", 0x1000}], 0x5) 16:06:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20ncci\x00', 0x201, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r2, 0xc0a85352, &(0x7f0000000180)={{0x1, 0x4}, 'port0\x00', 0x8, 0x110000, 0x8, 0x4, 0x4, 0x5, 0x101, 0x0, 0x3, 0xa90}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200280, 0x0) setsockopt$inet6_dccp_int(r3, 0x21, 0x1, &(0x7f0000000100)=0x4, 0x4) 16:06:22 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x300000000000000}, 0x0) 16:06:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) prctl$PR_GET_NO_NEW_PRIVS(0x27) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x8000, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0x6) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 703.682766] binder: 30755:30758 ioctl 4b47 20000180 returned -22 16:06:23 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 703.766760] binder_alloc: binder_alloc_mmap_handler: 30763 20001000-20004000 already mapped failed -16 16:06:23 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x400000000000000}, 0x0) [ 703.855879] binder: BINDER_SET_CONTEXT_MGR already set [ 703.873243] binder_alloc: 30763: binder_alloc_buf, no vma 16:06:23 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6007, 0xffffffffffffffff) r0 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x73c, 0x101000) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000080)=0x10000, 0xfffffffffffffdb6) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000100)={0x100, 0x1ff, 0x0, 0x3f}) [ 703.897378] binder: 30763:30766 ioctl 40046207 0 returned -16 [ 703.903847] binder: 30778:30783 ioctl 4b47 20000180 returned -22 [ 703.908275] binder: release 30763:30766 transaction 1681 out, still active [ 703.917259] binder: undelivered TRANSACTION_COMPLETE [ 703.937271] binder: undelivered TRANSACTION_ERROR: 29189 16:06:23 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x8001, 0x400) ioctl$VIDIOC_S_EDID(r2, 0xc0285629, &(0x7f0000000140)={0x0, 0x4, 0x503, [], &(0x7f0000000100)=0x1}) syz_open_dev$amidi(&(0x7f0000000180)='/dev/amidi#\x00', 0x3, 0x125002) [ 703.963413] binder: send failed reply for transaction 1681, target dead 16:06:23 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x30d1, 0x10000) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:23 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x600000000000000}, 0x0) 16:06:23 executing program 5: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$media(0x0, 0x0, 0x101000) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f00005befdc)) setsockopt$inet6_tcp_int(r2, 0x6, 0x8, &(0x7f0000000080)=0x8, 0x4) ioctl$DRM_IOCTL_GET_CTX(0xffffffffffffffff, 0xc0086423, 0x0) r4 = syz_open_pts(r3, 0x0) ioctl$VHOST_SET_VRING_NUM(r2, 0x4008af10, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000300)=0x14) kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) r5 = socket$caif_stream(0x25, 0x1, 0x2) ioctl$EXT4_IOC_GROUP_ADD(r1, 0x40286608, &(0x7f0000000000)={0x0, 0x8000, 0x0, 0x0, 0x7ff, 0x1}) kcmp(r0, r0, 0x6, r5, r3) [ 704.144352] binder_alloc: binder_alloc_mmap_handler: 30792 20001000-20004000 already mapped failed -16 16:06:23 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 704.211733] binder: BINDER_SET_CONTEXT_MGR already set 16:06:23 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200000, 0x0) ioctl$CAPI_NCCI_OPENCOUNT(r0, 0x80044326, &(0x7f0000000080)=0x7ff800000000) [ 704.232394] binder: 30792:30798 ioctl 40046207 0 returned -16 [ 704.263950] binder_alloc: 30792: binder_alloc_buf, no vma 16:06:23 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x800000000000000}, 0x0) [ 704.307903] binder: release 30792:30798 transaction 1686 out, still active [ 704.321530] binder: undelivered TRANSACTION_COMPLETE 16:06:23 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 704.370338] binder: undelivered TRANSACTION_ERROR: 29189 [ 704.375890] binder: send failed reply for transaction 1686, target dead 16:06:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000100)={0x6, 0x2, 'client1\x00', 0xffffffff80000000, "7099f32f70f454d0", "75c7c21f0c50f128be617dbd8d5cc0d2e1684516c61eb61702fbc9c7a51a4642", 0x8, 0x7}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:23 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:23 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xa00000000000000}, 0x0) [ 704.514597] binder_alloc: binder_alloc_mmap_handler: 30819 20001000-20004000 already mapped failed -16 [ 704.548225] binder: BINDER_SET_CONTEXT_MGR already set [ 704.579610] binder: 30819:30823 ioctl 40046207 0 returned -16 [ 704.621894] binder: send failed reply for transaction 1691 to 30819:30823 [ 704.630340] binder: undelivered TRANSACTION_COMPLETE [ 704.639425] binder: undelivered TRANSACTION_ERROR: 29189 16:06:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x400, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000180), &(0x7f0000000200)=0xc) read(r1, &(0x7f00000001c0)=""/25, 0x19) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = gettid() sched_getaffinity(r3, 0x8, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) fcntl$getownex(r2, 0x10, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:24 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 704.777030] binder_alloc: binder_alloc_mmap_handler: 30834 20001000-20004000 already mapped failed -16 [ 704.856970] binder: BINDER_SET_CONTEXT_MGR already set [ 704.879489] binder: 30834:30842 ioctl 40046207 0 returned -16 [ 704.910259] binder: release 30834:30836 transaction 1695 out, still active [ 704.917310] binder: undelivered TRANSACTION_COMPLETE [ 704.970918] binder: send failed reply for transaction 1695, target dead 16:06:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200, 0x0) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f00000000c0)="e6c488eedb754c7b51aae5fc349ef6210b2ce0861263f3903a1dac01b54decd75d9f6290b26e357b9521f4f3d8ac82373f0d177a631e5fcb8afc640c47d2a74aa8765ba6") ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:24 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r1 = socket$inet6(0xa, 0xa, 0xff) setsockopt$inet6_int(r1, 0x29, 0x16, &(0x7f0000fcb000), 0x4) r2 = socket$inet6(0xa, 0x80003, 0xff) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x60, @mcast1, 0x5}, 0x1c) socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) 16:06:24 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc00000000000000}, 0x0) 16:06:24 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:24 executing program 1: pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) lsetxattr$security_ima(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000280)='security.ima\x00', &(0x7f00000002c0)=@sha1={0x1, "c6f0eff5dd2ab619743ee1557fcbd284cbed85d3"}, 0x15, 0x0) syz_open_pts(r0, 0x10800) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) splice(r2, &(0x7f0000000300), r0, &(0x7f0000000340), 0x200, 0x1) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f00000001c0), &(0x7f0000000200)=0x4) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0x0) lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x3) 16:06:24 executing program 2: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000140)=""/154) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 705.546715] binder_alloc: binder_alloc_mmap_handler: 30869 20001000-20004000 already mapped failed -16 [ 705.605457] binder: BINDER_SET_CONTEXT_MGR already set 16:06:24 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc1ba3a200000000}, 0x0) 16:06:25 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x80801, 0x0) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f00000001c0)=""/193) 16:06:25 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 705.652568] binder: 30869:30874 ioctl 40046207 0 returned -16 [ 705.768258] binder_alloc: 30869: binder_alloc_buf, no vma 16:06:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x8, 0x301800) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000000)={0x2019ae2a}, 0x1) prctl$PR_GET_TIMERSLACK(0x1e) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000010, &(0x7f0000013ff4)={@local}, 0xc) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x2, &(0x7f0000000040)={0x2, 'gre0\x00'}, 0x3) close(r3) dup3(r1, r2, 0x0) [ 705.816448] binder: send failed reply for transaction 1699 to 30869:30870 [ 705.821490] binder_transaction: 4 callbacks suppressed [ 705.821506] binder: 30869:30892 transaction failed 29189/-3, size 24-8 line 3035 [ 705.840612] binder: undelivered TRANSACTION_COMPLETE [ 705.875605] binder: undelivered TRANSACTION_ERROR: 29189 [ 705.919784] binder: undelivered TRANSACTION_ERROR: 29189 16:06:25 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xe00000000000000}, 0x0) 16:06:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/status\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = fcntl$getown(r2, 0x9) fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x1, 0x3, 0x6, 0x0, r3}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f00000001c0)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) fcntl$setown(r2, 0x8, r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x202, 0x0, &(0x7f0000000240), 0x0, 0x0, 0x0}) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$FUSE_GETXATTR(r4, &(0x7f0000000040)={0x18, 0x0, 0x2, {0x99}}, 0x18) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r4, 0xc0505350, &(0x7f0000000100)={{0x0, 0x62}, {0x80000001, 0x8001}, 0x9, 0x3}) [ 705.999336] device bridge_slave_1 left promiscuous mode [ 706.005249] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.189542] binder: 30911:30913 unknown command 0 [ 706.194895] device bridge_slave_0 left promiscuous mode [ 706.199513] binder: 30911:30913 ioctl c0306201 20000300 returned -22 [ 706.201016] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.244225] binder_alloc: binder_alloc_mmap_handler: 30911 20001000-20004000 already mapped failed -16 [ 706.295052] binder: BINDER_SET_CONTEXT_MGR already set [ 706.295544] binder: 30911:30915 unknown command 0 [ 706.303906] binder: 30911:30913 ioctl 40046207 0 returned -16 [ 706.326052] binder: 30911:30915 ioctl c0306201 20000300 returned -22 [ 706.431433] device hsr_slave_1 left promiscuous mode [ 706.475271] device hsr_slave_0 left promiscuous mode [ 706.516516] team0 (unregistering): Port device team_slave_1 removed [ 706.527952] team0 (unregistering): Port device team_slave_0 removed [ 706.539901] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 706.586396] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 706.683207] bond0 (unregistering): Released all slaves [ 706.790593] IPVS: ftp: loaded support on port[0] = 21 [ 706.907068] chnl_net:caif_netlink_parms(): no params data found [ 706.947973] bridge0: port 1(bridge_slave_0) entered blocking state [ 706.954493] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.961687] device bridge_slave_0 entered promiscuous mode [ 706.970923] bridge0: port 2(bridge_slave_1) entered blocking state [ 706.977345] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.984957] device bridge_slave_1 entered promiscuous mode [ 707.010240] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 707.020229] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 707.036942] team0: Port device team_slave_0 added [ 707.043463] team0: Port device team_slave_1 added [ 707.111583] device hsr_slave_0 entered promiscuous mode [ 707.168381] device hsr_slave_1 entered promiscuous mode [ 707.290014] bridge0: port 2(bridge_slave_1) entered blocking state [ 707.296580] bridge0: port 2(bridge_slave_1) entered forwarding state [ 707.303279] bridge0: port 1(bridge_slave_0) entered blocking state [ 707.309680] bridge0: port 1(bridge_slave_0) entered forwarding state [ 707.352328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 707.367437] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 707.375878] bridge0: port 1(bridge_slave_0) entered disabled state [ 707.384463] bridge0: port 2(bridge_slave_1) entered disabled state [ 707.397765] 8021q: adding VLAN 0 to HW filter on device team0 [ 707.409761] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 707.417450] bridge0: port 1(bridge_slave_0) entered blocking state [ 707.423858] bridge0: port 1(bridge_slave_0) entered forwarding state [ 707.450519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 707.460124] bridge0: port 2(bridge_slave_1) entered blocking state [ 707.466492] bridge0: port 2(bridge_slave_1) entered forwarding state [ 707.474995] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 707.483314] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 707.501886] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 707.511969] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 707.524145] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 707.532395] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 707.540700] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 707.559339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 707.572189] 8021q: adding VLAN 0 to HW filter on device batadv0 16:06:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x80000001fffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:27 executing program 1: r0 = syz_open_dev$media(&(0x7f0000000240)='/dev/media#\x00', 0xc7f, 0x200) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f0000000280)=0x8, 0x4) getsockopt$XDP_MMAP_OFFSETS(r0, 0x11b, 0x1, &(0x7f00000002c0), &(0x7f0000000340)=0x60) accept4$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000006c0)=0x14, 0x80000) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) inotify_init() r2 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x3, 0x200700) r3 = dup(r2) ioctl$VIDIOC_S_FREQUENCY(r3, 0x402c5639, &(0x7f0000000680)={0x3d7, 0x3, 0x6b}) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="b900000000fc030080b3c61efbf1eca301c6b31526914142f072f12ab9751a240aac82ddb9fa5fee55f6be95d1c7677dce319c8210ac1ea6edd0854f27e45624e044d811a7714ed5d2c9824298b45b6413ff95a5f0b7b10ad486f373492a5e3c6e2cef9f2d3c089e359c9e3fde1edfeccc59b17ddcc1683915fffa433c8ca7294109036e810200082e95a288b05e94502355a4dc9df4801f7eecaa313e37106cbe23e453ad9ad4f42f7e924ef97cab4f5888e7963a1a50471b83a957253657b9d41a8dfe886d18d4c3ded3b43168e02fb2c13f733dd18750301372fab3aa670294647ec732a1599c0176bcf89ead51b97e75c6ba189e7d321da52fea82916f03fd2507518c905d79e755caf1c950129e410d00e78ea2b8b3e78eb121a2348e6cc2418ae2e3dce8e63fcd1fd7870bf0ad8791312c5d0a417d0a657fbf19fe6357a86774b705746f2e36c23598fba61588b5eb13b47d7eb7e24e9a44ccb05e17401813b77b6efda80de3883a6e09dc41bd903f8b81896c9397904c27d63326f811d63042a868b5df108689193584475089da7a97e018d20a9a2a500722"]) ioctl$VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000005c0)={0x8000, 0x7, 0x4, 0x10, {0x0, 0x7530}, {0x7, 0xa, 0x1, 0x0, 0x17b1, 0x5, "17700d6a"}, 0x100, 0x1, @planes=&(0x7f0000000380)={0x101, 0xfffffffffffffff9, @mem_offset=0x8000, 0x4}, 0x4}) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000640)=0x14, 0x80000) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x100000000, 0x3810c0) bind$vsock_dgram(r2, &(0x7f0000000100)={0x28, 0x0, 0x2711, @my=0x1}, 0xfffffffffffffefc) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="2b67dd05308ca38f8d8839af4e7785c007f76f01c5b7d6c93c9abc5993f5e4801faa93c15d975f270446928892abe14daffb55df96756887942731c72fd84827f3222f7b759b19f21c68bee9422c70eba1de74a709856d0010f0d9dfe30ade81e8b5b1530d32c09473d78a48c7989c1906bac632ea8816add00935ed03"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:27 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:27 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf00000000000000}, 0x0) 16:06:27 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x4) syz_emit_ethernet(0x30, &(0x7f00000000c0)={@link_local, @remote, [{}], {@ipx={0x8137, {0xffff, 0x1e, 0x0, 0x0, {@random, @current}, {@broadcast, @current}}}}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) [ 707.631112] binder: 30920:30921 ioctl 4b47 20000180 returned -22 16:06:27 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 707.742228] binder: 30928:30931 unknown command 98395947 [ 707.757935] protocol 88fb is buggy, dev hsr_slave_0 [ 707.763040] protocol 88fb is buggy, dev hsr_slave_1 [ 707.780799] binder: 30928:30931 ioctl c0306201 200000c0 returned -22 16:06:27 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x1000000000000000}, 0x0) [ 707.825598] binder: 30928:30941 got transaction with invalid handle, 0 [ 707.852784] binder: 30936:30944 ioctl 4b47 20000180 returned -22 16:06:27 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, 0x0, &(0x7f00000001c0)) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0x4) connect(r0, &(0x7f0000000100)=@pptp={0x18, 0x2, {0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000001240)={0x0, 0x1000, "d4e713c50056f1efc926db53ea37f20c0cf2b9378946fafef9d1c6161d33bc58b366bee50f635869b26838f2b8ddcb7b40a1db7d7f2ea6041fd359d71fbc6d29e47739f34c40726586df7f9a99d224956b35c1cafc5c9b79c7a90ed578a21da6e8db51a10061f98f37c719ac53e1ab2401765dae8e27f3cfa64d5900316a347a47db971dc1024c49736cf3a9177444cedd802963cf3d406c9a70051c7fd29ff706fa980a82cbb15046d6e6d0bd9130e589efca61827fd9cc42d04badfe20a39d2db37b6e1fc49379331bde5ce70b8d9c3c6263f8e4991e9d757481154a0a739429cd2af26f6ede0eb54a3406f14c33294883c327d8b3721101c97f0440d4c9dbab6eb599a38660ca86fe36b26267735414a1bd91ca79448fde0bd8a1ff6006f2f9aa45845a9fcd15b65d74228ccea2912a81ae3bd1da8c44d9bff8b5a046727ba8baa0866a2df41bdf7b6e4eef3a5626668193edf1167a07d0de03db45cdac618a1b68e632bed8a4e0f28a41e1328a34441b6fbc418bda29685282574f3b30ad731ea96f58a6902a363c171ff45e01ddb379ce569784523dc44fc0be0492994a987e99fe6d1bc3b208563d934ef93ba45782c5ae7ab03582b5c2e02d3923fd50a7bef17680f6cfc4b47eced1eaa31b27cd5408d37ffd5f21e4d6809837017ddff86473ce04dd1651e901f343fb5e560cf4ece65f8b22530e7481d05dcbd79429f872cd05c71a6e5041369cfbe3f96bcc7af0d8219268868430a5fea4e6813a39e46dc02872aae62a3c1cf2e4524c2bdbfe3551553674255c1013ab403a8831f793b1675972a5941f7362192cf12c9429b4a90093fc160fd67255c21e4246f82a0d79479444e305442eab32ed1237dab8534452f12d2dbcd275a709a7759e8a3e9a02017e1f9af58c91a0453a351ab7704e4f9c289dfeabaffd8f1437db6288e654ec6d1a960ae9d91d44e95a90282804805a49965b09958b5c162cb5366b9f2480a923c510743f6d4acf6f330ee448fec7056c809e74c575120d7fff3c1f1d63036571c9d5cb47d38ed87f980d7bcf5a6022c7430b454ab0c2ee1d72169b555d068df7682b3c7299e55b528eeefcbd1d18c3d44f84a1e7b0218de39b1c8797997ff65ff8e626e2ba9f0e02e5b0741e779c4866a4c290475b9fbe323defc6e155a82827c1c41583daa744199c8c6db27a7a56d9400de5b695e9f3665a01bb0740986943a3195de195d4a8072585b69b0dcccb0b110e8973e44f064c314e192ad46298c9ac90fb42732feac995761830b4bf483dd258acdfce4c8a56e580a796602aefd50655911a8a2a6cdd04713289ee67e8da5e301112bab7211f2e283c8ab220e8417b5434ad767de7580de7c0a0e340ef656551ea9da7bfcc26bf6f3e91bb1d7074c4262e9efbb22a2c745e3dfcd0dcd1bb094d28090b224f96842ba6c667d9f920355ecff85207ff826b6c5140ade0cc3c711960be285cc6888cb1ec4c64db0a3a544553659b2fef5ecd3e37ae64ed88c9def54647c69120a739e72d5316db0f166a82d9e2315c92022d9b45d2d6428f88b2e31724f85c78a1e5742097aaed485ca05a7b36f8cb85ee4a546c878230708bd60ca0e1123bd34deda6c0f0807a8cf47dbcf4b3b00041eb9e7e7af42809b4eeff21b6585287da2a041ea70fc36627a2b078edcb523165b7471215d04a092a82d11d64688ce0ed8a204a695c9768ae7d1e4236554066ea0f326603f4ddf772da6fa81106231d878ecdac71fe3be6416e84ff46772f4805065bd927afe00aba9912c3d1de9c8bc76108d6e72451bd49ec52133701274f0caa27ac53ab47c2228f7c3ef45a556933b5b8d70b76c15603924ce658ce08f7cbf99770f9eb136a478ad8c80bc978a8aeef9bec5c9bb2ca5f519faa3c19d69f10b9b4b5b688b338a35221b0cc8aa420790518c9f0a3d86339f8b3ef56b10953af0690e1313db06ec198e041422c5785ae200ad1eb0607788f6871fcee5a80213db9fd61c5388cc8e031b60e044f526e337fda6560d09d503175b214a5910096a177b772d0228a1a3f68b0952e82b44598bfb8021a5568b44dce9b2efffa3d35e7130fd6e576296273c08ba7b51aa547b21c5d4c91d75776c11f6b6aeb84350ee71d04e5dc26be842414c731df15c3b99eea87027087d9cfdfc1efa4de5c090869cbd23a5fd58b3a98a81c6325f1b9486f3bd2643606cb30039de3b0ec6ad83cc2419c7877efb7b0bb68e33783008dd51e8a69d502b50884de0cb10766067ba2d5224ed8e92d778485689ec8b4483c253695e45b7b1e61ad59d9b1f1a91f91a4a2e4716a0a9d83a4a0ab1114ad7e0dcfdc3bb87c2e9619baa815de33a7dd5c47e47c5f428050f38f426d5eb844b5eba1c877a02bb5db149cdf4bb38ff035abe571611a203736122cd8e458c9399dee783886ebd8097b0fd376dfc32bcb274e3a34e21425899c85d93f23db3c1011351082d5bad0c666f1b557f17d7f5b651be732519ad841b9e10b64c04121c33d0c1038eb3bacf5a08ce526d48cb4fd32462971e5fd9cd3bb910452b1de540c6b3cf79389163c97f63d3ab7b6ea52b86557a357a2a2d55914fd3e0a7346f4b710875fcb90ed0e77b2d5f81e40682aaeb34893dc7a649085e2bfc31ef0cf83e603924203ddf935fc3aebc170d77bd6c9db9849cf5d413706c2e0833dd618a54bfe89c5595bbb7de1cbf38736ed916ae2b676d9c973acb2674200604581dee9fc1f860b377f69bbdd331a52e0e1189ad11a54fc5a7d2c56b36914b8ee01fc8019955624eb892a0ac40f9a4c248cd3ae7b42f09e7fc8681d16b9e9d16b5721055822adfc5b3fb4ff2c91151542b120ca97903273ca7f377f08532ed2e70eff81ceaed44e660db6fba8de09128016d5e7b3c3d3ad87f05e0bce80bacb4dd669bb36b178dfe82ae817f13c6fded3ede0de4e4aa0240aa360fcb2c059b1fb425e9f6c5dac0ac0b5ee33adb18abe5e75dd3179ed1e6e7cd075ca343536f90ce5714840726de67d637cd5175fb29e840d94aedfef0bfc0ed518590b887483698d3ba0c783240784a2c2783ed2f3e4212086050f233b4b07f6d4336c987baef01a24156a708c94643249ae6770c6df6cf78945f078c15c2e865852e855b7a0bb7fa9cce30e408a913fd8a87415176e91a0f2a5a0ab39f8095df334a848b43af736a0812d8812ccda374496b42f7492e7498bc8e3b46a9179bb8234501f205783a06964808332fbea6aabed5b1cef0d1d9a9df0b77a9445af802ded32ba0be2f6d9e00e84a13c0c3372c96786de5331ab100235e284ecacc1fd5072b47715af02af2af0ef845b23fac4732762a476b0a378c1ba058844de5c5a8d30ec8ebcef7fa097a16f85fd575ab77c6b6ac11b5dcd98996e7a879bdecc7bff5090a86304506362a1191ce79f862512b05049c32c3a53dff3061f277ca927781c8d3b11fd5768153e15978207dbf5054be641909aef5945d3c8b303680ec9c2ce912633e5d03c7a6f4882bbc43a27bb558dd4162877365573a87b5710e8d376de6b55995444aa463da429719353c5dad4009ccfeb2889a08237a462db4086eaacd8b590b914c53387e769c0a110e37660686b7201399b3a3b7ed5808c7817c15f576fd5de0f191bb7850d9f7fceda8bf2fdcc06306fc9885b517540bbd49b90e0216fafbe88cc165b588f8148ec76fc7c03c98c57612279c18122f725a331437c7a91765dbea3fa9068d9d6abec1256350ef6a03d0655874b6443338447b8c24beb258d69343753d020f2668409b592f18c008737f23041b1ecba40f142e622c470a9fbbe6e99f34c51b22ae732985a25ce18fa6f73359a8f2b3305ffd751c03a811d3a9d8060a18545369a81cb8b9eda2d43c5b8f365ea5a5f547ec99a5280c7dd025780b5b3d71df6cd82dcb3ab4cb4b15e39ba75cbaf5661e075798a28f8476d7b4bbf054c9f0bf3c439c60e8935511c9f94fcb09d0b2300a8c5ee2768355fb51f0b2d80e2681d4abf6012cb50bf35746ede667e01bfbb63be06a8ddc20f333ab207fe660f4ab6e463411af31932440f950297081395f910c221fb036eab4d9c23210ff8ca86f944b31ee1904e1f9e996a9f93f75c93b10afd1f862b1a0088f01ad99617e7640beda14f66f71120482a3f56387a376c36550d9e288159274669a2af89e61c20313547dd3ab6b50e8569e65a9e363053f8d496918642bfc847b38a077a100bd60915298a5fb654bd2afb9c7b08361acf1b0ce11466fccbdc2e829147161b5506047647f304efac02d110a02e91d394a7de3d1e492c032bc8d9f0c25b90238a09c4ede4e7516e8f73de89fd163a194a2068bef62c488fd057c678508465392b0d53a6bb6d0015e3bec333cc488364d5551099a2cf48e5422f2a8a0dc22210c53f63e5d5525a6db8970fcf0a9d2f880792825a463f82a1ddc50af99f4f165c3c9b7c63d06331de79ce13b80e245aab320605cfc44096f951ad760e6e48aead121418bfa97ded60b60cfe54f74a48609f42b5802d5c230288f141b8dafede059092c4c6d6558a9e7ed52a10f6fa10ab60dea1542c6c806cfa318916df44194131c1bcd2ab427d9898f5d73e54c80dcf98563b4c48aed218799fa94f8906af3f8aeaef0d72651d1c8fbd682f0ac83a465c07f2beb73835eb1171737b0b5f9c2bc7e1f89067067bc55e5196f1eb32cfc5bd1a35f7f2e3bea22ecaf4fbc49b979bbad0659e5877f8d32dab840a3e0878ca24856da82585085396aa9bc58b4cfd363cf24cdd1b7e82f432f7e088c4c837edc01ba0435a4edc8265ff048b1ac9a37c27128546930c4d0bd62fe2a98e9c00b4675f9b2528be8b9a13d98433c33ca53c135051c42fd70ce7b88621e4ecd4c7af6cce78d7c5525ab070ea46b05cf5b158aa562719c248503d34cc01d7bb7106f29a8aa287e7d158f949cb714e3106f2db315a2355720efdce8b99caf3b6733c76d4e2cbb9f1326d989921e6f217ebe0f433a443dc9cafa5e338c1c9e8a6c280e7acc040fcac9be77643d5270bdf93af57678d3c3a9bf1efebfa96da5ad6aa96cd7ec0b68f22ed483b8ea60521f96642db9cc72f5e81529a126059c59176ccd2b16ad5dc47b2bf73c4af5c2e15525423cdd128fcb49c2a74b45567bb3cf31d2092dd1a2f6b274882adbc0be8a3e455ebc2f78409842aabbd6cf5448802a254e3ee9c8fd07b73db9c1e639da7332ef3d62cc2bb05579329d36e58d70d507b46a07a9223e9f39377bc4f17e3112fa60fe58ceecfb34d2920bf124780b9504e8c7eb9ea2db06d5845e92e023fc6a027d2ce428d17ed73eb19afd2c75d8380738bb125e23729e89509074e7b01a7383c64204e8beda27536df9324a49776dd3d604b8037e9247139c0b12dd47a7aa4e684c7117a718716523739664c6ee61d06f03e0f3509e269a71c5ee91d84adb99ef0ecc78e3b9262d1a086e13166e459ea0735db31d714780c536a13b209a94f97260c5c9c5ae34fadd0db0382188b38de8c9a80d5c3e6b3edd2168626c9e3c79c9048e773d6aa9771a30de1ff53fdd4d5b41aa9dc2c7cfc68e94eec36ea404d9d39ef9dbf022d29f36bafc9c9e7a7e53ca6bdfab130642bdc9b7c6a19f49c989d787ddc6ddf010571156cef46f76bd6f7defda6a88f130d9b06a225114b0bd41af208a5cb7073447aa650c05de5e9543d288636a2293c163176b3c3ab4c9047bc18c8c47633fb58bfa2f0c0d59de6940d03148d1d03c468c7918f030eea48d2d3eeb8f6d65f02e7b98afde6fad5523515ed"}, &(0x7f0000000080)=0x1008) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000000c0)={r1, 0x8}, 0x8) [ 707.888058] binder: 30928:30941 transaction failed 29201/-22, size 24-8 line 3126 16:06:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400000000005) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x200, 0x0) write$selinux_context(r2, &(0x7f0000000040)='system_u:object_r:dhcpd_initrc_exec_t:s0\x00', 0x29) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) 16:06:27 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = accept4$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080), &(0x7f0000000000)=0x60, 0x80800) accept4$packet(0xffffffffffffff9c, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000001c0)=0x14, 0x800) sendmsg(r0, &(0x7f0000001440)={&(0x7f0000000200)=@can={0x1d, r1}, 0x80, &(0x7f00000013c0)=[{&(0x7f0000000280)="b99876cce52cbc1706116f5c1b7bc3250c1e07073e67feb90701989a3760751ea6f197fd0392b2d9b9c52ad8a76928c42e9639d5b561164f10f33d06f605e12c94e58e719562cf4aea6facec93ce0838bad73a5b1356e806b11b93ac73dba84686edb011517c5bcb6703178d0b9877744523088bfd997eaa82522e4dc8c63e9852752cf754d8102ad6eea643e8a638edd9473795d396d47150c17f776188cba27700f7d2f57bce4b4539327f3e671ba7b6321cc2d4499d02d0ff93930dd6f5e94d4fe9c3aa50242c76", 0xc9}, {&(0x7f0000000380)="2eab94412e8a493abb584b9bb75181506bc491a7a0cdc116a5ecf0d291ce0edb05a81c83f900e98a3650a15752bf9215d95604d28f3a8ce2e3a2388a4c4dc2c7ea4199dadc6d16f583c77b575bd3c2ce735b93d7dd878c05b04b4b86f4750b75dbf5f0b5aa277a04919a23fe018ff950d1b8405906d7feeeb5c6e89f68467785577fe05cc374fe617b308c1f510c75c4b6759e9a9899d390565edc659544255e7f09d03c4933cced1f4e982c74202c940c9e88d69dae1a47bdf9fcd6139419b59ca660a77b73b306df078765867c662f86e3a85c6345003987a276fb7c3507ec27e9651ea639985c40f7be52d98144dff4b8390e9187c6e8defb22980be870a0fd8a9b6c8dd78aed10f7525ea150fe34a95a45683bf2d78fdf1a351267844b0687aabdcb6cd169a0e47a75316663bbbc78379894871c57000993f2b669545c650e9d9c0230c287631eba4e3d7f1d68ce1a1d6f3c967470bb5890cdab3578b01b9dd9707eb4174493b7b4bd420ec48a050acebcc341291c4d9c836d22771905f8ac3cd2c3e0744b72f17ddd9c658a1b3069464899f53a40e38e37479331c169903f799baab8a0a112f75517e3672edf5dbef527772de131cf80d12751f29ff8d3fe3462b76cd784d0a8d4480dc9509b10ba7dd3f58d0ae54868af5172d53269f9fe8f1c63349ea114906fa828160fe17ac7d02fec0c564ae9d89bc22656f10f50776b2d7e319913c3825ca5a5eb393638673b23ede2bacedec52021284d4894e7dbe1471eb07388aa25b48c86d3e7fbac8f524c35cc63a35f1cb2c5bb6a99e3fa2493df4fc7a3de2b4aa795c3b6fde76a3c0386e951198632b343e7c4333c40977aae5f9ec7e0af2c13a32c85fcb6c81cdf2f80114c752eea80a8874e101d9f90ae2651b5c32ab3539d3ddbc0e1092edf4fb10f61fd6c562f152a0829e928510571032125060b30c4ab0a8ea366f48fdcebd350793144a6525d43db0b5972a4bb52afaad19ea8e5c269a3d029e0ecefc98b3e8d698e6bc639979173b15441d5f2909bd997698b6c6079f5cea27f4af71f6f9d29b5fc082ff7726cd53e6d3c6e6083980c781fd844693770c8374682851bee0041cb2d4ce0d1bd7f32b93a05eed2dfc8e39e6195c1aee64d85a8a4b4781acb833eab63b0ad0f4d9caf08bbdbd32296f571f36e64bfe457da059e3cae78d7b25da170d68d8cbc266c40a0ab279ee4f4d77014c1dc07962906a289153271e9f1c0179a919e6f8f4749b6940948bd50c69dfaece2b5151264f5d9edb2ccd917c746bad9d21a2bbde690f444143e6e3c7decb3402485d075ea6367874752f66c23e140b79a77c6885579b5c41b170f2cb55c52059076d85d071b85e9cfe378ae890f73ebfbbaf58145d7c54742e6e49c065d016edddaddb7b7742dd93b6f713f39d934cfd2a96ffb98c1890063e8db37980b47e2559e1a274c8a4f3c6c4c9a2d55ab0f3a5950a8c43b5fc1bbd73e55845051b7aea2b11d89a5068cfc09d515a950b3bd71a946de295d37c05bda0dae76aae7e6724a04c43d7ff5c5c6189d559af3c5e17d4ab84d98801a005c8f4cfff043e0dcd309ea510e19cc112cdae15f062018c552ce8fbacdb64b2ef0d1a9194ccb38dec70e19499543d3cf897b05f54da213d2c64f861532c429b1438695c6feaba696827db14675647c53aa42fba8ab4003d50559aab783b8d1289bc487e9711b8280089849a4d92c81ffb27be433ef5c356d9f7abe6158058e6996066f7326d4dbc43616af0d93bf2197a75170c5344d16bfffdb340af3e1bf9d17018d74e3435afe3bda026d1b052764f0f5f2c4c70be9847927fbf0776a2895a8af1008eddcff7caee23f1312670c88a2a7c707e1c2ddba461968ebb41b18b7e03ddfc8a5442a4a26fc15a7571f2cda3fa5d22c1d13d39de37a79fc36a95434320386fdd933003d01568f228509485147df1567edf085ab0920eabb0f8d4c854b31c8b43fce04b626e88f3ea11a3cf3d3a449c4e4d009e44278bb299632f2dc8b644e278b421406402b0f6a6c0dcac8eef2ff6c795c4d166d10096e6ce1a51dfed1e0e09d83b01896e16140e1895a5b3ecd3570da31331d11a607d8eb23e21609fa3934f98d5722505590d0c54ede7b1c62e0873b6d8fb49651416cf423b365abe6bfad42200156e385aba9f4574946e569f8f998c5831298b2a08ac294bbeb8007051f7a235eee15f0ff59f792ef12658c28bf91fc4feb7868d8c159e92d53ca898c630e3fc44c9720f720a22948f2f250af1f017e78f91cd06c113f19a92d3e278009c5295bb6f28194a049c1f891a07f9db45384433a9752fe535ee4cb0328853499b73ea7334dbb3e7460151a488f21477204f28c75606dc7b99cd8da97cee152c06eccb77b2e473cf9a88cf7b9f428bae91b50249251f979a8ea860e26583af1efaf593920205761188739f3d1f7e031e601b54803e7269c2ef72cb84a2de8e7823b1310fa2c2bf09d1cbff26c910ef086d70c5f1e72d66ac295efff2202b128df32e10312324798b7d171765ea7a78e6bee46f607b08e3d2f62c680e40b6c536a151a458baae2567ab644936e67653af47cb091fd68d451575e86fc8518d5ff4e946dc1860127766b807a80d5a43b4ec0b124fec427cb2aea0162c760f47fc492625c7db4d31e3e8716677e992231ec4814aeadd5ddee710c0a7157a141b1878a905301f11dd66511bb6a6d6dabef8d155c95f8ed4cb6a7f38f79ccfb866fe9ecb62e3cb27275141fd9c8b3193da00e70d442699af6a74373a3fdc02abc7b25941d1b8e26e8e01cfeb133d855066da1dfe0340443410b1270a6d3be3f02c09471b4056c6eec77653d48341f8cef77accc5345f75272e85486cf0f9b7dd1e0367bc8ec13a0498141d7cf60b7ed14021ea13b80f870223cb50498768e752f88882cee9f5f8de811cf1eb9bd21beb241dc2e9b48385732b2bb429d995a9c69a09a3481d3d2e252f9a517a53d0218e7f95c3abb242257d843946b8e33e02cbb64e891e1b37ae24ad3751f424ba9accaed795d57e56f156674a8011cd253fea02750666c729cc2c5dc48699efa83bc2d69701986e03e7a59f597bffae9be37f637539b5420e1900e44d64a1cd86cbe4b358eeb6b2f285983de86543882f5f141beaad3992ff85c1b8b478d349b8e61aa592f791960562578e7347ae37c3701da3a07591d886852fe7f807386c11c4e6049329963407bccdcb331011623ccee6d42371a980ac12599afe1fd13c7c890a58bca51cced7e649ac2292c5ddd870f2706f1cefb74a119c784553d3d8c478655616e8ae236a246b4853fc64a72084fa699c31842ab4364822250d7018f05ecab59267241e1f144b9bcbc3a06a55f04ca10d88f1cbe36549f70fa66dc059287d44ad0d6d8d7ba2a708702d7e6c22fb4181e578f789d7119f8bdee5f45b040ba64db1bcd16fe7005961734a6f09b7f9c922db70587476740a1d06018397bbe637245f705bf53e5095c392ed8ace339613e10c8f047e8e3fb77c1669dbbb61c18222d06bf824605d54b8d9752ff8b3dd01232e4c0cc1a5173fcdef8efe450eae2f1685063ee1676b509a67210ec52bca2bd4a36e9c8a0f3ed42f0d30acac93d098f7cb20b5c02a4b7cddd2284fad4f1840bcb20e86d5b136744b6c1db5f36328d7cc9e5d103ffb7e224daf5fb10fccc4a46ead2238f4ea58fbd19c388fb6afef7c65365175d39feb64cd7a91fe69d0dd6cde1d5ef5e54813bc6fa948c9bbd927406e9b2140f152f5990557593dd6b7ac10f5c77be753764a33b3fa6bb940881e2f5f54cf3d7b0f4a3ccb3008bf8a04da95afe109da0e9e0c2ff3c2edae4f2b46796ef687329a99f3f83363cef4c19a77ac75bd7d9b83a352fdcd15871235690034eb76d20d6b6fe4a7020c283700eb5bd3f739472321e09cab293f7364c83486a39834c6ba00b94ab69949df3d9a288e1194503a583d0a784f9dff08fe9591108d84b35a218f0fa76ccc9450b8dc0bb7fc8394f4b3b555fc042146b572088359cde3a443948c3818c4e7830a55797380dc8842203596b52b661a54e7bbc2c4a2c94798336640b1b8143ee1bdaabc7596c39fd6dfe211e5f98662ed4bde7af2db3629732a1ddddb81bfdf026f26922cdba7af8b7ad89b02ef7dde593b31f24f2d0237ee659f5187d18297a06f12e9d57277bb90e8e9f1b1576c61c8b011bfe8df8028171517e922d997fbb77357f43f67e776e7e85325ffd3fb07d9c19f5dea17cc59731afb07364a6b6dfa93f33530aa921a646e5bd47d0f6085e800833b0c919995b40aa70a224a0e2e73ae7d1cb20db98f188d3b3084b367cc9add76e9805fb26114ac3f969da03be28b79d7222ba4f19a13c7d8bfcec7138336701c2a9d8deaccef8d192402baa4dda676ae35d5848cec2fb11549a377d6a476814f54279297519e71119cf205c5cd4b53acd79cf0777cb624bd758f85e7216f9e5a3e9d1e8e9ec09ca00c6d62d7588b2ce91d933387e837f9ffcf044fdd1bfcb86289caf4a835fcabaad409352d2d2e1a3afec6f39baf5a176a89aa73b32ec02015c2d941d7be1d06bc89dd1624e6f3c729e29d55ad9d771d0a500cdf393134712f312b8fd6729828e9a61b98e952611798570a0b1d83c56a7e61516a0e65d9b3e47b535009e6e991e96b1eb9da908ea79a980592318a9f9e193516524dc11c21ed98533b6ca0064b27c5248cf6cb8b9f9f11612cd56feea02fd2f98b6d51699dbf40326080786c1123489475c92fab6d70f7767185140412bf09c0bde3e4510b3ee2bc892cc1a2d9b1ce945a012083a41b77e23936e79bf6be1c1541a3b4d639f93df82a753ac6d7b3cd1cec527b72286a55f6899223838451f60861841e1e0d357c6751173c3bcc8637d7d93760264231d60aa78cea6622426fff7f5f8204e9ed0fa1804b23e2c0681c31ceb294dc6aec9b599ce1be8dff28928353790222c2421ccdc37f20b794ead5e1ccbe4ba05b134c0cd32f61fd60b3fc859967428d9319e7740c32fbf954bc0642d401aec4ec9db9eddb1baacfd393aab28b1ba350a067736785ca58afa7873c1eae4df53464162d004ab24498697127a92f84c09d2afd79292d76588ad9b7662d64f957f56cd2efeac48af4e6c7f5a057f4fbb1203e988d991007492ebb2cd153deec5792ce27f0e06618354ede0a4671fc16abfe0a8d9bd794aa5b83cb8d4bbc51242f3ebd6c14e2e9b498f2af878284307f88fb8e4307e3d14681b0acb864a0bd4f2a94cc331b00e43d46ed410629bfbe8dadf165a65978a1f91b5b77cf4475b54c9ad5b1c179f0290cf1589035e7a218f0123336a979a9e82ba24b3e0b86055abc043f1bdfd55055aba71ab763ff25ced8aaf402e4ee40b5092c0d9834cd31b2b6855cc891d0eb0fbb9d1363ee6679f602c1deeaaf670bb58928a18c5d60b0d7721f7a7a92f4c905134175aa07840b57ef827663a541ace6cd5a7d820f8cb08281e5e83571f78436b14bb3094b08d02bcac31bd9d8263ff4ab6496c023146a22958a68bac6ae2fdaaaa6d737f0333391aff87970667b2c4d062e8076a33ec368c7a24b8d1bfec8ad04890bb3ae86d729a29dbcedfd9e85636210ba25e82bf85d501af66c85c97968f55aa46fb6791284919035c3aeff942db5e010af0f9a83b0df11420ced8882bf8985020993e486197a22d4ceffb9a47553c3d90c5d52d40494623a9d8ca0034c0bbf369d3403e78978ca11649847266781e773a0ff4bd85d3f0eed35e8ef85cd9f7f5e40083", 0x1000}, {&(0x7f0000001380)="4bb6f39c8336126339e5d7b8010252c9adf3cc", 0x13}], 0x3, &(0x7f0000001400)}, 0x40000) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000001400)='/dev/btrfs-control\x00', 0x2, 0x0) getsockopt$inet_dccp_int(r2, 0x21, 0x6, &(0x7f0000001480), &(0x7f00000014c0)=0x4) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 707.945195] binder: 30928:30941 unknown command 98395947 [ 707.970984] binder: BINDER_SET_CONTEXT_MGR already set 16:06:27 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:27 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x6000000000000000}, 0x0) [ 708.031731] binder: undelivered TRANSACTION_ERROR: 29201 [ 708.039602] binder: 30928:30931 ioctl 40046207 0 returned -16 [ 708.069801] binder: 30928:30941 ioctl c0306201 200000c0 returned -22 16:06:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440d8d675770c8f7212a6aa7fc0948aca7d32104e3c0b00ec1a"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 708.144840] binder: 30955:30956 ioctl 4b47 20000180 returned -22 16:06:27 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = socket$inet(0x10, 0x3, 0x0) pipe2(&(0x7f0000000100), 0x80800) syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x7, 0x240041) sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2f0000001800030007fffd946fa283bc8020000000340005031d85680800a3a2d188737e0b000f0002000000598e2c", 0x2f}], 0x1}, 0x0) 16:06:27 executing program 4: r0 = syz_open_dev$swradio(&(0x7f0000000140)='/dev/swradio#\x00', 0x0, 0x2) accept4$rose(r0, &(0x7f00000001c0), &(0x7f0000000400)=0x1c, 0x80000) r1 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) eventfd2(0x1, 0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000002c0)={0x0, 0x3}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000380)={0x4, 0x200, 0x20000, 0xfffffffffffffad5, r4}, &(0x7f00000003c0)=0xffffffd7) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={r5, @in6={{0xa, 0x4e23, 0x80, @ipv4={[], [], @empty}, 0x40}}, 0x1, 0x2, 0x4, 0x7f, 0x40}, 0x98) clone(0x4000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x2, 0x400) ioctl$KVM_GET_DEBUGREGS(r6, 0x8080aea1, &(0x7f00000000c0)) ioctl$KDSIGACCEPT(r6, 0x4b4e, 0x3a) [ 708.211644] binder: 30962:30966 ioctl 4b47 20000180 returned -22 16:06:27 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:27 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0xc5469c2b4d1de608, 0x0) 16:06:27 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x6558000000000000}, 0x0) [ 708.298546] binder: 30969:30975 Acquire 1 refcount change on invalid ref 2004211416 ret -22 [ 708.326576] netlink: 'syz-executor5': attribute type 15 has an invalid length. [ 708.337048] binder: 30969:30975 got transaction with invalid handle, 0 [ 708.417959] binder: 30969:30975 transaction failed 29201/-22, size 24-8 line 3126 [ 708.460886] binder_alloc: binder_alloc_mmap_handler: 30969 20001000-20004000 already mapped failed -16 16:06:27 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x8100000000000000}, 0x0) 16:06:27 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 708.502277] binder: BINDER_SET_CONTEXT_MGR already set [ 708.517080] binder: 30981:30983 ioctl 4b47 20000180 returned -22 [ 708.526937] binder: 30969:30975 ioctl 40046207 0 returned -16 [ 708.527516] binder: 30969:30987 Acquire 1 refcount change on invalid ref 2004211416 ret -22 16:06:27 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x40002, 0x0) r1 = socket$inet6(0xa, 0x1000000000005, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x3, 0x70, 0x80, 0xbf4, 0x80000000, 0x7, 0x0, 0x2, 0x410, 0xca904d1404e0e583, 0x9, 0x1, 0x8, 0x4, 0xffffffffffffa78a, 0x0, 0x101, 0x1, 0x1, 0x7, 0x30000000000, 0x3ff, 0x0, 0x1, 0x10001, 0x4, 0x2, 0x4, 0x5, 0x73, 0x6, 0x40, 0x400, 0x7fff, 0x6, 0x2, 0x8f, 0x7, 0x0, 0xfff, 0x4, @perf_bp={&(0x7f0000000140), 0x9}, 0x10000, 0x1, 0xfffffffffffffffd, 0xf, 0x8, 0x1ff, 0x1}, 0xffffffffffffffff, 0xd, r0, 0x2) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f00000000c0)=0x6) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000200)=0x7, 0x4) socket$inet_sctp(0x2, 0x5, 0x84) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") getsockopt$inet_buf(r1, 0x84, 0x20, &(0x7f0000dcffe8)=""/24, &(0x7f0000000080)=0x18) [ 708.553773] binder: undelivered TRANSACTION_ERROR: 29201 16:06:27 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@dev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6}}, &(0x7f0000000080)=0xe8) r2 = getuid() fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0}, &(0x7f0000000300)=0xc) r6 = geteuid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000003c0)={{}, {0x1, 0x1}, [{0x2, 0x7, r1}, {0x2, 0x4, r2}, {0x2, 0x4, r3}, {0x2, 0x6, r4}, {0x2, 0x4, r5}, {0x2, 0x3, r6}], {0x4, 0x2}, [{0x8, 0x7, r7}], {0x10, 0x2}, {0x20, 0x1}}, 0x5c, 0x3) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2000000000, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x3ff, 0x3, 0xffff, 0x0, 0xe1e}) r2 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x2, 0x113800) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={0x0, 0x52}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000002c0)={0x0, 0xac, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0xa5e5, @loopback, 0x5}, @in6={0xa, 0x4e24, 0x4, @empty, 0x2a78}, @in6={0xa, 0x4e20, 0x10001, @empty, 0x101}, @in={0x2, 0x4e23, @rand_addr=0x300000000000}, @in6={0xa, 0x4e24, 0x1, @local}, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e24, 0x0, @mcast1, 0x9}]}, &(0x7f0000000340)=0x10) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000380)={r3, 0x8, 0x8000, 0x0, 0x2, 0xafee, 0xfffffffffffffffb, 0xf0ae, {r4, @in={{0x2, 0x4e24, @local}}, 0x2, 0xfca9, 0x6, 0x9}}, &(0x7f0000000440)=0xb0) socketpair(0x13, 0x3, 0x4, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000480)) 16:06:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000440)={0x9, {{0x2, 0x4e22, @local}}, 0x1, 0x3, [{{0x2, 0x4e21, @rand_addr=0x7}}, {{0x2, 0x4e23, @multicast1}}, {{0x2, 0x4e24, @local}}]}, 0x210) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {{0x3, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140)=[0x0, 0x0, 0x38, 0x78, 0x0]}, 0xfff}}], 0x0, 0x0, 0x0}) 16:06:28 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x88a8ffff00000000}, 0x0) 16:06:28 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:28 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x200581, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) write$vnet(r1, &(0x7f00000003c0)={0x1, {&(0x7f0000000300)=""/155, 0x9b, &(0x7f0000000200), 0x3, 0x2}}, 0x68) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f00000001c0)=0x200, 0x4) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000100)={0xf, 0x8, 0xfa00, {r2}}, 0x10) 16:06:28 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x200, 0x0) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f00000001c0)=""/239) 16:06:28 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 708.939418] binder: 31014:31019 got transaction to invalid handle [ 708.961588] binder: 31014:31019 transaction failed 29201/-22, size 0-0 line 2896 [ 708.973313] binder: 31018:31021 ioctl 80087601 200000c0 returned -22 [ 709.009421] binder_alloc: binder_alloc_mmap_handler: 31014 20001000-20004000 already mapped failed -16 16:06:28 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x9904000000000000}, 0x0) 16:06:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000100)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0xfffffffffffffffa, @ipv4={[], [], @remote}, 0x4}, r4}}, 0x30) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$getownex(r1, 0x10, &(0x7f0000000140)={0x0, 0x0}) ptrace$cont(0x20, r5, 0x9, 0xa9) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 709.055640] binder: 31018:31021 ioctl 801c581f 20000040 returned -22 [ 709.073002] binder: BINDER_SET_CONTEXT_MGR already set [ 709.090199] binder: 31014:31019 ioctl 40046207 0 returned -16 16:06:28 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 709.130060] binder: undelivered TRANSACTION_ERROR: 29201 16:06:28 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x9effffff00000000}, 0x0) 16:06:28 executing program 5: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000440)='./file0\x00', 0x0) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/vga_arbiter\x00', 0x101000, 0x0) getpeername$packet(r0, &(0x7f0000000080), &(0x7f00000001c0)=0xfc77) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000ac0)={0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffff7, 0x80, {0x0, @in6={{0xa, 0x4e20, 0xfffffffffffffffd, @loopback}}, 0x9, 0x4, 0x0, 0x7}}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x0, 0x14, &(0x7f00000003c0)=[@flags={0x3, 0x1110}], 0x1) openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x600000, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000000)) ioctl$KVM_RUN(r0, 0xae80, 0x0) 16:06:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x200, 0x0) getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f0000000140)=""/232, &(0x7f0000000240)=0xe8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket(0x17, 0xa, 0x4) ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:28 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x840, 0x0) read$eventfd(r0, &(0x7f0000000080), 0x8) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000000)=0x401, &(0x7f00000000c0)) [ 709.355832] binder: 31042:31054 ioctl 4b47 20000180 returned -22 16:06:28 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 709.416148] binder_alloc: binder_alloc_mmap_handler: 31052 20001000-20004000 already mapped failed -16 16:06:28 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xc00e000000000000}, 0x0) 16:06:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x10000800, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000000)={0x133, 0x0, 0x0, 0x494, 0x0, 0x0}) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x0, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) getsockname$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000040)=0x6e) ioctl$CAPI_GET_ERRCODE(r2, 0x80024321, &(0x7f00000000c0)) [ 709.519736] binder: BINDER_SET_CONTEXT_MGR already set 16:06:28 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x40, 0x0) openat$cgroup_ro(r0, &(0x7f0000000200)='rdma.current\x00', 0x0, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, r1) 16:06:28 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 709.553612] binder: 31052:31053 ioctl 40046207 0 returned -16 [ 709.589490] binder: release 31052:31058 transaction 1714 out, still active [ 709.596625] binder: undelivered TRANSACTION_COMPLETE [ 709.651054] binder: send failed reply for transaction 1714, target dead [ 709.668961] binder: 31074:31077 ioctl 8912 400200 returned -22 [ 709.704304] binder: 31074:31077 ioctl 4b47 20000000 returned -22 16:06:29 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0) 16:06:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x800, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') sendmsg$FOU_CMD_GET(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r3, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x40800}, 0x20000000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 709.756645] binder: 31074:31082 ioctl 8912 400200 returned -22 [ 709.774229] binder: 31074:31082 ioctl 4b47 20000000 returned -22 16:06:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x200, 0x0) getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f0000000140)=""/232, &(0x7f0000000240)=0xe8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = socket(0x17, 0xa, 0x4) ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:29 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:06:29 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x101, 0x0) poll(&(0x7f0000000400)=[{r2}, {r2}, {r0, 0x8000}, {r1, 0x20}, {r1, 0x441}], 0x5, 0x8) ioctl$VHOST_SET_LOG_BASE(r3, 0x4008af04, &(0x7f0000000100)=&(0x7f00000000c0)) r4 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x0, 0x2000) getsockopt$EBT_SO_GET_INIT_ENTRIES(r4, 0x0, 0x83, &(0x7f0000000340)={'broute\x00', 0x0, 0x4, 0x9a, [], 0x7, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000240)=""/154}, &(0x7f00000003c0)=0x78) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getpgid(0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000000)=r5) 16:06:29 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0) [ 709.989379] binder: BINDER_SET_CONTEXT_MGR already set [ 710.037377] binder: 31088:31101 ioctl 40046207 0 returned -16 [ 710.049096] binder: BINDER_SET_CONTEXT_MGR already set [ 710.076903] binder: 31095:31096 ioctl 40046207 0 returned -16 16:06:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x1c5) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r2, 0xc0305615, &(0x7f00000000c0)={0x0, {0x564c, 0x400}}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 710.097034] binder: send failed reply for transaction 1718 to 31088:31089 [ 710.136074] binder: 31095:31102 transaction failed 29189/-22, size 24-8 line 2896 16:06:29 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000080)=0x9, 0xfffffffffffffd6e) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x26004, 0xffffffffffffffff) ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000200)) set_robust_list(&(0x7f00000001c0)={&(0x7f0000000100)={&(0x7f00000000c0)}, 0x8}, 0x18) 16:06:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000000100)={0x1, 0x20, 0x5, 'queue0\x00', 0x6}) 16:06:29 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 710.167060] binder: undelivered TRANSACTION_COMPLETE [ 710.184779] binder: undelivered TRANSACTION_ERROR: 29189 16:06:29 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xffffffffa0010000}, 0x0) 16:06:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x200000, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f0000000100)={{0xa, 0x4e24, 0x2, @local, 0x9}, {0xa, 0x4e20, 0x93, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}, 0x81, [0xbc6, 0xf9d5, 0x59, 0x50, 0x3, 0x80000001, 0x3, 0x5]}, 0x5c) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f00000000c0)={0x81, 0xfffffffffffffffc}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 710.263281] binder: 31111:31113 ioctl 4b47 20000180 returned -22 [ 710.288686] binder: 31116:31120 ioctl c08c5334 20000100 returned -22 [ 710.307278] binder: undelivered TRANSACTION_ERROR: 29189 16:06:29 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 710.319617] binder_alloc: binder_alloc_mmap_handler: 31116 20001000-20004000 already mapped failed -16 16:06:29 executing program 5: r0 = creat(0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, 0x0, &(0x7f0000000400)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='mime_typenodevprocwlan1.proc%vmnet1ppp0\xe6\x00', r0}, 0x10) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000340)={&(0x7f0000000200)='./file0\x00', r1}, 0x10) set_robust_list(&(0x7f0000000300)={0x0, 0xffffffffffffff80}, 0x18) r2 = socket$inet(0x10, 0x0, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000380)={'lo\x00', 0xa00}) sendmsg(r2, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000000000000000000000", 0x4c}], 0x1}, 0x0) sendmsg$nl_netfilter(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000001080)=ANY=[@ANYBLOB="140c00000207000025bd7000fedbdf250100000907ddb3028f6faa58f53a5be5341ec65aef6156b225d00e9587af65cf29078b9828c0e262dca25e674fb127e10afb9d37cd732b9b834f32f643781f3a256a691a17c81a64b7f8cc53212160ea0e31a02ecc72965e6b78cc7e4f3931deefa01decc62889348f7ca549eabdcc68b15a741bcb2b09512d1a453543cc9764159249a80a6b3281ca8ecf675e48dc02dd35436858a0d825848c24441502a9174f129e00debbba5d8b11d9ee9099ca982183898b1f2e407027325f3c4d04a57bdb800fa6ff6fd8b7beba38a6ee3a37fb83e6d62b113d46a250835c3fef9f81e70f49cfeccd37bede4f7bc2bd4a17306e085854444d52308bddb74dcbb8c928597005c441964db79fd4fd2fbdd49597c5fa87c3ce2427605d3abe979315d42dd8f51adc6381fd8ee67c4211a368f294b4d43699d05e76747a10451d31e45a0f245712a33f09e613ac94f015db9e498c675558c12b830cbda1fdfd710d59e4ca3e40558fabfd2e61ef15436f05b84a0394f7f055d1819ec3a1280d635b6d8b6990f6313a0ab42f2e6638d9ea77aade5bdae5931e6fc55caa72a9e57216e1e8ea85c56cf22c1e6968d91b55ad3a949c5a546fc6ec764bde099df7a7b1bb5173d883d4bb134f6adff8710d4bc1ecaa77517ecd7ca1e05a90fc8a472bafbaeb7d51236acf456f79f052226dde5bcb9bc64bc5872d355cd37d2e16d7c60ead1822bddafbc495e85a0c3b3733889f362b0009eca91b978e5326be40111643160355e49f7996cfa64be79ded722815fb0e3301e72a8cac506b8fb855e51dfd5f917557b2c83ee4e57eb8d4e90512b3bc097507988e227219b84d465ce547a6feb82124646b91bfc809370f4c10a7566647b5caff5c07af7f0c54e187bf23d8f6b51d1a2c9b82887d9164019f448674b30c956c748c9369087edfcab2b56acf2ef0c91881454fad3638dfc0616a7538933741d3f9b6659abf9eb4c7d451e7d3fd74c67b4af58cb2b29fd51399199cf19c781edb8add49d7de7a7330258b538004b941db66111724ab4b8d11c61816920e02c77f2f59ad389e0f5216d6ae922271cd44dd9ad7252d13178ddab928b1b59f46e3bbde5e854fb5169a7c636992c5ed3ad17be46db8c297fe2bde7dfb4abc32513b5168864fc1e0e49289ed71ce67059b901b1130f97879872a6d08d1a8db4876c2e4600a1c833238ae44b1a152dd6b8532cf779d526308666fed1b5a14057a944fe61fec2f60e3ef6995490ba83b6b3a758dbf19386a317d9b3a5dc9d0c641e949d2ee633553e7f405de12e562b8590d1cb9c3862fd373ee918c5ea2ca466e787d316ed9067b3142f581be5fdc8292770280134e461098ed00a4dc17c0ed8c47775a723a4a5e335162763ca77df85f27e2aed1bb17548b0ea8d969fe76cb2ae2141bc1fa3087e907f5ffbbac8b2d74f6ed4c449c4cda5607782c322b5cccb70d28994c61c39c79f1212bd261da6c07121f66909a71d4b9940f0b8aae2b7f6f658c4f49610e981c27fab626a8aa04a8afa35fbc38ccbe3bd136b4f7cbcc9a02cce655a23e65564bf7b54045cfdf55f36b339cdf24a005dd3e73e578394088096c8e1e789235e1b62f25b0ff319d2b08d079ef5fb6bbd6acca8c57077220a34a9f3c5cb84bc588d6c035f1207bc63058b741fb9a2d481bd1a0c8efe324981ec2ce14b447e6f8488cc035ee71a648c9fe8f9de29d0098cf846852429166b642ca484101dc1bfec51dedcf876300efb7a2aa62a4f6f5c3c8ef975201bbc31c3105f493563a652420d26ad85a8fd4cea5bbf4fb956111a766bfc9c8576a31e51e65b6cae603aa360b790bcf4c7e1aff59407d88728fd914763b4e05ba446e5276e425edaa43d971504f2dc53497dd2e2f38b141f2606185b9e4aa39c1cf3d3bb9076f2ed2b869706ace8ee70c6389ed3d6847aa812cc76b796dd9d16f69f7847f9cd72712fa6474551b78bbd64f0bff2dc3dae8738b3154cddfe20ea2ab49eed07c4322e175af779cba3e547ac8d6da253fdaba4d8cb1c43f0f002e3ec2c9570fa71a9ba105b6b07a537fe47990350204a4f59e8c529a4901affcad504885abc35e4e75bdcecd617bbfeefd9c4d39a1217d3fd5011b14852f42b9272c5034c731a1eb7c51082b48abbcf57664e71d7b753e21ae57dc6a38970f63f61e3926696f678dd9a9b44a87b646b478966836de3449bbcff979afac633e078ca1b8d8fbadd93748c79dc54161c267b19dc6d4bf655b2dfc5ef7072f330ea859124dcd03ed90e86fc1daa9f46d5a6ab0aff5bc736e0444c77247ba1a38bf56a54b90e1f7e3f063e46a8e04a3d043638c91bb3db7ac6c392eea2b8445847a8a6e93502931d49ac971f4da98344b564e967f1fa2de1a416eb36ef0f34b459470dcf2262f5d8bf2080f36c541730da21e4b7adab67bc6a5bb8db8c6655cb3d1be0b713313171f877b0031d5acad82e6b1b393d73dd4738aa30d454b45050f6eddebc1b99b8d4de19c5cef78aa48a817641fe8e2e6167e5046194b84e45988803c3e4453d5f53dd5b3c558445268dd452319cbbb1bc36a07371242fbf7dced6c897ec0d76912f9330fd8bcc80013ac53f6a936035ccef071a127e01a9f80047df36ca6311d0f258a7c00673752970302b3644d0de32e1594f6a7398a3114265278d0667adbbf1ea50fbdd34293383438199622d30370d0f7679e337049491223ba48b17f65819135bc885cb05f1b23b3aac320d4438a935a53ad1b2d9b6772870f5605aef25b488aac3c4156fd57d533d2d8249ca75c24f76b76e90834ab6a9221bb22a1edb0e03bfbd706749db468b3ff82e559a79f4873545be23f7758f670b62ef7b6b9b383eb265d4c99c60ddbe9941dc67c07283f1121ac5c1eb66d1100260b398384eccd2fca99992ffe758f8b85e033e2df278f86d763c106949bee880881674178ea90cb82f601409845168e8e06bd96d984277e625291e4f5514774849794b35464f9381c5e1c567e879e80f2328e5488fa795e228b645e6e4ff11d3ed19d73775296a26e9f5c8411e85adaca0e389d581009d974093683eef7773bc4ba4efbcfb14908402e3cf8b1aa0b7ad5580f853fcbddbf191b8064df932acc0cbc10edd7301b7bca1587c52208c1dd37bf4bc222605f8c521f84fb7035162cd91d6905938b4d88dcd604eeac05efce1eb3776059991d196ae5038aba222ff22292d20f8b7b3911e549357b74c2af4506364e9a94d3f5f29e954e40e50ba24cc68643f6d9931b482158719e92c30f304ca1e6f0ff4b9289bc8360fe8cb2464d96f61347fafeaf0b8708386eb316819f3c9c59a415eb7434d9c8424645a7b3f47a50c059242666c4db52ca3c2d9e68ac936c7a7bc9d3b5405267e301af0707dabf3686634ac6cf2c237bcfb6c64c9514360a8db937e159cdb5b09b5460fe55e3598ae6a2b0514318b130d137969b4b6de4fbbeabc9bf22eb2f2048db79b627ffe67b892c95645659bf8052d3fbe295de3059caf41becc51223039fb9d9485b3aad9e39268140056f4a25611734a46e2fc2fcf16d756482b4270f464e37bf28a916cf33dde1eab7d9a1c69562a6ddd5d9b64266159a1ed68dbf0177d1e2e74abe9b0ce440f5dc5ea12fdfeb4b97bb3f7525ea22eb52fe8a86be0b60a649fc5531ec6e42d3a1df868d61c3f8feb3f46645d07c4fbae6427204666948b0c6aa8738cd3452125899d79b92256208542191471141cdc78164388770377080a93f9e8fb8cdf0ff68970280daec97e1763e928cbaf319668bda4da790e4816451b5d59e969e4b06a3c7acdcc4b6f03499778de4ea1721bf27d7d0a66a4315c689de0fd00579ae1310c3f83e494c76c76218371a3174cf12260ec278e423dfc123ec00d4afcecd4246b28f33b28087b0a134232548e63b92378a197a7880a84f0fabdf32ea11f7c01ebf6cc2e26308f8f84339fd01265573a8bfaad1f5222b75f6d0a9e196c72f3d45b599a0a246c799d9a4c4817ee7ce06a05569b0c0b3db5b81ae35ac48895cea2be718938ef0b576a086675dc3f90dac38cb73e463cf9b6dbef9f172644db220e2e788d7a38cdb362054584d9ce4bd7375ef8e6e1ccfe70000000030e0664814f76d57cd5537a65a9cac5adfe2d50244b96fea309fbeef4afa20bf033bea2394bd8c2983ce3a13653be5d4afc852357bd354113bef4361f217fc85a506fd36db4c6b0834aa7045e68d9cabf835804265f18aa23c80f578e6c5044ba62c4d25cf6af2f650b7d81ad8f63be6f3b3daa50db80137de3d880423a08044e34dd4e8aff7187cb02f89ece47aa3cbaa49b83eea5b19c42da8bdc08040aa9ce32b3e"], 0xc14}}, 0x4000080) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1c) [ 710.389317] binder: BINDER_SET_CONTEXT_MGR already set [ 710.412887] binder: 31116:31120 ioctl 40046207 0 returned -16 [ 710.429035] binder_alloc: 31116: binder_alloc_buf, no vma [ 710.446147] binder: release 31116:31120 transaction 1724 out, still active [ 710.453991] binder: 31116:31123 transaction failed 29189/-3, size 24-8 line 3035 [ 710.465214] binder: undelivered TRANSACTION_COMPLETE 16:06:29 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0xfffffffffffff000}, 0x0) 16:06:29 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x122) removexattr(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="6f73322e5d70726f7896b9286387beceec65c793797b6376626f786e6574312b76626f786e6574908b"]) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000080)) getresuid(&(0x7f0000000640)=0x0, &(0x7f0000000680), &(0x7f00000006c0)) lstat(&(0x7f0000000700)='./file1\x00', &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@mcast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast2}}, &(0x7f00000008c0)=0xe8) syz_mount_image$ntfs(&(0x7f00000001c0)='ntfs\x00', &(0x7f0000000200)='./file1\x00', 0x8, 0x4, &(0x7f00000005c0)=[{&(0x7f0000000240)="f81ac1b26764f6596b6770cf81e8d4f592211f9745f23390a50f196e7a3f636864de440af1c9466a3ffc713b7252441ae882b37983bb8cbc24643471588a7697c89ad1973e163b648bca937694e71041cce75e7c014e5f642dc53f5522b9ecf6e1a52d509adb80133c319e1706ceab067c118e9fabb01fd0b80428564c64269ae4e5268629bbd7b4d43b812f6a510af9b9aba336d3cb0135587253795c4a9c019e601ea13b9baf8ccb6732cd607494f1c38648a59eb37c4d02c8c41dd2f8db13c16a561177d698ac46d880711130", 0xce, 0x2}, {&(0x7f0000000340)="df88e61c1c0a3ece2442c0db773fccc30807e0e179cd55cdd537ca6f184841ad93dd45d86f54d2f58ca9245a56c3524d0d82ff4fcd4b6aa3029442c9ec6df7b4ab1bfb3af77388edfc4f14ea9c46c592a175c9d91f3c3fee80b243edc90e45f5f546103d5c7e1d6cf1ad395f4a6aa1d21cfa86f7bc09257a4f411edbd8132a4afae754b991d770c6071c83fb5c2dbca4f8bb70a401455e6bc7921f87d3aea53587ca85f556d49120ad8c83b2059c6b5e4a2b880a902154b72b350de9d575e2ca30e73f9b47ed850008ea4d724e6b047e1e8a80abb3bea007691159b0d516343cca41935751", 0xe5, 0x8}, {&(0x7f0000000440)="30953a08665201cd5c36a213665832af4a2f0fd9ebc3ce9486a0e4e3ffc7e36cbc57d1d62c75b455b9305f7f0a9257fccd5ac011a9069e55b44fef16eee6e8091f61f863560a1806e70422787868ac4463df82", 0x53, 0x200}, {&(0x7f00000004c0)="2bc0632f2fb3016c2f865fa131cc031473efd5cb19b55e2712d0e84ef6f7f85fca601c19562fc28aa80c0f9204158400aed341147b6554917d7fe774fe0c0ea6c31e39399d8a7b8e415353bb296158589bfdafa51af372afd788607fbe70c09dce30f6fdccdd9f6f7bf20981669147e465c77506657f2026eb074fec3e0179de2ec2fea7bb6db4f80594720a2ebe826c104ab734d0cb6d52dd82b745eb09e15af45ff2ffdd26b110bddd7dc5f568107d607d13c1e1d041eb27370a05f6b383063a003d17d5d059cab09f980a15b6", 0xce, 0x9}], 0x8000, &(0x7f0000000900)={[{@errors_remount='errors=remount-ro'}], [{@fowner_lt={'fowner<', r1}}, {@euid_eq={'euid', 0x3d, r2}}, {@measure='measure'}, {@fowner_gt={'fowner>', r3}}]}) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0x0) [ 710.487590] binder: send failed reply for transaction 1724, target dead [ 710.521308] binder: undelivered TRANSACTION_ERROR: 29189 16:06:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000100)=0xc) get_robust_list(r2, &(0x7f0000000200)=&(0x7f00000001c0)={&(0x7f0000000180)={&(0x7f0000000140)}}, &(0x7f0000000240)=0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:30 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 710.651693] binder: 31137:31142 ioctl 4b47 20000180 returned -22 16:06:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x8000, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000040)=0x6) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 710.722112] binder: 31147:31149 Acquire 1 refcount change on invalid ref 0 ret -22 16:06:30 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 710.801877] ntfs: (device loop1): parse_options(): Unrecognized mount option fowner<00000000000000000000. [ 710.828479] binder: 31147:31153 transaction failed 29189/-22, size 24-8 line 2896 [ 710.919554] binder: undelivered TRANSACTION_ERROR: 29189 [ 710.939351] ntfs: (device loop1): parse_options(): Unrecognized mount option euid. 16:06:30 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 711.004486] ntfs: (device loop1): parse_options(): Unrecognized mount option measure. [ 711.037202] binder: 31160:31162 ioctl 4b47 20000180 returned -22 16:06:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup(r0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f0000000100)={0x1, 0x4, 0xfff, 0x744}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056705c0a60440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:30 executing program 5: r0 = creat(0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, 0x0, &(0x7f0000000400)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='mime_typenodevprocwlan1.proc%vmnet1ppp0\xe6\x00', r0}, 0x10) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000340)={&(0x7f0000000200)='./file0\x00', r1}, 0x10) set_robust_list(&(0x7f0000000300)={0x0, 0xffffffffffffff80}, 0x18) r2 = socket$inet(0x10, 0x0, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000380)={'lo\x00', 0xa00}) sendmsg(r2, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000000000000000000000", 0x4c}], 0x1}, 0x0) sendmsg$nl_netfilter(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000001080)=ANY=[@ANYBLOB="140c00000207000025bd7000fedbdf250100000907ddb3028f6faa58f53a5be5341ec65aef6156b225d00e9587af65cf29078b9828c0e262dca25e674fb127e10afb9d37cd732b9b834f32f643781f3a256a691a17c81a64b7f8cc53212160ea0e31a02ecc72965e6b78cc7e4f3931deefa01decc62889348f7ca549eabdcc68b15a741bcb2b09512d1a453543cc9764159249a80a6b3281ca8ecf675e48dc02dd35436858a0d825848c24441502a9174f129e00debbba5d8b11d9ee9099ca982183898b1f2e407027325f3c4d04a57bdb800fa6ff6fd8b7beba38a6ee3a37fb83e6d62b113d46a250835c3fef9f81e70f49cfeccd37bede4f7bc2bd4a17306e085854444d52308bddb74dcbb8c928597005c441964db79fd4fd2fbdd49597c5fa87c3ce2427605d3abe979315d42dd8f51adc6381fd8ee67c4211a368f294b4d43699d05e76747a10451d31e45a0f245712a33f09e613ac94f015db9e498c675558c12b830cbda1fdfd710d59e4ca3e40558fabfd2e61ef15436f05b84a0394f7f055d1819ec3a1280d635b6d8b6990f6313a0ab42f2e6638d9ea77aade5bdae5931e6fc55caa72a9e57216e1e8ea85c56cf22c1e6968d91b55ad3a949c5a546fc6ec764bde099df7a7b1bb5173d883d4bb134f6adff8710d4bc1ecaa77517ecd7ca1e05a90fc8a472bafbaeb7d51236acf456f79f052226dde5bcb9bc64bc5872d355cd37d2e16d7c60ead1822bddafbc495e85a0c3b3733889f362b0009eca91b978e5326be40111643160355e49f7996cfa64be79ded722815fb0e3301e72a8cac506b8fb855e51dfd5f917557b2c83ee4e57eb8d4e90512b3bc097507988e227219b84d465ce547a6feb82124646b91bfc809370f4c10a7566647b5caff5c07af7f0c54e187bf23d8f6b51d1a2c9b82887d9164019f448674b30c956c748c9369087edfcab2b56acf2ef0c91881454fad3638dfc0616a7538933741d3f9b6659abf9eb4c7d451e7d3fd74c67b4af58cb2b29fd51399199cf19c781edb8add49d7de7a7330258b538004b941db66111724ab4b8d11c61816920e02c77f2f59ad389e0f5216d6ae922271cd44dd9ad7252d13178ddab928b1b59f46e3bbde5e854fb5169a7c636992c5ed3ad17be46db8c297fe2bde7dfb4abc32513b5168864fc1e0e49289ed71ce67059b901b1130f97879872a6d08d1a8db4876c2e4600a1c833238ae44b1a152dd6b8532cf779d526308666fed1b5a14057a944fe61fec2f60e3ef6995490ba83b6b3a758dbf19386a317d9b3a5dc9d0c641e949d2ee633553e7f405de12e562b8590d1cb9c3862fd373ee918c5ea2ca466e787d316ed9067b3142f581be5fdc8292770280134e461098ed00a4dc17c0ed8c47775a723a4a5e335162763ca77df85f27e2aed1bb17548b0ea8d969fe76cb2ae2141bc1fa3087e907f5ffbbac8b2d74f6ed4c449c4cda5607782c322b5cccb70d28994c61c39c79f1212bd261da6c07121f66909a71d4b9940f0b8aae2b7f6f658c4f49610e981c27fab626a8aa04a8afa35fbc38ccbe3bd136b4f7cbcc9a02cce655a23e65564bf7b54045cfdf55f36b339cdf24a005dd3e73e578394088096c8e1e789235e1b62f25b0ff319d2b08d079ef5fb6bbd6acca8c57077220a34a9f3c5cb84bc588d6c035f1207bc63058b741fb9a2d481bd1a0c8efe324981ec2ce14b447e6f8488cc035ee71a648c9fe8f9de29d0098cf846852429166b642ca484101dc1bfec51dedcf876300efb7a2aa62a4f6f5c3c8ef975201bbc31c3105f493563a652420d26ad85a8fd4cea5bbf4fb956111a766bfc9c8576a31e51e65b6cae603aa360b790bcf4c7e1aff59407d88728fd914763b4e05ba446e5276e425edaa43d971504f2dc53497dd2e2f38b141f2606185b9e4aa39c1cf3d3bb9076f2ed2b869706ace8ee70c6389ed3d6847aa812cc76b796dd9d16f69f7847f9cd72712fa6474551b78bbd64f0bff2dc3dae8738b3154cddfe20ea2ab49eed07c4322e175af779cba3e547ac8d6da253fdaba4d8cb1c43f0f002e3ec2c9570fa71a9ba105b6b07a537fe47990350204a4f59e8c529a4901affcad504885abc35e4e75bdcecd617bbfeefd9c4d39a1217d3fd5011b14852f42b9272c5034c731a1eb7c51082b48abbcf57664e71d7b753e21ae57dc6a38970f63f61e3926696f678dd9a9b44a87b646b478966836de3449bbcff979afac633e078ca1b8d8fbadd93748c79dc54161c267b19dc6d4bf655b2dfc5ef7072f330ea859124dcd03ed90e86fc1daa9f46d5a6ab0aff5bc736e0444c77247ba1a38bf56a54b90e1f7e3f063e46a8e04a3d043638c91bb3db7ac6c392eea2b8445847a8a6e93502931d49ac971f4da98344b564e967f1fa2de1a416eb36ef0f34b459470dcf2262f5d8bf2080f36c541730da21e4b7adab67bc6a5bb8db8c6655cb3d1be0b713313171f877b0031d5acad82e6b1b393d73dd4738aa30d454b45050f6eddebc1b99b8d4de19c5cef78aa48a817641fe8e2e6167e5046194b84e45988803c3e4453d5f53dd5b3c558445268dd452319cbbb1bc36a07371242fbf7dced6c897ec0d76912f9330fd8bcc80013ac53f6a936035ccef071a127e01a9f80047df36ca6311d0f258a7c00673752970302b3644d0de32e1594f6a7398a3114265278d0667adbbf1ea50fbdd34293383438199622d30370d0f7679e337049491223ba48b17f65819135bc885cb05f1b23b3aac320d4438a935a53ad1b2d9b6772870f5605aef25b488aac3c4156fd57d533d2d8249ca75c24f76b76e90834ab6a9221bb22a1edb0e03bfbd706749db468b3ff82e559a79f4873545be23f7758f670b62ef7b6b9b383eb265d4c99c60ddbe9941dc67c07283f1121ac5c1eb66d1100260b398384eccd2fca99992ffe758f8b85e033e2df278f86d763c106949bee880881674178ea90cb82f601409845168e8e06bd96d984277e625291e4f5514774849794b35464f9381c5e1c567e879e80f2328e5488fa795e228b645e6e4ff11d3ed19d73775296a26e9f5c8411e85adaca0e389d581009d974093683eef7773bc4ba4efbcfb14908402e3cf8b1aa0b7ad5580f853fcbddbf191b8064df932acc0cbc10edd7301b7bca1587c52208c1dd37bf4bc222605f8c521f84fb7035162cd91d6905938b4d88dcd604eeac05efce1eb3776059991d196ae5038aba222ff22292d20f8b7b3911e549357b74c2af4506364e9a94d3f5f29e954e40e50ba24cc68643f6d9931b482158719e92c30f304ca1e6f0ff4b9289bc8360fe8cb2464d96f61347fafeaf0b8708386eb316819f3c9c59a415eb7434d9c8424645a7b3f47a50c059242666c4db52ca3c2d9e68ac936c7a7bc9d3b5405267e301af0707dabf3686634ac6cf2c237bcfb6c64c9514360a8db937e159cdb5b09b5460fe55e3598ae6a2b0514318b130d137969b4b6de4fbbeabc9bf22eb2f2048db79b627ffe67b892c95645659bf8052d3fbe295de3059caf41becc51223039fb9d9485b3aad9e39268140056f4a25611734a46e2fc2fcf16d756482b4270f464e37bf28a916cf33dde1eab7d9a1c69562a6ddd5d9b64266159a1ed68dbf0177d1e2e74abe9b0ce440f5dc5ea12fdfeb4b97bb3f7525ea22eb52fe8a86be0b60a649fc5531ec6e42d3a1df868d61c3f8feb3f46645d07c4fbae6427204666948b0c6aa8738cd3452125899d79b92256208542191471141cdc78164388770377080a93f9e8fb8cdf0ff68970280daec97e1763e928cbaf319668bda4da790e4816451b5d59e969e4b06a3c7acdcc4b6f03499778de4ea1721bf27d7d0a66a4315c689de0fd00579ae1310c3f83e494c76c76218371a3174cf12260ec278e423dfc123ec00d4afcecd4246b28f33b28087b0a134232548e63b92378a197a7880a84f0fabdf32ea11f7c01ebf6cc2e26308f8f84339fd01265573a8bfaad1f5222b75f6d0a9e196c72f3d45b599a0a246c799d9a4c4817ee7ce06a05569b0c0b3db5b81ae35ac48895cea2be718938ef0b576a086675dc3f90dac38cb73e463cf9b6dbef9f172644db220e2e788d7a38cdb362054584d9ce4bd7375ef8e6e1ccfe70000000030e0664814f76d57cd5537a65a9cac5adfe2d50244b96fea309fbeef4afa20bf033bea2394bd8c2983ce3a13653be5d4afc852357bd354113bef4361f217fc85a506fd36db4c6b0834aa7045e68d9cabf835804265f18aa23c80f578e6c5044ba62c4d25cf6af2f650b7d81ad8f63be6f3b3daa50db80137de3d880423a08044e34dd4e8aff7187cb02f89ece47aa3cbaa49b83eea5b19c42da8bdc08040aa9ce32b3e"], 0xc14}}, 0x4000080) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1c) [ 711.105967] ntfs: (device loop1): parse_options(): Unrecognized mount option fowner>00000000000000000000. 16:06:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000300)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = syz_open_dev$amidi(&(0x7f0000002600)='/dev/amidi#\x00', 0xffffffff00000000, 0x2000) write$cgroup_int(r3, &(0x7f0000002640)=0xffffffffffff8f36, 0x12) chroot(&(0x7f0000002680)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmmsg(r1, &(0x7f0000002580)=[{{&(0x7f0000000100)=@sco, 0x80, &(0x7f0000001500)=[{&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/206, 0xce}, {&(0x7f0000001340)=""/111, 0x6f}, {&(0x7f00000013c0)=""/154, 0x9a}, {&(0x7f00000002c0)=""/30, 0x1e}, {&(0x7f0000001480)=""/72, 0x48}], 0x6, &(0x7f0000001580)=""/4096, 0x1000}, 0xb95d}], 0x1, 0x2000, &(0x7f00000025c0)={0x77359400}) 16:06:30 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 711.206534] ntfs: (device loop1): parse_options(): Unrecognized mount option . 16:06:30 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 711.254852] binder: 31172:31175 ioctl c0305710 20000100 returned -22 [ 711.317612] ntfs: (device loop1): parse_options(): Unrecognized mount option fowner<00000000000000000000. 16:06:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f0000000180)={0xffffffffffffff72, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 711.352440] binder: 31172:31185 unknown command -1073387771 [ 711.429344] ntfs: (device loop1): parse_options(): Unrecognized mount option euid. [ 711.440131] binder: 31172:31185 ioctl c0306201 200000c0 returned -22 [ 711.447466] binder: 31172:31175 got transaction with invalid handle, 0 [ 711.494962] ntfs: (device loop1): parse_options(): Unrecognized mount option measure. [ 711.541930] binder: 31172:31175 transaction failed 29201/-22, size 24-8 line 3126 [ 711.549782] ntfs: (device loop1): parse_options(): Unrecognized mount option fowner>00000000000000000000. [ 711.616026] ntfs: (device loop1): parse_options(): Unrecognized mount option . [ 711.638521] binder: 31193:31194 ioctl 4b47 20000180 returned -22 [ 711.663306] binder: 31172:31180 ioctl c0305710 20000100 returned -22 [ 711.682734] binder_alloc: binder_alloc_mmap_handler: 31172 20001000-20004000 already mapped failed -16 16:06:31 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x511, 0x0) 16:06:31 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:31 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:31 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0xffffff73) r1 = dup(r0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x100000001) 16:06:31 executing program 5: r0 = creat(0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, 0x0, &(0x7f0000000400)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='mime_typenodevprocwlan1.proc%vmnet1ppp0\xe6\x00', r0}, 0x10) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000340)={&(0x7f0000000200)='./file0\x00', r1}, 0x10) set_robust_list(&(0x7f0000000300)={0x0, 0xffffffffffffff80}, 0x18) r2 = socket$inet(0x10, 0x0, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000380)={'lo\x00', 0xa00}) sendmsg(r2, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000000000000000000000", 0x4c}], 0x1}, 0x0) sendmsg$nl_netfilter(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000001080)=ANY=[@ANYBLOB="140c00000207000025bd7000fedbdf250100000907ddb3028f6faa58f53a5be5341ec65aef6156b225d00e9587af65cf29078b9828c0e262dca25e674fb127e10afb9d37cd732b9b834f32f643781f3a256a691a17c81a64b7f8cc53212160ea0e31a02ecc72965e6b78cc7e4f3931deefa01decc62889348f7ca549eabdcc68b15a741bcb2b09512d1a453543cc9764159249a80a6b3281ca8ecf675e48dc02dd35436858a0d825848c24441502a9174f129e00debbba5d8b11d9ee9099ca982183898b1f2e407027325f3c4d04a57bdb800fa6ff6fd8b7beba38a6ee3a37fb83e6d62b113d46a250835c3fef9f81e70f49cfeccd37bede4f7bc2bd4a17306e085854444d52308bddb74dcbb8c928597005c441964db79fd4fd2fbdd49597c5fa87c3ce2427605d3abe979315d42dd8f51adc6381fd8ee67c4211a368f294b4d43699d05e76747a10451d31e45a0f245712a33f09e613ac94f015db9e498c675558c12b830cbda1fdfd710d59e4ca3e40558fabfd2e61ef15436f05b84a0394f7f055d1819ec3a1280d635b6d8b6990f6313a0ab42f2e6638d9ea77aade5bdae5931e6fc55caa72a9e57216e1e8ea85c56cf22c1e6968d91b55ad3a949c5a546fc6ec764bde099df7a7b1bb5173d883d4bb134f6adff8710d4bc1ecaa77517ecd7ca1e05a90fc8a472bafbaeb7d51236acf456f79f052226dde5bcb9bc64bc5872d355cd37d2e16d7c60ead1822bddafbc495e85a0c3b3733889f362b0009eca91b978e5326be40111643160355e49f7996cfa64be79ded722815fb0e3301e72a8cac506b8fb855e51dfd5f917557b2c83ee4e57eb8d4e90512b3bc097507988e227219b84d465ce547a6feb82124646b91bfc809370f4c10a7566647b5caff5c07af7f0c54e187bf23d8f6b51d1a2c9b82887d9164019f448674b30c956c748c9369087edfcab2b56acf2ef0c91881454fad3638dfc0616a7538933741d3f9b6659abf9eb4c7d451e7d3fd74c67b4af58cb2b29fd51399199cf19c781edb8add49d7de7a7330258b538004b941db66111724ab4b8d11c61816920e02c77f2f59ad389e0f5216d6ae922271cd44dd9ad7252d13178ddab928b1b59f46e3bbde5e854fb5169a7c636992c5ed3ad17be46db8c297fe2bde7dfb4abc32513b5168864fc1e0e49289ed71ce67059b901b1130f97879872a6d08d1a8db4876c2e4600a1c833238ae44b1a152dd6b8532cf779d526308666fed1b5a14057a944fe61fec2f60e3ef6995490ba83b6b3a758dbf19386a317d9b3a5dc9d0c641e949d2ee633553e7f405de12e562b8590d1cb9c3862fd373ee918c5ea2ca466e787d316ed9067b3142f581be5fdc8292770280134e461098ed00a4dc17c0ed8c47775a723a4a5e335162763ca77df85f27e2aed1bb17548b0ea8d969fe76cb2ae2141bc1fa3087e907f5ffbbac8b2d74f6ed4c449c4cda5607782c322b5cccb70d28994c61c39c79f1212bd261da6c07121f66909a71d4b9940f0b8aae2b7f6f658c4f49610e981c27fab626a8aa04a8afa35fbc38ccbe3bd136b4f7cbcc9a02cce655a23e65564bf7b54045cfdf55f36b339cdf24a005dd3e73e578394088096c8e1e789235e1b62f25b0ff319d2b08d079ef5fb6bbd6acca8c57077220a34a9f3c5cb84bc588d6c035f1207bc63058b741fb9a2d481bd1a0c8efe324981ec2ce14b447e6f8488cc035ee71a648c9fe8f9de29d0098cf846852429166b642ca484101dc1bfec51dedcf876300efb7a2aa62a4f6f5c3c8ef975201bbc31c3105f493563a652420d26ad85a8fd4cea5bbf4fb956111a766bfc9c8576a31e51e65b6cae603aa360b790bcf4c7e1aff59407d88728fd914763b4e05ba446e5276e425edaa43d971504f2dc53497dd2e2f38b141f2606185b9e4aa39c1cf3d3bb9076f2ed2b869706ace8ee70c6389ed3d6847aa812cc76b796dd9d16f69f7847f9cd72712fa6474551b78bbd64f0bff2dc3dae8738b3154cddfe20ea2ab49eed07c4322e175af779cba3e547ac8d6da253fdaba4d8cb1c43f0f002e3ec2c9570fa71a9ba105b6b07a537fe47990350204a4f59e8c529a4901affcad504885abc35e4e75bdcecd617bbfeefd9c4d39a1217d3fd5011b14852f42b9272c5034c731a1eb7c51082b48abbcf57664e71d7b753e21ae57dc6a38970f63f61e3926696f678dd9a9b44a87b646b478966836de3449bbcff979afac633e078ca1b8d8fbadd93748c79dc54161c267b19dc6d4bf655b2dfc5ef7072f330ea859124dcd03ed90e86fc1daa9f46d5a6ab0aff5bc736e0444c77247ba1a38bf56a54b90e1f7e3f063e46a8e04a3d043638c91bb3db7ac6c392eea2b8445847a8a6e93502931d49ac971f4da98344b564e967f1fa2de1a416eb36ef0f34b459470dcf2262f5d8bf2080f36c541730da21e4b7adab67bc6a5bb8db8c6655cb3d1be0b713313171f877b0031d5acad82e6b1b393d73dd4738aa30d454b45050f6eddebc1b99b8d4de19c5cef78aa48a817641fe8e2e6167e5046194b84e45988803c3e4453d5f53dd5b3c558445268dd452319cbbb1bc36a07371242fbf7dced6c897ec0d76912f9330fd8bcc80013ac53f6a936035ccef071a127e01a9f80047df36ca6311d0f258a7c00673752970302b3644d0de32e1594f6a7398a3114265278d0667adbbf1ea50fbdd34293383438199622d30370d0f7679e337049491223ba48b17f65819135bc885cb05f1b23b3aac320d4438a935a53ad1b2d9b6772870f5605aef25b488aac3c4156fd57d533d2d8249ca75c24f76b76e90834ab6a9221bb22a1edb0e03bfbd706749db468b3ff82e559a79f4873545be23f7758f670b62ef7b6b9b383eb265d4c99c60ddbe9941dc67c07283f1121ac5c1eb66d1100260b398384eccd2fca99992ffe758f8b85e033e2df278f86d763c106949bee880881674178ea90cb82f601409845168e8e06bd96d984277e625291e4f5514774849794b35464f9381c5e1c567e879e80f2328e5488fa795e228b645e6e4ff11d3ed19d73775296a26e9f5c8411e85adaca0e389d581009d974093683eef7773bc4ba4efbcfb14908402e3cf8b1aa0b7ad5580f853fcbddbf191b8064df932acc0cbc10edd7301b7bca1587c52208c1dd37bf4bc222605f8c521f84fb7035162cd91d6905938b4d88dcd604eeac05efce1eb3776059991d196ae5038aba222ff22292d20f8b7b3911e549357b74c2af4506364e9a94d3f5f29e954e40e50ba24cc68643f6d9931b482158719e92c30f304ca1e6f0ff4b9289bc8360fe8cb2464d96f61347fafeaf0b8708386eb316819f3c9c59a415eb7434d9c8424645a7b3f47a50c059242666c4db52ca3c2d9e68ac936c7a7bc9d3b5405267e301af0707dabf3686634ac6cf2c237bcfb6c64c9514360a8db937e159cdb5b09b5460fe55e3598ae6a2b0514318b130d137969b4b6de4fbbeabc9bf22eb2f2048db79b627ffe67b892c95645659bf8052d3fbe295de3059caf41becc51223039fb9d9485b3aad9e39268140056f4a25611734a46e2fc2fcf16d756482b4270f464e37bf28a916cf33dde1eab7d9a1c69562a6ddd5d9b64266159a1ed68dbf0177d1e2e74abe9b0ce440f5dc5ea12fdfeb4b97bb3f7525ea22eb52fe8a86be0b60a649fc5531ec6e42d3a1df868d61c3f8feb3f46645d07c4fbae6427204666948b0c6aa8738cd3452125899d79b92256208542191471141cdc78164388770377080a93f9e8fb8cdf0ff68970280daec97e1763e928cbaf319668bda4da790e4816451b5d59e969e4b06a3c7acdcc4b6f03499778de4ea1721bf27d7d0a66a4315c689de0fd00579ae1310c3f83e494c76c76218371a3174cf12260ec278e423dfc123ec00d4afcecd4246b28f33b28087b0a134232548e63b92378a197a7880a84f0fabdf32ea11f7c01ebf6cc2e26308f8f84339fd01265573a8bfaad1f5222b75f6d0a9e196c72f3d45b599a0a246c799d9a4c4817ee7ce06a05569b0c0b3db5b81ae35ac48895cea2be718938ef0b576a086675dc3f90dac38cb73e463cf9b6dbef9f172644db220e2e788d7a38cdb362054584d9ce4bd7375ef8e6e1ccfe70000000030e0664814f76d57cd5537a65a9cac5adfe2d50244b96fea309fbeef4afa20bf033bea2394bd8c2983ce3a13653be5d4afc852357bd354113bef4361f217fc85a506fd36db4c6b0834aa7045e68d9cabf835804265f18aa23c80f578e6c5044ba62c4d25cf6af2f650b7d81ad8f63be6f3b3daa50db80137de3d880423a08044e34dd4e8aff7187cb02f89ece47aa3cbaa49b83eea5b19c42da8bdc08040aa9ce32b3e"], 0xc14}}, 0x4000080) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1c) 16:06:31 executing program 5: r0 = creat(0x0, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, 0x0, &(0x7f0000000400)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='mime_typenodevprocwlan1.proc%vmnet1ppp0\xe6\x00', r0}, 0x10) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000340)={&(0x7f0000000200)='./file0\x00', r1}, 0x10) set_robust_list(&(0x7f0000000300)={0x0, 0xffffffffffffff80}, 0x18) r2 = socket$inet(0x10, 0x0, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000380)={'lo\x00', 0xa00}) sendmsg(r2, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000000000000000000000", 0x4c}], 0x1}, 0x0) sendmsg$nl_netfilter(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000001080)=ANY=[@ANYBLOB="140c00000207000025bd7000fedbdf250100000907ddb3028f6faa58f53a5be5341ec65aef6156b225d00e9587af65cf29078b9828c0e262dca25e674fb127e10afb9d37cd732b9b834f32f643781f3a256a691a17c81a64b7f8cc53212160ea0e31a02ecc72965e6b78cc7e4f3931deefa01decc62889348f7ca549eabdcc68b15a741bcb2b09512d1a453543cc9764159249a80a6b3281ca8ecf675e48dc02dd35436858a0d825848c24441502a9174f129e00debbba5d8b11d9ee9099ca982183898b1f2e407027325f3c4d04a57bdb800fa6ff6fd8b7beba38a6ee3a37fb83e6d62b113d46a250835c3fef9f81e70f49cfeccd37bede4f7bc2bd4a17306e085854444d52308bddb74dcbb8c928597005c441964db79fd4fd2fbdd49597c5fa87c3ce2427605d3abe979315d42dd8f51adc6381fd8ee67c4211a368f294b4d43699d05e76747a10451d31e45a0f245712a33f09e613ac94f015db9e498c675558c12b830cbda1fdfd710d59e4ca3e40558fabfd2e61ef15436f05b84a0394f7f055d1819ec3a1280d635b6d8b6990f6313a0ab42f2e6638d9ea77aade5bdae5931e6fc55caa72a9e57216e1e8ea85c56cf22c1e6968d91b55ad3a949c5a546fc6ec764bde099df7a7b1bb5173d883d4bb134f6adff8710d4bc1ecaa77517ecd7ca1e05a90fc8a472bafbaeb7d51236acf456f79f052226dde5bcb9bc64bc5872d355cd37d2e16d7c60ead1822bddafbc495e85a0c3b3733889f362b0009eca91b978e5326be40111643160355e49f7996cfa64be79ded722815fb0e3301e72a8cac506b8fb855e51dfd5f917557b2c83ee4e57eb8d4e90512b3bc097507988e227219b84d465ce547a6feb82124646b91bfc809370f4c10a7566647b5caff5c07af7f0c54e187bf23d8f6b51d1a2c9b82887d9164019f448674b30c956c748c9369087edfcab2b56acf2ef0c91881454fad3638dfc0616a7538933741d3f9b6659abf9eb4c7d451e7d3fd74c67b4af58cb2b29fd51399199cf19c781edb8add49d7de7a7330258b538004b941db66111724ab4b8d11c61816920e02c77f2f59ad389e0f5216d6ae922271cd44dd9ad7252d13178ddab928b1b59f46e3bbde5e854fb5169a7c636992c5ed3ad17be46db8c297fe2bde7dfb4abc32513b5168864fc1e0e49289ed71ce67059b901b1130f97879872a6d08d1a8db4876c2e4600a1c833238ae44b1a152dd6b8532cf779d526308666fed1b5a14057a944fe61fec2f60e3ef6995490ba83b6b3a758dbf19386a317d9b3a5dc9d0c641e949d2ee633553e7f405de12e562b8590d1cb9c3862fd373ee918c5ea2ca466e787d316ed9067b3142f581be5fdc8292770280134e461098ed00a4dc17c0ed8c47775a723a4a5e335162763ca77df85f27e2aed1bb17548b0ea8d969fe76cb2ae2141bc1fa3087e907f5ffbbac8b2d74f6ed4c449c4cda5607782c322b5cccb70d28994c61c39c79f1212bd261da6c07121f66909a71d4b9940f0b8aae2b7f6f658c4f49610e981c27fab626a8aa04a8afa35fbc38ccbe3bd136b4f7cbcc9a02cce655a23e65564bf7b54045cfdf55f36b339cdf24a005dd3e73e578394088096c8e1e789235e1b62f25b0ff319d2b08d079ef5fb6bbd6acca8c57077220a34a9f3c5cb84bc588d6c035f1207bc63058b741fb9a2d481bd1a0c8efe324981ec2ce14b447e6f8488cc035ee71a648c9fe8f9de29d0098cf846852429166b642ca484101dc1bfec51dedcf876300efb7a2aa62a4f6f5c3c8ef975201bbc31c3105f493563a652420d26ad85a8fd4cea5bbf4fb956111a766bfc9c8576a31e51e65b6cae603aa360b790bcf4c7e1aff59407d88728fd914763b4e05ba446e5276e425edaa43d971504f2dc53497dd2e2f38b141f2606185b9e4aa39c1cf3d3bb9076f2ed2b869706ace8ee70c6389ed3d6847aa812cc76b796dd9d16f69f7847f9cd72712fa6474551b78bbd64f0bff2dc3dae8738b3154cddfe20ea2ab49eed07c4322e175af779cba3e547ac8d6da253fdaba4d8cb1c43f0f002e3ec2c9570fa71a9ba105b6b07a537fe47990350204a4f59e8c529a4901affcad504885abc35e4e75bdcecd617bbfeefd9c4d39a1217d3fd5011b14852f42b9272c5034c731a1eb7c51082b48abbcf57664e71d7b753e21ae57dc6a38970f63f61e3926696f678dd9a9b44a87b646b478966836de3449bbcff979afac633e078ca1b8d8fbadd93748c79dc54161c267b19dc6d4bf655b2dfc5ef7072f330ea859124dcd03ed90e86fc1daa9f46d5a6ab0aff5bc736e0444c77247ba1a38bf56a54b90e1f7e3f063e46a8e04a3d043638c91bb3db7ac6c392eea2b8445847a8a6e93502931d49ac971f4da98344b564e967f1fa2de1a416eb36ef0f34b459470dcf2262f5d8bf2080f36c541730da21e4b7adab67bc6a5bb8db8c6655cb3d1be0b713313171f877b0031d5acad82e6b1b393d73dd4738aa30d454b45050f6eddebc1b99b8d4de19c5cef78aa48a817641fe8e2e6167e5046194b84e45988803c3e4453d5f53dd5b3c558445268dd452319cbbb1bc36a07371242fbf7dced6c897ec0d76912f9330fd8bcc80013ac53f6a936035ccef071a127e01a9f80047df36ca6311d0f258a7c00673752970302b3644d0de32e1594f6a7398a3114265278d0667adbbf1ea50fbdd34293383438199622d30370d0f7679e337049491223ba48b17f65819135bc885cb05f1b23b3aac320d4438a935a53ad1b2d9b6772870f5605aef25b488aac3c4156fd57d533d2d8249ca75c24f76b76e90834ab6a9221bb22a1edb0e03bfbd706749db468b3ff82e559a79f4873545be23f7758f670b62ef7b6b9b383eb265d4c99c60ddbe9941dc67c07283f1121ac5c1eb66d1100260b398384eccd2fca99992ffe758f8b85e033e2df278f86d763c106949bee880881674178ea90cb82f601409845168e8e06bd96d984277e625291e4f5514774849794b35464f9381c5e1c567e879e80f2328e5488fa795e228b645e6e4ff11d3ed19d73775296a26e9f5c8411e85adaca0e389d581009d974093683eef7773bc4ba4efbcfb14908402e3cf8b1aa0b7ad5580f853fcbddbf191b8064df932acc0cbc10edd7301b7bca1587c52208c1dd37bf4bc222605f8c521f84fb7035162cd91d6905938b4d88dcd604eeac05efce1eb3776059991d196ae5038aba222ff22292d20f8b7b3911e549357b74c2af4506364e9a94d3f5f29e954e40e50ba24cc68643f6d9931b482158719e92c30f304ca1e6f0ff4b9289bc8360fe8cb2464d96f61347fafeaf0b8708386eb316819f3c9c59a415eb7434d9c8424645a7b3f47a50c059242666c4db52ca3c2d9e68ac936c7a7bc9d3b5405267e301af0707dabf3686634ac6cf2c237bcfb6c64c9514360a8db937e159cdb5b09b5460fe55e3598ae6a2b0514318b130d137969b4b6de4fbbeabc9bf22eb2f2048db79b627ffe67b892c95645659bf8052d3fbe295de3059caf41becc51223039fb9d9485b3aad9e39268140056f4a25611734a46e2fc2fcf16d756482b4270f464e37bf28a916cf33dde1eab7d9a1c69562a6ddd5d9b64266159a1ed68dbf0177d1e2e74abe9b0ce440f5dc5ea12fdfeb4b97bb3f7525ea22eb52fe8a86be0b60a649fc5531ec6e42d3a1df868d61c3f8feb3f46645d07c4fbae6427204666948b0c6aa8738cd3452125899d79b92256208542191471141cdc78164388770377080a93f9e8fb8cdf0ff68970280daec97e1763e928cbaf319668bda4da790e4816451b5d59e969e4b06a3c7acdcc4b6f03499778de4ea1721bf27d7d0a66a4315c689de0fd00579ae1310c3f83e494c76c76218371a3174cf12260ec278e423dfc123ec00d4afcecd4246b28f33b28087b0a134232548e63b92378a197a7880a84f0fabdf32ea11f7c01ebf6cc2e26308f8f84339fd01265573a8bfaad1f5222b75f6d0a9e196c72f3d45b599a0a246c799d9a4c4817ee7ce06a05569b0c0b3db5b81ae35ac48895cea2be718938ef0b576a086675dc3f90dac38cb73e463cf9b6dbef9f172644db220e2e788d7a38cdb362054584d9ce4bd7375ef8e6e1ccfe70000000030e0664814f76d57cd5537a65a9cac5adfe2d50244b96fea309fbeef4afa20bf033bea2394bd8c2983ce3a13653be5d4afc852357bd354113bef4361f217fc85a506fd36db4c6b0834aa7045e68d9cabf835804265f18aa23c80f578e6c5044ba62c4d25cf6af2f650b7d81ad8f63be6f3b3daa50db80137de3d880423a08044e34dd4e8aff7187cb02f89ece47aa3cbaa49b83eea5b19c42da8bdc08040aa9ce32b3e"], 0xc14}}, 0x4000080) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1c) [ 711.786253] binder: BINDER_SET_CONTEXT_MGR already set [ 711.822891] binder: 31172:31206 unknown command -1073387771 [ 711.921464] binder: undelivered TRANSACTION_ERROR: 29201 [ 711.927344] binder: 31172:31185 ioctl 40046207 0 returned -16 [ 711.960195] binder: 31172:31206 ioctl c0306201 200000c0 returned -22 16:06:31 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:31 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:31 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='\x00', 0x400041, 0x120) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:31 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x34, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) r2 = getpgid(0xffffffffffffffff) fcntl$lock(r1, 0x27, &(0x7f0000000000)={0x2, 0x2, 0x9, 0x7f, r2}) ioctl$int_out(r0, 0x20000008810c5701, &(0x7f0000000080)) mincore(&(0x7f00000e2000/0x2000)=nil, 0x2000, &(0x7f00000000c0)=""/91) socket$inet6_tcp(0xa, 0x1, 0x0) 16:06:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0xfffffffffffffff8, 0x80000) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000100)={0x0, 0x72, "8307b084a401286e304bc26f1bcdb9ab3eea2fa24ea5029ddf017aebb0f9d85e84df3fc36632352fd5e569622e9a5e04d2def9262a7ce672a40cf5143c25d6d9a47e6958f9dd9699c23742604bfa41050a77709f2239eacc7878a468973e65dcf452f3a0c9b7422caa26096c63819580cc42"}, &(0x7f0000000180)=0x7a) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00000001c0)={r3, 0x2b69, 0x265529a2, 0x1, 0x5, 0xfffffffffffff87f}, 0x14) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xffffffffffffff14, 0x0, &(0x7f0000000040)=ANY=[@ANYRESHEX=r1], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000280)=[@acquire_done={0x40106309, r4, 0x3}], 0xfffffffffffffdf4, 0x0, 0x0}) 16:06:31 executing program 4: sendmmsg(0xffffffffffffffff, &(0x7f0000007e00)=[{{&(0x7f00000004c0)=@in6={0xa, 0x4e22, 0x0, @mcast2}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1400000000000000290000003e000000d85c4a09"], 0x14}}], 0x1, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000240)=0xc) setsockopt$inet6_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, 0x0, 0x0) mkdirat$cgroup(r3, &(0x7f0000000080)='3yz0\x00', 0x1ff) fchdir(r3) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) prctl$PR_SVE_GET_VL(0x33, 0xbef0) umount2(&(0x7f0000000280)='./file0\x00', 0x0) r4 = syz_open_dev$vcsn(0x0, 0x800, 0x80040) ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000140)=0x8001) bind$unix(0xffffffffffffffff, 0x0, 0x0) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x19, 0x0, 0x0) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) accept$alg(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) write$P9_RXATTRCREATE(r2, 0x0, 0xe17d492c7f47118b) syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) mmap$perf(&(0x7f00007d0000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x3) getgroups(0x2, &(0x7f0000000000)=[0xee01, 0xee01]) socket$inet6(0xa, 0x0, 0xd3) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r5, r6) socket$inet6(0xa, 0x2, 0x0) 16:06:31 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:31 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 712.248811] binder: 31228:31232 BC_ACQUIRE_DONE u0000000000000000 no match 16:06:31 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x8000, 0x0) write$selinux_load(r0, &(0x7f0000000080)={0xf97cff8c, 0x8, 'SE Linux', "1dc00c12d294b58c2f660084fe38919e26"}, 0x21) lsetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@random={'user.', '/dev/snapshot\x00'}, &(0x7f00000001c0)='GPL]+md5sum\x00', 0xc, 0x2) [ 712.293765] binder: 31228:31232 ioctl c0306201 200003c0 returned -14 [ 712.372296] binder: BINDER_SET_CONTEXT_MGR already set 16:06:31 executing program 5: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000100)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) connect$pptp(r0, &(0x7f0000000040)={0x18, 0x2, {0x2}}, 0x1e) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x4882) ioctl$SIOCRSACCEPT(r1, 0x89e3) 16:06:31 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 712.421416] binder: 31228:31239 ioctl 40046207 0 returned -16 16:06:31 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:31 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x5, 0xd6b3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0xfffffffffffffffe, 0x9, 0x0, 0x0, 0x0, 0x0, 0x7e49, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x9, 0x200802) write$tun(r0, &(0x7f0000000080)={@val={0x0, 0x6000}, @void, @llc={@snap={0x0, 0x1, "84", "f5b63c", 0x809b, "3517d9a8026ead09ddbf1732c6c2457d7a01004a0799e50df05877b55d28a16c2b74efcf9c7aa1c51f337c8585ad0cd3b2a224c598cfbc08e5fc19030a3fe859863c613674f902341676653af71f8737396007d43b47ed6ecde5284ae742d8e211b4a34df2d72ae4c43865e16aed857fea95997e731a93669b819ba02899713aefa67f41b0a01d23fa699e7906c75ed7703b9a68664fccde9ef88ac6a32e"}}}, 0xaa) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6008, 0xffffffffffffffff) 16:06:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x7ffffc, 0x11, r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:32 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000640)='cgroup.subtree_control\x00', 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0x8, 0x600002) syz_open_dev$vcsa(&(0x7f0000000540)='/dev/vcsa#\x00', 0x5, 0x140) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000580)='/proc/capi/capi20ncci\x00', 0x153441, 0x0) syz_open_dev$vbi(&(0x7f00000005c0)='/dev/vbi#\x00', 0x1, 0x2) dup3(r1, r0, 0x80000) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000600)='/dev/dlm_plock\x00', 0x400c00, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB="100000e4aed05f622247e0004020000000"], 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000140)={{{@in=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@remote}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vcan0\x00', r3}) socket$inet6_tcp(0xa, 0x1, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) symlink(&(0x7f0000000500)='./file0/f.le.\x00', &(0x7f0000000140)='.//ile0\x00') mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x10001, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r5, 0x8008ae9d, &(0x7f0000000340)=""/126) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) r6 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, 0x0, &(0x7f00000003c0)=0xfffffffffffffdbd) fsetxattr$system_posix_acl(r6, &(0x7f00000001c0)='system.posix_acl_access\x00', 0x0, 0x0, 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCDELRT(r6, 0x890c, &(0x7f0000000480)={@mcast1, @remote, @rand_addr="f450b44f36069a73d0f088e2907b79c0", 0x1, 0xffffffffffff0660, 0x5, 0x400, 0x4, 0x80000, r4}) renameat(r6, &(0x7f0000000240)='.//ile0\x00', r6, &(0x7f00000007c0)='./file0/f.le.\x00') perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1) getdents64(0xffffffffffffffff, 0x0, 0x0) fcntl$dupfd(r0, 0x0, r0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 16:06:32 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:32 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 712.843041] binder_alloc: 31267: binder_alloc_buf, no vma [ 712.876323] binder: 31267:31272 transaction failed 29189/-3, size 24-8 line 3035 [ 712.939026] binder: BINDER_SET_CONTEXT_MGR already set [ 712.964224] binder: 31267:31272 ioctl 40046207 0 returned -16 16:06:32 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) msgsnd(0x0, &(0x7f0000e74f60)={0x2}, 0x8, 0x0) msgrcv(0x0, &(0x7f0000745000)={0x0, ""/4096}, 0x1008, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200040, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000040)={{{@in=@multicast2, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) ioctl$SIOCAX25ADDUID(r2, 0x89e1, &(0x7f0000000180)={0x3, @null, r3}) 16:06:32 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:32 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="2616ffdf122a91ecbacd0a7b49332624d0138e38b40ab0eb674b063b27b7593ed4d1e8616e0c935eedf0b39607dbd76d60bfd15b25a30ea36cb306ceb2d2e19fa4ed0ed4d87f2c2c970f9b718af7835085892eb25a1ef510ca85e679b1378d976f0ca43c83f3bd71a18c0dcc2503698643050a87962f813a6c8a70d728ac4c8cbda566c9144545d07f2dd1a05d1e36907f4529b58fa0cf6f8325408de960e950ee8ae4878b3754f6a21ec675e1a7645a4bc4bc6319fc8cab3f5b9bebbb948c917291e4176a48e61011ab8b38f090fb6b27db0823038f5ba4ead3c70acd749df4972941fe6f90413d72221c89b93baa0eeeb30913debf7ad4287b62dad28ea4e1") [ 713.016900] binder: undelivered TRANSACTION_ERROR: 29189 16:06:32 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x80000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:32 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:32 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 713.343218] overlayfs: filesystem on './file0' not supported as upperdir [ 713.369353] binder_alloc: binder_alloc_mmap_handler: 31299 20001000-20004000 already mapped failed -16 16:06:32 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:32 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {r1, 0x1c, 0x0, @ib={0x1b, 0x1, 0x3, {"48d7782ce99999294917b35e5410ceef"}, 0x1, 0x6}}}, 0x90) [ 713.476281] binder_alloc: 31299: binder_alloc_buf, no vma [ 713.483693] binder: BINDER_SET_CONTEXT_MGR already set [ 713.495041] binder: 31299:31308 transaction failed 29189/-3, size 24-8 line 3035 [ 713.577356] binder: 31299:31314 ioctl 40046207 0 returned -16 [ 713.577367] binder: release 31299:31305 transaction 1739 out, still active [ 713.577379] binder: undelivered TRANSACTION_COMPLETE 16:06:32 executing program 5: bind$alg(0xffffffffffffffff, 0x0, 0x29a) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d", 0xa) r0 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r0, &(0x7f0000001380)={0x0, 0x0, 0x0, 0xfffffffffffffe8c, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x200}], 0x30}, 0x0) write$binfmt_script(r0, &(0x7f00000001c0)=ANY=[], 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x400200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000100)={'lo\x00'}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) getsockopt$inet_sctp_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000180)=[@text32={0x20, &(0x7f0000000200)="b8010000000f01d965660faeb603000000b8358556370f23c80f21f8350400d0000f23f8640fc7ae02000000ea00600000fa00c4c18566220f20d835080000000f22d8360f01cf66baf80cb83bd30c85ef66bafc0cb06aee0fc7b49f0a000000", 0x60}], 0x1, 0x5, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) ioctl$SIOCGETNODEID(r2, 0x89e1, &(0x7f0000000140)) ioctl$KVM_SET_CLOCK(r6, 0x4030ae7b, &(0x7f0000000000)={0x4, 0x2d1}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fchown(r3, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) 16:06:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x109, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0x2f) openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x220400, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) sendmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0xc000002000000000, &(0x7f00000009c0), 0x3e8, &(0x7f00000000c0)}}], 0x40000000000026a, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000001cc0)=[{{&(0x7f0000000580)=@in, 0x80, 0x0}}], 0x1, 0x10) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect$nfc_llcp(r1, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "957c1f39fdc861f704272ccaf88c5997e6504d2b304c6ffd080000000000000011764502ba2ec3b0dc8a561793ebc4317f4a3cfa6e9b08761700befb00", 0x26}, 0x60) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl\x00', 0x600, 0x0) accept4$llc(r2, 0x0, &(0x7f00000000c0), 0x0) [ 713.626731] binder: undelivered TRANSACTION_ERROR: 29189 [ 713.666070] binder: send failed reply for transaction 1739, target dead 16:06:33 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:33 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:33 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.SMACK64IPIN\x00', &(0x7f00000000c0)='\'eth1trusted\x00', 0xd, 0x2) 16:06:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630460"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$vbi(&(0x7f0000000340)='/dev/vbi#\x00', 0x1, 0x2) accept4$unix(r2, &(0x7f0000000440)=@abs, &(0x7f00000004c0)=0x6e, 0x80000) socketpair(0x1, 0x6, 0x3f, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_crypto(r3, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="e8000000120001002bbd7000fedbdf256374722d74776f666973682d33776179000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000200000000000000000000008000100fc4d00000000000000000000"], 0xe8}, 0x1, 0x0, 0x0, 0x20000001}, 0x80) ioctl$VIDIOC_G_CROP(r2, 0xc014563b, &(0x7f0000000500)={0xe, {0x7fff, 0x3, 0x7f, 0x40}}) socket$vsock_dgram(0x28, 0x2, 0x0) 16:06:33 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:33 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 714.005719] binder: 31341:31346 unknown command 1610900229 16:06:33 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:33 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) fstatfs(r0, &(0x7f0000000000)=""/5) [ 714.046143] binder: 31341:31346 ioctl c0306201 200000c0 returned -22 [ 714.070798] binder_alloc: 31341: binder_alloc_buf, no vma 16:06:33 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 714.155882] binder: 31341:31350 transaction failed 29189/-3, size 24-8 line 3035 16:06:33 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 714.340196] binder: BINDER_SET_CONTEXT_MGR already set [ 714.374646] binder: 31341:31350 unknown command 1610900229 [ 714.411660] binder: 31341:31346 ioctl 40046207 0 returned -16 [ 714.446558] binder: 31341:31350 ioctl c0306201 200000c0 returned -22 [ 714.480713] binder_alloc: 31341: binder_alloc_buf, no vma [ 714.495190] binder: undelivered TRANSACTION_ERROR: 29189 16:06:33 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000100)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SET_FPEMU(0xa, 0x2) r2 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000040)={0xc1ed, 0x1}) ioctl$VIDIOC_G_FMT(r2, 0xc0d05604, &(0x7f0000000500)={0xb, @win={{0x2, 0x3, 0x5, 0xf7}, 0xf, 0x3f, &(0x7f00000001c0)={{0x5, 0xffffffffffff8001, 0x3, 0x4}, &(0x7f0000000180)={{0x5, 0x1, 0x8891, 0x4}, &(0x7f00000000c0)={{0x8, 0x7, 0x9}}}}, 0x3, &(0x7f0000000980)="9f0ea015e9fbfcfa7cc7f8b30e4fbae470b363ae2df025562a2240de697ee8f8d28e73eafb2053cb4a018818223d570e4eb9b021a3074a35cec591a75b6161de527b65728cc8f8d98793fe94dc4c25a095dd3fc5e4e50c45e1516e8379de3daf9c90964fc8621f906840ae93fbba826f5f50ed003c2e2d03cd74a49eb5a17a9c98d1cc88af901a45cd373468a80170aa7e46a1903ae368f3e065f40b3176fe757dac492c61cc37163c9e8d1d58d497f03e28f11970f54b9a56c9605ca79a1f114262a7b1cae292ad21d7204edc5f69d0022c905d47911276d0ca2574fbfb39280a2e692a589fb8f17f957a5f2457be62f123973178c07f116d54b62ce7bad1b882d833a669ac7086b58d7678cde029f5b6b9384148f2a1a0ae5b82d2c1fbef3cf1640087786ca41c14594032f987a67394854bbb4042a5447d2f56bae19b26defcda8967dc2e875cb4cdde4af69c8c67ef10afb27300b74ecf17d9d548bb3af6246e1405e1c5a31dc38c39d5007845059952bdd9dc80ef264f5b13fd3d8eb3ae9f72b2fd94de29841983bcc6d86c99cd9be2759f0ed7e3058baa9efb93b21968af2ff85c07f791906bf4dfea444305f838f932ca3d8f0a9565648fe27094aa3172a74248a7e8b2797dbc23dcf754273d4ef4326710d05afb19832b3b5cb1e15d0f445a812b0532303da9e09bdddf9be404dbee606a871c008b305984f3591674aa1561381446015d33f3a3303ae75c661dc0fa64016e87f3b1535d49c5691ad81a2509687ef0cb37cc44ccb9258f2c65e0970aab4db5e846ec436c1f1b4b6bd1ca204e2c25de63ae1746309bb1de883c9200848cc31ce19de96d1978167a352b758f2699ae6ffb3315c7cae824029faba9881d42f5071ccd3f046aa353e97018940c3cb9f92f4c3a27d873363b959c01674f935505de13f84aab2b1727394aec480054026806b16a998a3e7b48b853af45eff5dd41143c72e1da7759c881f2a289cf48fa2c5c1f73d613f88a9df3030a815fa77f76d4eb7fee215ad97e72f1bf0f1b7ce2f72b1628324debd43ccc5b60a4b1d4956493f9139531b51211db5419904d08502da29e599e194db1588b49559d9b2fd12e60e05727934f4bca59f89fc9c572c446941ba8cad2a139a92e391d04ab8250fa91669c01f1b8c7b45eb737944ac1634b05a767dc66a39176daad5cf56252c7eca5f0d102ce72185683960b15c5a6ee3834a3962a5fe5e6583f6fece4add16f8b4f0faa8f98998be4143e900fa90f95af992331268036642afa5c059de0c77dfb9f73c9697d9354d2617498dbf1b670838d3bc8c628f521b4b3a13afdf7b3c80220558081735f863783ae781e5af4d6a2e53100fe1baf78d10e878cf447a8257b1c836fcee911351850a1a27c335c3b5da0580503aae73246183f8ca285bb8bbada31a2d2d1487f8756340b8f9d0ddc8cf5246508751cf95517d48d13c31745df373804bd2dfcbe4502bcbcfcdfe4d6bae0d95d134b70479ff2974793fb2c8395a18f352bf60dfdea8a8c49615f2cad562dc1a346e28d96a65043bb1282aa2ceb6706339836ea97ea8d4e5772569b660eed0323c4a6feacffb2e9b4cc0f2aa85cc02755ea87a9ab5073178a11ed16505f5686dbee5b52bf1a10791e271a545d4b97e00f74939f52af96cc2726eb0ced5c5f4d8b0f9a1944325b9e06995f7d7a8d642a2435dfa10b9ce9de16ca23906137fe536a484c5b8389d62e58003b9ce9debfb2710469be036142261c983100a155c756ab4841204dcab55109f2108962197198a2b12ec20f6c9104878df78724916b45ca2c104d9138da067afa847a4ff0c868063f7fcee47b48b95d5c5bbd43a2feab0e17b6b899b1480c3e1ba35e5aaba660c77f6e24eeb991b1a76310dd24aeacc9c28217ca4aca46eb30fa36f49141504157d5fbf49f71fb6ad4091bd2d8ce8ac0a44ce6e7422234e2ebf3a127c9c6ee452ab714f1c906f852b3793fd4703d7869f2278bc152da89901c35933e11e1c6f288cda723071ed2480d69e97ea063f3ffbd761825162c5cf3c18978b3f9924d30505a82b26fc7c967b3cb404db6ae30fb54841bc5fa4b0bd6c3c49c931cb046a8e302e1d83f97c8673e0210d04c8301f0d9f23bcde9fdbd47c3fc60aefc41c991bf28db95f3ae3e4d2cfaa9800def55395ecba65076c30dcb017f40bf8a44e6ecc73e8b978414e65224d5ee5b1d3422c96621eff7a0f303d4aea50481385f256e79f829ebd0e953eb897277dfbcfa03ac637266a16b07f91d542c1e9b97ffe04e9b94cb9651a1ff517ace0812808765b549ccf1f54ab645887d972060b20f068e7ed248a52c45def0decbd777e2aaa04c5875275c91bb9e40e5afa6c26a12cdad94e93589acdd66d3f27c6241953ea26a386a5a3dca57618d5b9013156907692698f360af0fa37bb4651724dfc1e69570f5f7582fb222b17d33c3f5e8aa76d685e5dc2dc6156e6395e7b0dbecf2723722963e54a0f35011e78f59566d1ce36311656c928d7d7fc9e46daf094d0b5c8e54a159421fc84e4d45e68b78230d7119796e3e6cb2ed60a123962510a1f688985134139a0f205b423f536072d839dde694cdd0dff258e2191f6ddfa6a6d600b6d0b6ba1876b6853a5cdd99fbd9f92d92a65d9234760dfc0b81ab4bb4432d0344aa7aace15cce2ca87a4cff49580349f06bf5c89ad6709270a3e5d9546402b0bb15a6348ae15775521c0b822a3122890a67ccc79a1616226d45a3f58dcb7116db8f30acb37f54f2c897ce2870f382e57ff940345ff9aec5c236967663ebe4f4c80d727edaa3d1448666a7063feea6b02bbf2809e82235aa7464f77398662622dfc9ac719d80a09ffe80cb7befedcdb965bfef3d615cbfc5981f5079d7f6d010e321877e91a8bad9728b6ee66202df588cdfae230cb2e691b5011026d92ed23e6d6efd890467fef83765e832b82c523d307b5416ecdaa6e8c281416330be5c3bcec086099ec9f01629dd1ccd8ea2e79f9175f991500b25f5d36657861a08c94e67f17104e3ab391bc80d00eb0a3f8714f00be906446570b57ecd4f3a5b668d2612578de4c03aca73671f48e95a8dc4281f340dcf205bcaaa60dc8e8361e62c26356eda3269051d0f40c172c29024ca52647723fc43052153444366d63bf17be89ac9c63229a9b0f44e3fcdb7d715fbeb8247e0ba2407e9b03564327f7e229846fd8434506679ded4ea5a139d360278f3d074b2e1fb495d0772f1fc2dbc852b70239e2a4a7a2bb32152f4b0638f41fe39367b14e82da14c358dd8a293c523e974c981d60752bed5970fe9c5060f83a5a9c3534b2b501ad5618e1e16c41fab9e8a5fc7b9a9b6df2ab8cf52da98d04da2bf4c342c18971b48b9fb978c251a9afe76f432cf3cb1195a723abaf2cfaa287ae2c7d630deb6d00cda3f5e33108c00c71f65241f831565c0b3f5d12dc113944374bae0276dd7191de393d4feee8f318d7bf9d5ef2546d7e104073d758a5d5a14bfcd93000ea876022990eb0c2605bd280ffcdf2305591131c9cd9042af2f3f3b6b5490926009993c21983318221cdac6b600297c6b9c7b7c3ccd41e65cb0a1aba3aec94cce667c9c4b198d4fa068a7185482002166614f3c269e40196d213f6aab6963d2894429f17557e96a134f7335c747a9faef8cffe6d29c35dfe2826cd41534f18bbf2a88694afc065c5d6d35a5857270c5e8abf0b9d4e2599a05b1ec64044a4f041b0576a4c3d820cbb28fa05d85e0d4b2bec152f5bb446a7def28faf28b55a356dcee98ab0f744be1cbfe7c66e851c55f3446b4c943402791eb3ddf3df89ab93a0b5dbc4e833536345e806fd0123440eac536c72f46c0afa28d9176d01ff1f36740316bcdb46b5fc4909326a87bb13f97e3bae291ca3791d616658cd1181be5e5686ac9c7b0961dca9d15bc654ec2e175529bd30da340e11c73b0e102e5eb0df99cc76626dc185bc54743ddc8e01188fcb5d4848bdc0d8b4fe0c533f97dcba6fd646b83a380690417555e9c2705752f95fb33f51e40b525a141294b5fb80e27641ef675af1b37ceb45d041ab2d1996941f238085c53a410a3925fe62976fa2552c03209f72cc5de86568adc5c88a274997f47b997f7b788835af48dda9401f5bce0600d878394e7fe4313126fbc0d2caba99ac330baf93952f14ea426293b9cf0b04e1b16576256ebb097db699cbf5462f1ea87751ed50fce05ab222f1c46605982e17f812bde4dd5bd2790ecc551c12f19598bde086f5d2f6eb80d096f52e11d4eb4c6bdd0296aa263172dac373d3a69fbcd2b7dbc82c4dede3259301f2eea4e4c6bb8b7a0783fd0aca43d5cfcbbda333f74a86a2e1a8ee622a2589c95731197a52cd6ae1cc819b2559eee42f65defac56769d4d7010acb3469499087b9507909e946f16b673ce48be1cf0025fe18a93009a73b17c5d1d2b65ffafbd619ae638a86ed45376e1f4b00c3a773aac771b8bb3106f2f966ddf4ba795f588c6ec74fedea9392fefe1229cd3ce2954213efce448df46e024b873c980afe727a3ad99ebd532030d2cc05596c027f429989a00859ba108eff8b0fc5b9c9dfce0b4ecc46f68678f4b4d3ea1c25ea609a810f1f91f1ad4d63ac6955c3cfeb7191c4269a89d1db1059b525350282eeb1ef65a35b21563037d0afdf8ba56df43542547f07746c6b71baeb2f3b7225f4e036c646019af84149bff78501acc6122755c4def231a65ab425dd68ede1e79494ad44ed40bf55187bea1e5ae9f3018e170065ddc425716203d4ee48ddb4ac903f9e7cb5c0a592b71a21256979041f89f1ed5ed6dda275a66c150cad822656f43c78fcee9969b0c2dfab1610231d4763f34f50653747ff737b3ef999b8534aa44bdfafdf6826f31d3c779e4148264c61f2ee26349a21adbbe8f6217f36dd0cd9a62b8c10cef8b24dd8f57b23d64e8f5a6506b24beecc1b7a59835b4d73753e679fa8582288543b721ff8603d6c2fcb6ec809eaa05add97f275c59cfae94a04f1026d5296e145138e1e2bf958ca64277d2114831f72562647f19d46c53e46beebbacf1e49b5369314e2c3984c2c2bccd827d1fb2c5b99b910495c7ddc526d8f3f20f3aae0e1f3c74f1894acd33bd4cd78753ba262ff259a918448fca50500248458ea74398453e24429dfad0a86cb97d23331916b5ab57c5e429438b96673ce535fc1b91c7a11a9b03d1ef6a58bf4507c7df5c03e0813cc7e3dc17797bb5867264822b52f5ffcaf5958424ff464fccc9444d399004862004a0e97decb25d4180b6218dc4eddda2b54e6f0cbf341fd2cf7d58c453a74498faf8310539a6ee71226de1fce23f49a0d127d52fa39422dfe9db02c071f62763ecf050ee67267295cbe041a2dca6eaf5b8c5078012427714503737ca83c35ae9833cef0f80ea2266696cfcaae2327cc1036c6e128569af8108ea9b60dea80bbcd1c0997a7725842062d72a8e11abe4d36f673f5b5d3a02248f0c0e51a356ac3ded798ddc9e1d5cec38f57dadefd845565c2723418785a630469c6bd598bbdf0cf640f050ed87cacc08808f97792f65306b61e3a194a662c95f5a924a0bb4e206c5dd60a77e4877388e529c2e300ed6d2c38584c1c518abcd68e26be007954d15ea33e368b1db9118cfc32b18969b5eb292a7b340147df355e09f8b0efb9f143709769e3ae4e19a8e15970d27aeea4251c5f4aa92086a7a64b15663e74f56be40d784166ecb28c9cd24a6d600b7f3665937b4693403ea8b38b4f9c3a4ec7fc0c5b448271e747f1245", 0xd0d}}) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000080)) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000740)=ANY=[@ANYBLOB="ffffff7f0000000002004e21e0000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000300000002004e20ac1e010100000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23ac14140c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080ffff00a78fffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002852eb45dc67c72b0a18f705b0b1ba77bcae2877137af53912"], 0x210) fcntl$setsig(r2, 0xa, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000200)={0x0}, &(0x7f0000000300)=0xc) write$P9_RGETLOCK(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="5b0000003702000300100000000000000900000000000000", @ANYRES32=r3, @ANYBLOB="3d0076626f786e657430267081000000000000005f616363657373766d6e6574306c6f6b657972696e676c6f656d30286d696d655f747970656367726f06dc"], 0x5b) write$9p(r2, &(0x7f0000000280)="e91f261955b0ea84e8f3c91947d170ae2716f08b5417a48d8153806ba309e0b9b9c16364929a402ab7bd80268d918ae5065d8176a470eeaeb5fca635dfd133f8a2d6de320a8eb881ecac49868478145c58951bc5234c12c867183b84002821febb53", 0x62) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f0000001980), &(0x7f00000019c0)=0x4) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000240)={'bond_slave_0\x00\x0e\x00', {0x2, 0x0, @rand_addr=0x7f000000}}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r0) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCX25SSUBSCRIP(r2, 0x89e1, &(0x7f0000000400)={'nr0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\xff\xff\xff\x00', 0x8001f, 0x3ff}) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x0, @local}}) r4 = shmget(0x3, 0x1000, 0x602, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r4, 0xd, &(0x7f0000000600)=""/235) write$FUSE_IOCTL(r2, &(0x7f0000000700)={0x20, 0xfffffffffffffffe, 0x3, {0x987b, 0x4, 0x4, 0x7}}, 0x20) [ 714.532299] binder: 31341:31368 transaction failed 29189/-3, size 24-8 line 3035 [ 714.582194] binder: undelivered TRANSACTION_ERROR: 29189 16:06:34 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x4, @mcast1}, 0x1c) listen(r0, 0x5) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x1000000, 0x0, 0x54}, 0x98) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000000)={0x0, 0xfffffffffffffff8}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000080)={0x8, 0x7, 0x200, 0x4, 0x4c, 0x9, 0x100, 0x71, r4}, 0x20) 16:06:34 executing program 1: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f00000004c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x148, r2, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000001}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3ead}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}]}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6_vti0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3c}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1000}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x1}}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xec}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6a}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@empty}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffffffc}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xffffffffffffffb3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x148}}, 0x4000) recvfrom$ax25(r1, &(0x7f00000001c0)=""/116, 0x74, 0x40000000, &(0x7f0000000240)={{0x3, @bcast}, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null]}, 0x48) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000000)={0x0, 0xff}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000000c0)={r3, 0x8, 0x10}, 0xc) r4 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r4, 0x660c) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r4) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x6000, 0xffffffffffffffff) 16:06:34 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:34 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = getpgid(0x0) ptrace$poke(0x5, r2, &(0x7f0000000000), 0xfffffffffffffffb) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x180, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000140)) [ 714.761741] binder_alloc: binder_alloc_mmap_handler: 31382 20001000-20004000 already mapped failed -16 16:06:34 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 714.809952] binder: BINDER_SET_CONTEXT_MGR already set [ 714.830899] binder: 31382:31389 ioctl 40046207 0 returned -16 [ 714.854570] binder_alloc: 31382: binder_alloc_buf, no vma 16:06:34 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) syz_mount_image$nfs4(&(0x7f0000000000)='nfs4\x00', &(0x7f0000000080)='./file0\x00', 0xd665, 0x1, &(0x7f00000000c0)=[{&(0x7f00000001c0)="05acb56a81f767d14757182209cbfc355b7b5c097bb171c58e559b47d9f5f4aaff61ebbc6985e6546d2eed9139c08d1722a96f38c3e6ced87300e47c3102a0fe3fbf09831a7fb4b0617d5d50d7020df1213c7af9430d1734aa9e4b0edbfaed1a98cb2775b68fab28600597b8a973f36a0e60473c9fdbbebfaf060cf07949d051c995cdf5a11fcb5b490ebbce2862c9a5ab27c266b70f8e39f79b3bf7c9bc5662467a01416c8109de339b9fe7db938d591f35993f868a63ffff5391faa7c9fe7d", 0xc0, 0x6}], 0x2, &(0x7f0000000100)='em0security,\x00') [ 714.880200] binder: release 31382:31389 transaction 1747 out, still active [ 714.887948] binder: 31382:31392 transaction failed 29189/-3, size 24-8 line 3035 [ 714.898122] binder: undelivered TRANSACTION_COMPLETE 16:06:34 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x2, 0x7ff}}], 0x30) [ 714.924944] binder: send failed reply for transaction 1747, target dead [ 714.952377] binder: undelivered TRANSACTION_ERROR: 29189 16:06:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) 16:06:34 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x8, 0x7ff}}], 0x30) [ 715.103986] binder: 31412:31413 ioctl 660c 0 returned -22 [ 715.133759] binder: 31412:31413 ioctl 660c 0 returned -22 [ 715.140155] binder_alloc: binder_alloc_mmap_handler: 31412 20001000-20004000 already mapped failed -16 [ 715.149926] binder: BINDER_SET_CONTEXT_MGR already set [ 715.155981] binder: 31412:31415 ioctl 40046207 0 returned -16 16:06:34 executing program 1: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xfffffffffffffffa, 0x101002) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x5000000000000, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000}, 0xffffffffffffffff, 0x0, r0, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:35 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000100)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SET_FPEMU(0xa, 0x2) r2 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000040)={0xc1ed, 0x1}) ioctl$VIDIOC_G_FMT(r2, 0xc0d05604, &(0x7f0000000500)={0xb, @win={{0x2, 0x3, 0x5, 0xf7}, 0xf, 0x3f, &(0x7f00000001c0)={{0x5, 0xffffffffffff8001, 0x3, 0x4}, &(0x7f0000000180)={{0x5, 0x1, 0x8891, 0x4}, &(0x7f00000000c0)={{0x8, 0x7, 0x9}}}}, 0x3, &(0x7f0000000980)="9f0ea015e9fbfcfa7cc7f8b30e4fbae470b363ae2df025562a2240de697ee8f8d28e73eafb2053cb4a018818223d570e4eb9b021a3074a35cec591a75b6161de527b65728cc8f8d98793fe94dc4c25a095dd3fc5e4e50c45e1516e8379de3daf9c90964fc8621f906840ae93fbba826f5f50ed003c2e2d03cd74a49eb5a17a9c98d1cc88af901a45cd373468a80170aa7e46a1903ae368f3e065f40b3176fe757dac492c61cc37163c9e8d1d58d497f03e28f11970f54b9a56c9605ca79a1f114262a7b1cae292ad21d7204edc5f69d0022c905d47911276d0ca2574fbfb39280a2e692a589fb8f17f957a5f2457be62f123973178c07f116d54b62ce7bad1b882d833a669ac7086b58d7678cde029f5b6b9384148f2a1a0ae5b82d2c1fbef3cf1640087786ca41c14594032f987a67394854bbb4042a5447d2f56bae19b26defcda8967dc2e875cb4cdde4af69c8c67ef10afb27300b74ecf17d9d548bb3af6246e1405e1c5a31dc38c39d5007845059952bdd9dc80ef264f5b13fd3d8eb3ae9f72b2fd94de29841983bcc6d86c99cd9be2759f0ed7e3058baa9efb93b21968af2ff85c07f791906bf4dfea444305f838f932ca3d8f0a9565648fe27094aa3172a74248a7e8b2797dbc23dcf754273d4ef4326710d05afb19832b3b5cb1e15d0f445a812b0532303da9e09bdddf9be404dbee606a871c008b305984f3591674aa1561381446015d33f3a3303ae75c661dc0fa64016e87f3b1535d49c5691ad81a2509687ef0cb37cc44ccb9258f2c65e0970aab4db5e846ec436c1f1b4b6bd1ca204e2c25de63ae1746309bb1de883c9200848cc31ce19de96d1978167a352b758f2699ae6ffb3315c7cae824029faba9881d42f5071ccd3f046aa353e97018940c3cb9f92f4c3a27d873363b959c01674f935505de13f84aab2b1727394aec480054026806b16a998a3e7b48b853af45eff5dd41143c72e1da7759c881f2a289cf48fa2c5c1f73d613f88a9df3030a815fa77f76d4eb7fee215ad97e72f1bf0f1b7ce2f72b1628324debd43ccc5b60a4b1d4956493f9139531b51211db5419904d08502da29e599e194db1588b49559d9b2fd12e60e05727934f4bca59f89fc9c572c446941ba8cad2a139a92e391d04ab8250fa91669c01f1b8c7b45eb737944ac1634b05a767dc66a39176daad5cf56252c7eca5f0d102ce72185683960b15c5a6ee3834a3962a5fe5e6583f6fece4add16f8b4f0faa8f98998be4143e900fa90f95af992331268036642afa5c059de0c77dfb9f73c9697d9354d2617498dbf1b670838d3bc8c628f521b4b3a13afdf7b3c80220558081735f863783ae781e5af4d6a2e53100fe1baf78d10e878cf447a8257b1c836fcee911351850a1a27c335c3b5da0580503aae73246183f8ca285bb8bbada31a2d2d1487f8756340b8f9d0ddc8cf5246508751cf95517d48d13c31745df373804bd2dfcbe4502bcbcfcdfe4d6bae0d95d134b70479ff2974793fb2c8395a18f352bf60dfdea8a8c49615f2cad562dc1a346e28d96a65043bb1282aa2ceb6706339836ea97ea8d4e5772569b660eed0323c4a6feacffb2e9b4cc0f2aa85cc02755ea87a9ab5073178a11ed16505f5686dbee5b52bf1a10791e271a545d4b97e00f74939f52af96cc2726eb0ced5c5f4d8b0f9a1944325b9e06995f7d7a8d642a2435dfa10b9ce9de16ca23906137fe536a484c5b8389d62e58003b9ce9debfb2710469be036142261c983100a155c756ab4841204dcab55109f2108962197198a2b12ec20f6c9104878df78724916b45ca2c104d9138da067afa847a4ff0c868063f7fcee47b48b95d5c5bbd43a2feab0e17b6b899b1480c3e1ba35e5aaba660c77f6e24eeb991b1a76310dd24aeacc9c28217ca4aca46eb30fa36f49141504157d5fbf49f71fb6ad4091bd2d8ce8ac0a44ce6e7422234e2ebf3a127c9c6ee452ab714f1c906f852b3793fd4703d7869f2278bc152da89901c35933e11e1c6f288cda723071ed2480d69e97ea063f3ffbd761825162c5cf3c18978b3f9924d30505a82b26fc7c967b3cb404db6ae30fb54841bc5fa4b0bd6c3c49c931cb046a8e302e1d83f97c8673e0210d04c8301f0d9f23bcde9fdbd47c3fc60aefc41c991bf28db95f3ae3e4d2cfaa9800def55395ecba65076c30dcb017f40bf8a44e6ecc73e8b978414e65224d5ee5b1d3422c96621eff7a0f303d4aea50481385f256e79f829ebd0e953eb897277dfbcfa03ac637266a16b07f91d542c1e9b97ffe04e9b94cb9651a1ff517ace0812808765b549ccf1f54ab645887d972060b20f068e7ed248a52c45def0decbd777e2aaa04c5875275c91bb9e40e5afa6c26a12cdad94e93589acdd66d3f27c6241953ea26a386a5a3dca57618d5b9013156907692698f360af0fa37bb4651724dfc1e69570f5f7582fb222b17d33c3f5e8aa76d685e5dc2dc6156e6395e7b0dbecf2723722963e54a0f35011e78f59566d1ce36311656c928d7d7fc9e46daf094d0b5c8e54a159421fc84e4d45e68b78230d7119796e3e6cb2ed60a123962510a1f688985134139a0f205b423f536072d839dde694cdd0dff258e2191f6ddfa6a6d600b6d0b6ba1876b6853a5cdd99fbd9f92d92a65d9234760dfc0b81ab4bb4432d0344aa7aace15cce2ca87a4cff49580349f06bf5c89ad6709270a3e5d9546402b0bb15a6348ae15775521c0b822a3122890a67ccc79a1616226d45a3f58dcb7116db8f30acb37f54f2c897ce2870f382e57ff940345ff9aec5c236967663ebe4f4c80d727edaa3d1448666a7063feea6b02bbf2809e82235aa7464f77398662622dfc9ac719d80a09ffe80cb7befedcdb965bfef3d615cbfc5981f5079d7f6d010e321877e91a8bad9728b6ee66202df588cdfae230cb2e691b5011026d92ed23e6d6efd890467fef83765e832b82c523d307b5416ecdaa6e8c281416330be5c3bcec086099ec9f01629dd1ccd8ea2e79f9175f991500b25f5d36657861a08c94e67f17104e3ab391bc80d00eb0a3f8714f00be906446570b57ecd4f3a5b668d2612578de4c03aca73671f48e95a8dc4281f340dcf205bcaaa60dc8e8361e62c26356eda3269051d0f40c172c29024ca52647723fc43052153444366d63bf17be89ac9c63229a9b0f44e3fcdb7d715fbeb8247e0ba2407e9b03564327f7e229846fd8434506679ded4ea5a139d360278f3d074b2e1fb495d0772f1fc2dbc852b70239e2a4a7a2bb32152f4b0638f41fe39367b14e82da14c358dd8a293c523e974c981d60752bed5970fe9c5060f83a5a9c3534b2b501ad5618e1e16c41fab9e8a5fc7b9a9b6df2ab8cf52da98d04da2bf4c342c18971b48b9fb978c251a9afe76f432cf3cb1195a723abaf2cfaa287ae2c7d630deb6d00cda3f5e33108c00c71f65241f831565c0b3f5d12dc113944374bae0276dd7191de393d4feee8f318d7bf9d5ef2546d7e104073d758a5d5a14bfcd93000ea876022990eb0c2605bd280ffcdf2305591131c9cd9042af2f3f3b6b5490926009993c21983318221cdac6b600297c6b9c7b7c3ccd41e65cb0a1aba3aec94cce667c9c4b198d4fa068a7185482002166614f3c269e40196d213f6aab6963d2894429f17557e96a134f7335c747a9faef8cffe6d29c35dfe2826cd41534f18bbf2a88694afc065c5d6d35a5857270c5e8abf0b9d4e2599a05b1ec64044a4f041b0576a4c3d820cbb28fa05d85e0d4b2bec152f5bb446a7def28faf28b55a356dcee98ab0f744be1cbfe7c66e851c55f3446b4c943402791eb3ddf3df89ab93a0b5dbc4e833536345e806fd0123440eac536c72f46c0afa28d9176d01ff1f36740316bcdb46b5fc4909326a87bb13f97e3bae291ca3791d616658cd1181be5e5686ac9c7b0961dca9d15bc654ec2e175529bd30da340e11c73b0e102e5eb0df99cc76626dc185bc54743ddc8e01188fcb5d4848bdc0d8b4fe0c533f97dcba6fd646b83a380690417555e9c2705752f95fb33f51e40b525a141294b5fb80e27641ef675af1b37ceb45d041ab2d1996941f238085c53a410a3925fe62976fa2552c03209f72cc5de86568adc5c88a274997f47b997f7b788835af48dda9401f5bce0600d878394e7fe4313126fbc0d2caba99ac330baf93952f14ea426293b9cf0b04e1b16576256ebb097db699cbf5462f1ea87751ed50fce05ab222f1c46605982e17f812bde4dd5bd2790ecc551c12f19598bde086f5d2f6eb80d096f52e11d4eb4c6bdd0296aa263172dac373d3a69fbcd2b7dbc82c4dede3259301f2eea4e4c6bb8b7a0783fd0aca43d5cfcbbda333f74a86a2e1a8ee622a2589c95731197a52cd6ae1cc819b2559eee42f65defac56769d4d7010acb3469499087b9507909e946f16b673ce48be1cf0025fe18a93009a73b17c5d1d2b65ffafbd619ae638a86ed45376e1f4b00c3a773aac771b8bb3106f2f966ddf4ba795f588c6ec74fedea9392fefe1229cd3ce2954213efce448df46e024b873c980afe727a3ad99ebd532030d2cc05596c027f429989a00859ba108eff8b0fc5b9c9dfce0b4ecc46f68678f4b4d3ea1c25ea609a810f1f91f1ad4d63ac6955c3cfeb7191c4269a89d1db1059b525350282eeb1ef65a35b21563037d0afdf8ba56df43542547f07746c6b71baeb2f3b7225f4e036c646019af84149bff78501acc6122755c4def231a65ab425dd68ede1e79494ad44ed40bf55187bea1e5ae9f3018e170065ddc425716203d4ee48ddb4ac903f9e7cb5c0a592b71a21256979041f89f1ed5ed6dda275a66c150cad822656f43c78fcee9969b0c2dfab1610231d4763f34f50653747ff737b3ef999b8534aa44bdfafdf6826f31d3c779e4148264c61f2ee26349a21adbbe8f6217f36dd0cd9a62b8c10cef8b24dd8f57b23d64e8f5a6506b24beecc1b7a59835b4d73753e679fa8582288543b721ff8603d6c2fcb6ec809eaa05add97f275c59cfae94a04f1026d5296e145138e1e2bf958ca64277d2114831f72562647f19d46c53e46beebbacf1e49b5369314e2c3984c2c2bccd827d1fb2c5b99b910495c7ddc526d8f3f20f3aae0e1f3c74f1894acd33bd4cd78753ba262ff259a918448fca50500248458ea74398453e24429dfad0a86cb97d23331916b5ab57c5e429438b96673ce535fc1b91c7a11a9b03d1ef6a58bf4507c7df5c03e0813cc7e3dc17797bb5867264822b52f5ffcaf5958424ff464fccc9444d399004862004a0e97decb25d4180b6218dc4eddda2b54e6f0cbf341fd2cf7d58c453a74498faf8310539a6ee71226de1fce23f49a0d127d52fa39422dfe9db02c071f62763ecf050ee67267295cbe041a2dca6eaf5b8c5078012427714503737ca83c35ae9833cef0f80ea2266696cfcaae2327cc1036c6e128569af8108ea9b60dea80bbcd1c0997a7725842062d72a8e11abe4d36f673f5b5d3a02248f0c0e51a356ac3ded798ddc9e1d5cec38f57dadefd845565c2723418785a630469c6bd598bbdf0cf640f050ed87cacc08808f97792f65306b61e3a194a662c95f5a924a0bb4e206c5dd60a77e4877388e529c2e300ed6d2c38584c1c518abcd68e26be007954d15ea33e368b1db9118cfc32b18969b5eb292a7b340147df355e09f8b0efb9f143709769e3ae4e19a8e15970d27aeea4251c5f4aa92086a7a64b15663e74f56be40d784166ecb28c9cd24a6d600b7f3665937b4693403ea8b38b4f9c3a4ec7fc0c5b448271e747f1245", 0xd0d}}) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000080)) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000740)=ANY=[@ANYBLOB="ffffff7f0000000002004e21e0000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000300000002004e20ac1e010100000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23ac14140c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080ffff00a78fffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002852eb45dc67c72b0a18f705b0b1ba77bcae2877137af53912"], 0x210) fcntl$setsig(r2, 0xa, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000200)={0x0}, &(0x7f0000000300)=0xc) write$P9_RGETLOCK(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="5b0000003702000300100000000000000900000000000000", @ANYRES32=r3, @ANYBLOB="3d0076626f786e657430267081000000000000005f616363657373766d6e6574306c6f6b657972696e676c6f656d30286d696d655f747970656367726f06dc"], 0x5b) write$9p(r2, &(0x7f0000000280)="e91f261955b0ea84e8f3c91947d170ae2716f08b5417a48d8153806ba309e0b9b9c16364929a402ab7bd80268d918ae5065d8176a470eeaeb5fca635dfd133f8a2d6de320a8eb881ecac49868478145c58951bc5234c12c867183b84002821febb53", 0x62) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f0000001980), &(0x7f00000019c0)=0x4) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000240)={'bond_slave_0\x00\x0e\x00', {0x2, 0x0, @rand_addr=0x7f000000}}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r0) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCX25SSUBSCRIP(r2, 0x89e1, &(0x7f0000000400)={'nr0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\xff\xff\xff\x00', 0x8001f, 0x3ff}) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x0, @local}}) r4 = shmget(0x3, 0x1000, 0x602, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r4, 0xd, &(0x7f0000000600)=""/235) write$FUSE_IOCTL(r2, &(0x7f0000000700)={0x20, 0xfffffffffffffffe, 0x3, {0x987b, 0x4, 0x4, 0x7}}, 0x20) 16:06:35 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000100)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SET_FPEMU(0xa, 0x2) r2 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000040)={0xc1ed, 0x1}) ioctl$VIDIOC_G_FMT(r2, 0xc0d05604, &(0x7f0000000500)={0xb, @win={{0x2, 0x3, 0x5, 0xf7}, 0xf, 0x3f, &(0x7f00000001c0)={{0x5, 0xffffffffffff8001, 0x3, 0x4}, &(0x7f0000000180)={{0x5, 0x1, 0x8891, 0x4}, &(0x7f00000000c0)={{0x8, 0x7, 0x9}}}}, 0x3, &(0x7f0000000980)="9f0ea015e9fbfcfa7cc7f8b30e4fbae470b363ae2df025562a2240de697ee8f8d28e73eafb2053cb4a018818223d570e4eb9b021a3074a35cec591a75b6161de527b65728cc8f8d98793fe94dc4c25a095dd3fc5e4e50c45e1516e8379de3daf9c90964fc8621f906840ae93fbba826f5f50ed003c2e2d03cd74a49eb5a17a9c98d1cc88af901a45cd373468a80170aa7e46a1903ae368f3e065f40b3176fe757dac492c61cc37163c9e8d1d58d497f03e28f11970f54b9a56c9605ca79a1f114262a7b1cae292ad21d7204edc5f69d0022c905d47911276d0ca2574fbfb39280a2e692a589fb8f17f957a5f2457be62f123973178c07f116d54b62ce7bad1b882d833a669ac7086b58d7678cde029f5b6b9384148f2a1a0ae5b82d2c1fbef3cf1640087786ca41c14594032f987a67394854bbb4042a5447d2f56bae19b26defcda8967dc2e875cb4cdde4af69c8c67ef10afb27300b74ecf17d9d548bb3af6246e1405e1c5a31dc38c39d5007845059952bdd9dc80ef264f5b13fd3d8eb3ae9f72b2fd94de29841983bcc6d86c99cd9be2759f0ed7e3058baa9efb93b21968af2ff85c07f791906bf4dfea444305f838f932ca3d8f0a9565648fe27094aa3172a74248a7e8b2797dbc23dcf754273d4ef4326710d05afb19832b3b5cb1e15d0f445a812b0532303da9e09bdddf9be404dbee606a871c008b305984f3591674aa1561381446015d33f3a3303ae75c661dc0fa64016e87f3b1535d49c5691ad81a2509687ef0cb37cc44ccb9258f2c65e0970aab4db5e846ec436c1f1b4b6bd1ca204e2c25de63ae1746309bb1de883c9200848cc31ce19de96d1978167a352b758f2699ae6ffb3315c7cae824029faba9881d42f5071ccd3f046aa353e97018940c3cb9f92f4c3a27d873363b959c01674f935505de13f84aab2b1727394aec480054026806b16a998a3e7b48b853af45eff5dd41143c72e1da7759c881f2a289cf48fa2c5c1f73d613f88a9df3030a815fa77f76d4eb7fee215ad97e72f1bf0f1b7ce2f72b1628324debd43ccc5b60a4b1d4956493f9139531b51211db5419904d08502da29e599e194db1588b49559d9b2fd12e60e05727934f4bca59f89fc9c572c446941ba8cad2a139a92e391d04ab8250fa91669c01f1b8c7b45eb737944ac1634b05a767dc66a39176daad5cf56252c7eca5f0d102ce72185683960b15c5a6ee3834a3962a5fe5e6583f6fece4add16f8b4f0faa8f98998be4143e900fa90f95af992331268036642afa5c059de0c77dfb9f73c9697d9354d2617498dbf1b670838d3bc8c628f521b4b3a13afdf7b3c80220558081735f863783ae781e5af4d6a2e53100fe1baf78d10e878cf447a8257b1c836fcee911351850a1a27c335c3b5da0580503aae73246183f8ca285bb8bbada31a2d2d1487f8756340b8f9d0ddc8cf5246508751cf95517d48d13c31745df373804bd2dfcbe4502bcbcfcdfe4d6bae0d95d134b70479ff2974793fb2c8395a18f352bf60dfdea8a8c49615f2cad562dc1a346e28d96a65043bb1282aa2ceb6706339836ea97ea8d4e5772569b660eed0323c4a6feacffb2e9b4cc0f2aa85cc02755ea87a9ab5073178a11ed16505f5686dbee5b52bf1a10791e271a545d4b97e00f74939f52af96cc2726eb0ced5c5f4d8b0f9a1944325b9e06995f7d7a8d642a2435dfa10b9ce9de16ca23906137fe536a484c5b8389d62e58003b9ce9debfb2710469be036142261c983100a155c756ab4841204dcab55109f2108962197198a2b12ec20f6c9104878df78724916b45ca2c104d9138da067afa847a4ff0c868063f7fcee47b48b95d5c5bbd43a2feab0e17b6b899b1480c3e1ba35e5aaba660c77f6e24eeb991b1a76310dd24aeacc9c28217ca4aca46eb30fa36f49141504157d5fbf49f71fb6ad4091bd2d8ce8ac0a44ce6e7422234e2ebf3a127c9c6ee452ab714f1c906f852b3793fd4703d7869f2278bc152da89901c35933e11e1c6f288cda723071ed2480d69e97ea063f3ffbd761825162c5cf3c18978b3f9924d30505a82b26fc7c967b3cb404db6ae30fb54841bc5fa4b0bd6c3c49c931cb046a8e302e1d83f97c8673e0210d04c8301f0d9f23bcde9fdbd47c3fc60aefc41c991bf28db95f3ae3e4d2cfaa9800def55395ecba65076c30dcb017f40bf8a44e6ecc73e8b978414e65224d5ee5b1d3422c96621eff7a0f303d4aea50481385f256e79f829ebd0e953eb897277dfbcfa03ac637266a16b07f91d542c1e9b97ffe04e9b94cb9651a1ff517ace0812808765b549ccf1f54ab645887d972060b20f068e7ed248a52c45def0decbd777e2aaa04c5875275c91bb9e40e5afa6c26a12cdad94e93589acdd66d3f27c6241953ea26a386a5a3dca57618d5b9013156907692698f360af0fa37bb4651724dfc1e69570f5f7582fb222b17d33c3f5e8aa76d685e5dc2dc6156e6395e7b0dbecf2723722963e54a0f35011e78f59566d1ce36311656c928d7d7fc9e46daf094d0b5c8e54a159421fc84e4d45e68b78230d7119796e3e6cb2ed60a123962510a1f688985134139a0f205b423f536072d839dde694cdd0dff258e2191f6ddfa6a6d600b6d0b6ba1876b6853a5cdd99fbd9f92d92a65d9234760dfc0b81ab4bb4432d0344aa7aace15cce2ca87a4cff49580349f06bf5c89ad6709270a3e5d9546402b0bb15a6348ae15775521c0b822a3122890a67ccc79a1616226d45a3f58dcb7116db8f30acb37f54f2c897ce2870f382e57ff940345ff9aec5c236967663ebe4f4c80d727edaa3d1448666a7063feea6b02bbf2809e82235aa7464f77398662622dfc9ac719d80a09ffe80cb7befedcdb965bfef3d615cbfc5981f5079d7f6d010e321877e91a8bad9728b6ee66202df588cdfae230cb2e691b5011026d92ed23e6d6efd890467fef83765e832b82c523d307b5416ecdaa6e8c281416330be5c3bcec086099ec9f01629dd1ccd8ea2e79f9175f991500b25f5d36657861a08c94e67f17104e3ab391bc80d00eb0a3f8714f00be906446570b57ecd4f3a5b668d2612578de4c03aca73671f48e95a8dc4281f340dcf205bcaaa60dc8e8361e62c26356eda3269051d0f40c172c29024ca52647723fc43052153444366d63bf17be89ac9c63229a9b0f44e3fcdb7d715fbeb8247e0ba2407e9b03564327f7e229846fd8434506679ded4ea5a139d360278f3d074b2e1fb495d0772f1fc2dbc852b70239e2a4a7a2bb32152f4b0638f41fe39367b14e82da14c358dd8a293c523e974c981d60752bed5970fe9c5060f83a5a9c3534b2b501ad5618e1e16c41fab9e8a5fc7b9a9b6df2ab8cf52da98d04da2bf4c342c18971b48b9fb978c251a9afe76f432cf3cb1195a723abaf2cfaa287ae2c7d630deb6d00cda3f5e33108c00c71f65241f831565c0b3f5d12dc113944374bae0276dd7191de393d4feee8f318d7bf9d5ef2546d7e104073d758a5d5a14bfcd93000ea876022990eb0c2605bd280ffcdf2305591131c9cd9042af2f3f3b6b5490926009993c21983318221cdac6b600297c6b9c7b7c3ccd41e65cb0a1aba3aec94cce667c9c4b198d4fa068a7185482002166614f3c269e40196d213f6aab6963d2894429f17557e96a134f7335c747a9faef8cffe6d29c35dfe2826cd41534f18bbf2a88694afc065c5d6d35a5857270c5e8abf0b9d4e2599a05b1ec64044a4f041b0576a4c3d820cbb28fa05d85e0d4b2bec152f5bb446a7def28faf28b55a356dcee98ab0f744be1cbfe7c66e851c55f3446b4c943402791eb3ddf3df89ab93a0b5dbc4e833536345e806fd0123440eac536c72f46c0afa28d9176d01ff1f36740316bcdb46b5fc4909326a87bb13f97e3bae291ca3791d616658cd1181be5e5686ac9c7b0961dca9d15bc654ec2e175529bd30da340e11c73b0e102e5eb0df99cc76626dc185bc54743ddc8e01188fcb5d4848bdc0d8b4fe0c533f97dcba6fd646b83a380690417555e9c2705752f95fb33f51e40b525a141294b5fb80e27641ef675af1b37ceb45d041ab2d1996941f238085c53a410a3925fe62976fa2552c03209f72cc5de86568adc5c88a274997f47b997f7b788835af48dda9401f5bce0600d878394e7fe4313126fbc0d2caba99ac330baf93952f14ea426293b9cf0b04e1b16576256ebb097db699cbf5462f1ea87751ed50fce05ab222f1c46605982e17f812bde4dd5bd2790ecc551c12f19598bde086f5d2f6eb80d096f52e11d4eb4c6bdd0296aa263172dac373d3a69fbcd2b7dbc82c4dede3259301f2eea4e4c6bb8b7a0783fd0aca43d5cfcbbda333f74a86a2e1a8ee622a2589c95731197a52cd6ae1cc819b2559eee42f65defac56769d4d7010acb3469499087b9507909e946f16b673ce48be1cf0025fe18a93009a73b17c5d1d2b65ffafbd619ae638a86ed45376e1f4b00c3a773aac771b8bb3106f2f966ddf4ba795f588c6ec74fedea9392fefe1229cd3ce2954213efce448df46e024b873c980afe727a3ad99ebd532030d2cc05596c027f429989a00859ba108eff8b0fc5b9c9dfce0b4ecc46f68678f4b4d3ea1c25ea609a810f1f91f1ad4d63ac6955c3cfeb7191c4269a89d1db1059b525350282eeb1ef65a35b21563037d0afdf8ba56df43542547f07746c6b71baeb2f3b7225f4e036c646019af84149bff78501acc6122755c4def231a65ab425dd68ede1e79494ad44ed40bf55187bea1e5ae9f3018e170065ddc425716203d4ee48ddb4ac903f9e7cb5c0a592b71a21256979041f89f1ed5ed6dda275a66c150cad822656f43c78fcee9969b0c2dfab1610231d4763f34f50653747ff737b3ef999b8534aa44bdfafdf6826f31d3c779e4148264c61f2ee26349a21adbbe8f6217f36dd0cd9a62b8c10cef8b24dd8f57b23d64e8f5a6506b24beecc1b7a59835b4d73753e679fa8582288543b721ff8603d6c2fcb6ec809eaa05add97f275c59cfae94a04f1026d5296e145138e1e2bf958ca64277d2114831f72562647f19d46c53e46beebbacf1e49b5369314e2c3984c2c2bccd827d1fb2c5b99b910495c7ddc526d8f3f20f3aae0e1f3c74f1894acd33bd4cd78753ba262ff259a918448fca50500248458ea74398453e24429dfad0a86cb97d23331916b5ab57c5e429438b96673ce535fc1b91c7a11a9b03d1ef6a58bf4507c7df5c03e0813cc7e3dc17797bb5867264822b52f5ffcaf5958424ff464fccc9444d399004862004a0e97decb25d4180b6218dc4eddda2b54e6f0cbf341fd2cf7d58c453a74498faf8310539a6ee71226de1fce23f49a0d127d52fa39422dfe9db02c071f62763ecf050ee67267295cbe041a2dca6eaf5b8c5078012427714503737ca83c35ae9833cef0f80ea2266696cfcaae2327cc1036c6e128569af8108ea9b60dea80bbcd1c0997a7725842062d72a8e11abe4d36f673f5b5d3a02248f0c0e51a356ac3ded798ddc9e1d5cec38f57dadefd845565c2723418785a630469c6bd598bbdf0cf640f050ed87cacc08808f97792f65306b61e3a194a662c95f5a924a0bb4e206c5dd60a77e4877388e529c2e300ed6d2c38584c1c518abcd68e26be007954d15ea33e368b1db9118cfc32b18969b5eb292a7b340147df355e09f8b0efb9f143709769e3ae4e19a8e15970d27aeea4251c5f4aa92086a7a64b15663e74f56be40d784166ecb28c9cd24a6d600b7f3665937b4693403ea8b38b4f9c3a4ec7fc0c5b448271e747f1245", 0xd0d}}) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000080)) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000740)=ANY=[@ANYBLOB="ffffff7f0000000002004e21e0000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000300000002004e20ac1e010100000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23ac14140c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080ffff00a78fffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002852eb45dc67c72b0a18f705b0b1ba77bcae2877137af53912"], 0x210) fcntl$setsig(r2, 0xa, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000200)={0x0}, &(0x7f0000000300)=0xc) write$P9_RGETLOCK(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="5b0000003702000300100000000000000900000000000000", @ANYRES32=r3, @ANYBLOB="3d0076626f786e657430267081000000000000005f616363657373766d6e6574306c6f6b657972696e676c6f656d30286d696d655f747970656367726f06dc"], 0x5b) write$9p(r2, &(0x7f0000000280)="e91f261955b0ea84e8f3c91947d170ae2716f08b5417a48d8153806ba309e0b9b9c16364929a402ab7bd80268d918ae5065d8176a470eeaeb5fca635dfd133f8a2d6de320a8eb881ecac49868478145c58951bc5234c12c867183b84002821febb53", 0x62) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f0000001980), &(0x7f00000019c0)=0x4) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000240)={'bond_slave_0\x00\x0e\x00', {0x2, 0x0, @rand_addr=0x7f000000}}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r0) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f0000000140)) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SIOCX25SSUBSCRIP(r2, 0x89e1, &(0x7f0000000400)={'nr0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p\xf1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfd\xff\xff\xff\x00', 0x8001f, 0x3ff}) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x0, @local}}) r4 = shmget(0x3, 0x1000, 0x602, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_STAT(r4, 0xd, &(0x7f0000000600)=""/235) write$FUSE_IOCTL(r2, &(0x7f0000000700)={0x20, 0xfffffffffffffffe, 0x3, {0x987b, 0x4, 0x4, 0x7}}, 0x20) 16:06:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="00fba106024ec091348aeec5fecf0e56d1907b4dbec27dd59cdb1af2d50711f28aa7b2e21a013edfa97e3e81f9d0e308628f56ad7c4029feb45752013d1b7115f9a9059db5d417b4a6dcf27f85d61b711e07c33e55fb0636f7319e8504411116d53c41af0d7215c2cdb5758353afa197fde42d991a3dab9ee9741d8a39619037f65968a24d3e82b312e15b32cbc2d376f8f8"], 0xa1, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="857fb84d2293fe06700906a86abb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socket$inet_udplite(0x2, 0x2, 0x88) 16:06:35 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:35 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0xffffff80, 0x7ff}}], 0x30) 16:06:35 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 715.831764] binder: 31437:31447 unknown command 0 16:06:35 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:35 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0xffffff81, 0x7ff}}], 0x30) [ 715.858578] binder: 31437:31447 ioctl c0306201 200000c0 returned -22 [ 715.876337] binder: 31437:31447 got transaction with invalid offset (0, min 0 max 24) or object. 16:06:35 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x200000006003, 0x1) [ 715.938539] binder: 31437:31447 transaction failed 29201/-22, size 24-8 line 3097 [ 715.981857] binder_alloc: binder_alloc_mmap_handler: 31437 20001000-20004000 already mapped failed -16 16:06:35 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0xffffff92, 0x7ff}}], 0x30) [ 716.022887] binder: BINDER_SET_CONTEXT_MGR already set [ 716.035505] binder: 31437:31454 ioctl 40046207 0 returned -16 [ 716.056374] binder: 31437:31447 unknown command 0 [ 716.077109] binder: 31437:31447 ioctl c0306201 200000c0 returned -22 [ 716.108325] binder: undelivered TRANSACTION_ERROR: 29201 [ 716.114661] binder_alloc: 31437: binder_alloc_buf, no vma 16:06:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687780000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 16:06:35 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0xffffff93, 0x7ff}}], 0x30) [ 716.122264] binder: 31437:31454 transaction failed 29189/-3, size 24-8 line 3035 [ 716.130948] binder: undelivered TRANSACTION_ERROR: 29189 [ 716.273137] binder_alloc: binder_alloc_mmap_handler: 31470 20001000-20004000 already mapped failed -16 [ 716.321774] binder: send failed reply for transaction 1758 to 31470:31472 [ 716.339015] binder: undelivered TRANSACTION_COMPLETE [ 716.366062] binder: undelivered TRANSACTION_ERROR: 29189 16:06:36 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom$unix(r1, 0x0, 0x0, 0x0, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) r2 = dup2(r0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x10000) write$9p(r0, &(0x7f00000001c0)='!', 0x1) socket$key(0xf, 0x3, 0x2) 16:06:36 executing program 1: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) perf_event_open$cgroup(&(0x7f00000000c0)={0x3, 0x70, 0xc4, 0x5, 0x6, 0x10001, 0x0, 0x29a, 0x0, 0x1, 0x80, 0x9, 0x8, 0x724, 0x3, 0x1000, 0x34, 0x10001, 0x100000000, 0xfffffffffffffff9, 0x20, 0x0, 0x9, 0x0, 0x5, 0xffff, 0x0, 0x0, 0x8, 0x3, 0x7, 0x7, 0x3, 0x6, 0x9, 0x1761ef45, 0xffffffff, 0x8, 0x0, 0x40, 0x0, @perf_config_ext={0x23, 0x401}, 0x40, 0x81, 0x0, 0x6, 0x2, 0x1f, 0x5}, r1, 0x5, r0, 0x0) mknod$loop(&(0x7f00000002c0)='./file0/file0\x00', 0x6005, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000000240)) r4 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x5, 0x1) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000200)=0x100001d) bind$netlink(r3, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfd, 0x40}, 0xc) 16:06:36 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0xffffff94, 0x7ff}}], 0x30) 16:06:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="006340000000000000000000000000000000000000000018000000000000000800000000000000bc4cba252d2724cb356047bdd4fa95576e96eb93ee", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 16:06:36 executing program 4: r0 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0xfffffffffffffffa, 0x3fc) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000100)=0x0) syz_open_procfs(r1, &(0x7f0000000180)='net/udp6\x00') getsockopt$inet6_dccp_int(r0, 0x21, 0x15, &(0x7f0000003680), &(0x7f00000036c0)=0x4) r2 = timerfd_create(0x0, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) timerfd_settime(r2, 0x0, &(0x7f0000007000)={{}, {0x0, 0x5}}, 0x0) timerfd_gettime(r2, &(0x7f0000000140)) 16:06:36 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:36 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:36 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0xfffffffd, 0x7ff}}], 0x30) [ 717.021003] binder: 31485:31486 unknown command 4219648 [ 717.038282] binder: 31485:31486 ioctl c0306201 200003c0 returned -22 16:06:36 executing program 4: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x0, 0x0) setsockopt$llc_int(r0, 0x10c, 0xf, &(0x7f0000000400)=0x9, 0x4) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r1, 0x10c, 0x8, &(0x7f0000000a00)=0x7f00, 0x4) readv(r1, &(0x7f0000000380)=[{&(0x7f0000000000)=""/210, 0xd2}, {&(0x7f0000000100)=""/209, 0xd1}, {&(0x7f0000000200)}, {&(0x7f0000000240)=""/158, 0x9e}, {&(0x7f0000000300)=""/108, 0x6c}], 0x5) [ 717.095088] binder_alloc: binder_alloc_mmap_handler: 31485 20001000-20004000 already mapped failed -16 16:06:36 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x543679f6, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = accept(0xffffffffffffff9c, &(0x7f0000000080)=@tipc, &(0x7f0000000000)=0x80) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000100), &(0x7f00000001c0)=0x4) 16:06:36 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) creat(&(0x7f0000000000)='./file0\x00', 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:36 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x800000000002000, 0x0) accept$nfc_llcp(r0, &(0x7f0000000100), &(0x7f00000001c0)=0x60) ioctl$CAPI_REGISTER(r0, 0x400c4301, &(0x7f0000000200)={0x1, 0xf6a, 0x3}) syz_mount_image$ext4(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x100020, &(0x7f0000000280)=ANY=[@ANYBLOB="61626f72742c6772700567ded0852bc64b3761907fcc226b5859c9b148d81b3bdaea9d8fcb9a567232715e847b5c7ee5384519331d27c5d1b9a37f8e9b83e4520adcb5f3f224241fde02e990b963d13cb98b59d03414894b2a640be7b9c35af14633c3553d89750363f1a712ad6146d3dbb60cab7ae48226a6017acf2f252de26cd13d218a2037c39e084ce9d606101ef2464871aa966d81d9c04c48fd7bd57b0aff8d1b63c3994ffc84e6dff172d1000000000000000000"]) 16:06:36 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0xfffffffe, 0x7ff}}], 0x30) 16:06:36 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x9, 0x10000) 16:06:36 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x40, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f0000000280)={'filter\x00', 0xc4, "701410effa42e5f0d8ddf7cf1937f16af30bc8f5b172016f7dd4609803589aac46873e5597b1017290b17a372d6252513f029b2a58b2cbc747f91d71cb1f8d9ce4c2945f6727459f774e00866519f7afed0b6ce1087bebc29eeaa4354d421b48d1586f88ca92392691dcc97008c82c5b3f1472038641ef67841d9e388947f076a22f4ef59f48d3505f87cc35ffccdb75c065ebf0ddbe2ad9c7646fd035b6a29fc51c9ae4ba72f6fc64d135dbacad0c1d416e666966ef4e889ec1918f367a4953b0963511"}, &(0x7f0000000080)=0xe8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105511, &(0x7f0000000140)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) 16:06:36 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 717.441803] binder_alloc: binder_alloc_mmap_handler: 31520 20001000-20004000 already mapped failed -16 16:06:36 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x3) [ 717.487075] binder: BINDER_SET_CONTEXT_MGR already set [ 717.500119] binder: 31520:31527 ioctl 40046207 0 returned -16 [ 717.523538] binder_alloc: 31520: binder_alloc_buf, no vma 16:06:36 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x400, 0x0) accept$alg(r1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = dup2(r2, r0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x5, @mcast1, 0x100000000}, {0xa, 0x4e23, 0x75f, @mcast2, 0x80000000000000}, r4, 0x12ef9afa}}, 0x48) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r7, 0xc008ae88, &(0x7f0000000340)={0x20000000007b, 0x0, [0x40000020]}) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, &(0x7f0000000040)=r1) 16:06:36 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 717.554443] binder: 31520:31539 transaction failed 29189/-3, size 24-8 line 3035 [ 717.593550] binder: release 31520:31527 transaction 1765 out, still active [ 717.609381] binder: undelivered TRANSACTION_COMPLETE [ 717.627855] binder: undelivered TRANSACTION_ERROR: 29189 16:06:37 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)="fea9b08a7a0a72c405b3ceaf388fb7638cf3b0345aca3bd69f51ffbf79c9f8c38e043dcec7e49d6f320d0aa1acf2a484a86af57b2a01b97fcbad546bdee6768569773e771e33baec544acf15317afb9f655a81ec08a6863daaceae4649fa080b95ee9a1e166cef2eaf06e54e0dcae0dc8317e19eb383de4f23189807dbe8b4098f9385a4a1499502cbfb8a414596c5a9ff9eb934aca75a0ab9f61bcab16a6ff4c12807e3c3f228f416713283ba7e84e345dd13f80e98953a61bde538484bf1960062718e4c5a71d72a14d6a1bf1243130424aa53e85947b7acf81151a42359963452f19ddb6606ea03687ef9534ac3473a41cacc087e8ddfeac0793f2fff261af5d33965c3e210e8366819a2c9456d0b30352c060690dd84a7a4f44fdfe3b10f8ccc59949b4a7caaa1be3fc9b77e3d13c0f83217b6977563d363e825fb3c4adddc1878a4fb616898aaf4f8cbc988ccaf1e9744f91b56a56fdf75ea37bf260c09fd96ffa58809e63173d3d8423a80d569c132ab2a625371dacc68b18f37fb06e9d8e98c73dfd86d974554566541fe7fdaeb6df5f81c600a95057e10672432c9dbf20a0fa6f607964d129e42faff1f854a6dd5c455b62d5c8414f8c1c2fa99dbe63b25852cd119ecec64804e3ad4621f5e252588063a801df5d09848333d399d3c07ed2bf367148ff88afae5d4d88ade4697804c56286f4b2e9a00bde8ec2f7a8e0e50e82ed5750bc92b5417538ddd8589b83ca4e0e0dc968b9d33765d434aa8046eb25fd2a7c9228472593fef4acdec3f35de9965d7d551e34fa2dc24c0b4975bd71c7fdbc6c2afd25bb5db8c16979900f815c2ed81838c566a3d54f2aceca8ca58ce22be038d1bab22ae2522c6768999fcaeca5a6fc4e085827292510b3243636dff00730e00c2a3e7d60a5d81db80af54cd64b775995839449ac0354cb884e8522ae4142bd74c5ee0d49342e220d22e3574f7184d7c44401bc1e48bf4072b1a3807f4dac1a65c0b8afa46ce8cdb755efd1cc338b0af681004fd872923896caef1aac92a4fd083e9f05bd98ec902e29ddbc121d89ac11e48efa5c5973f477ea06e9f6310485064629fcd8377667112bf6c2149f7c76aaf6d86108d609e7f7486eb2acaf13a51b4c19f73d5356f865eac281906472bef80cf7c83aae412a4632092277c75ccddc0554cce9b2f6f84fbd29da1e9875953a29992d4f50b8b3cb18fd4327a86cf926cc2be83df1d381af8d9ff85d5284fe112c34f16fe050678861566564266a4ec6e8143c13b4ad04946045c9f16b60a83639606cffc069accb85cc8cd725f19de32032e3d6589bd1867a37f9623ff6ad1462cd4ca0c5268ee29cfc435197f2233adb813f3041e0bca70ec4ce432562e328028743c897dca93c44e488a90a2101e47ae645b62c928a263571be7a3e68a5966886701c3fec192ded5a7eb6818e0300f31e7319fc4b6c491ec7533f41a3ea5d4795a618f7e1042574de4f14e1a10b45713edd54b61c2bddd99ab7330057158478459e8a7126e0dc36699540c6d5bbae80aca6258836ef1eafba0df7da4e5180c5a560ab6885ee913092385cfbefc641ccdeeaa2883e811c56acb78125b62661e09f635e02368e01f668c5e577df17166841c8e0548d2f2b7bcf400bc193cf6d0be2420e6fcfe68a41d21db7adc79ba56be4ce25b129e33cdb0728abaf3e3a5349c408230127666e2c072a155268c867c68dafaecd3c9f288267e8f8f894402b9302aa54510514f2edeec4d574157f0d567ff7f9a0b594a42191bac42053c68578c482490af81ad8ab68100fbcfbdd6b8465dfb43a51e93c1134a9e04b69525712af3cbbc94cbe1dfcaf4690eb5c09bb05f74a1301b5986a1556aa729feca79c45c1074ff6eeb2e6ccf44759e80d6f54137df3377701551aa9f27bb2ca72f7a03d7b08ff998cbed91599a04f0c6f54a7bac28d9811df971a97f2b6c7c9629acd2a3de7b0ac7025d97b09496694dad1628be7dcb6a50a9c78d477f92a5836d7240e308c77318ed36134ae3707588f7fc4c1c8cc0505680fa3a42bf0a63d4301b54e89341ede74e50c2a1e3ed118a864f68f31f1f9f682c6e3fe14647caa5089e4acc7ed9fff34b5007ee7cc0f53475b284fdf266f0155998538b7d020362c4bb87dc37fb8534d711a70ae68d0c5be46e6b85c9aeae4ec7e9500a4da40066a103038d106a4eab9447628548631e26ea43dd841ef8eac85f3cce2bae26c03ce841c3259bfe1ffaae1ed4e9dffa4a3a1c112729b7733e27104e8688b6e75b28d93c7da938a2313803f427528b90d40dd83eacea084f53af5d5cd9078c8f1e2e6bc9c4d60db758925f50be8d7079878c4b81c0bf7829ddcd84e0f64324c59cdba5f49b81a624ded95e6d2d279c8c00013e557d0a45614ae10ad831b32961155ba10457a2274248af3f93045ec78ec960384ce84293bcc5d6f813bb8e19f54973f1a4585e28004308484bd5cb409ec5bc166e23675b8421d2e6030cfcee38da312a4570a81ed862ee7dfeb57467f8df7d1c1a79d3bf930d2467a4c21995a081ef01190aab07f9c025b4aaa9c3aca3cb8cec1d6bde88fd3d189e1c6de115d8ed6228a373072a63083c178e1aba780567182dbea9c2a435097845f137f095220086a2739d704e4823bfd59b050789b1b719ff9283daa47c484fcbc40771f18f46693249699fb6c5e41f913c27cd709b45dfc91c2938773ed3b21900a62834997851060fddd0347797c8fcf1af3bb9c24572d0e72c7bb41e95f32b080c55e3c9332f7b422d2d9a3ef915ce9c31ccb719270aa51cb07f7ba9604220e8132fca4325f30c0bf0c7be9d83c73390c44f258243f68a1962d6299351eccfd693555ee521322f57522c2ece9d0f08f94df06c64c0d22e7662fc686e2fe3e8b840747fcacc0f9870030d15ac7a5b742a45a607a62b073e6a0c2acba762ed94f48cf00b7748d42b37eaeab787f18968a50be9a10a0c6215aca0656e1a7962d46b1a98bd7c672cd3b59ae0be2a6ae18aedfc1d7ea27ee4f50ef9671efc96eaa826a652ac8918581c02209444f328dc972e4a50d510b530ac0fcd8797a18e445b5f68d5f431d72d218d41c536963881d0edea86237fd394632d399444729fa817827a662314eb1faf4d90651de65798e7525b97e5b7d60b6e282c357dedee5672a8a3be5cd64892d369f2bd37d43bbf93df7683a952d07074ccca68f19b6b08a72ad3e915c15de8eb259b09fb076caf5afdfd2fe15ee76088ac62978d78afa7e73aad775281bf61d68518893fb11d6f77ed160803492b055c80b296c9da83736f2fb95f9c501a1dac97c9352b0eb0ab3869bfcc8ed0335e434f9e456fd95ad78d75a2f9227c3c37a88554be3ed009f6618ae081909df984474d885a73cb4fd1854d0791be009180fd00ba0161de224b9552e952f57716057688e0a891820bc6f9040f5f28c273ddd42017f8eba0dda5d3751ae1db5b4905ecca50e6fb3f0f7e7308de7fa823067608019d87dd673275441c890317da2deab1322835e16635235cefc44d272c210855d7c8e3fb620c7f9399761459a1b612affda269fb0a8655c03908ab1d22a4d680519dffe0886467f957668cab5a342dd017a04f2790fb97b86652e0f8158e63a2b5d9fcd6878e7e4418076491798b657e860594339ff33e588a1ce14c293c37104c4870344da1b703337fdee1df46a4370e6df3c87cfb8081ccbe1eb2b00363b6957bcc130de862d1da660e5ee24e6aae0b82bd2d6eb4f2aea1ff5f4c5dad92f44b5a9e06ee26c3fccbf30e37ea07d0ea0a2a86a9c4ccb63f2143f4ca3e4b423c60739830830c746c04eeb16a3425888a748685126403b210ed0ed85d43881cba86aa0e1065219a6c6f265c222608fb850269bc837452db9bea6f368c30334aecd1c66d290942cd51a63f9a5ddc5dce17225f5f8589a668dffb6f6a4530cfd7a0f0c2d800348c5743aabf2b2af1b70704b9e6e1717f317be974bd89a19679e37b617dbe367e28e3ea14fe3898cf20fc8bcfeb57eac4dd0026e7d7633bd90c5fce70443c686f5e861dce0ec6331c9ab004dbb5390c9f5549e1d71c959f3fc832cad21768fa352c557d7ffca07c99108b0f182c0845c3b5d09d7e52b8901d4424f0c695c16e4bdd2bdfc5aa03a877630912a7e224788a6196f3b52a8f5e5108b367b4405694596f0420ffeed1c5fe9c8e91daa5e3718a5b99ea0efe102da66cce0edf33c5561b5a643df06e9f7557c7cf6943e01eda6036a6e77300e55db3a705fc3f03cb9ba6bfe82d843d65ada235a9d2cd7a58f034cf3bd16105685dd0ba31ee2e1a4a00632f79def9dc4ac58f36bba1f1d6bd1810b3ff60212a684f3068c009a240c349a3f575987377d564cf812b16a4965e246ba185d3af612564b9d775d453b3e7b9f644709a9cfc3005f1ebbb5c71da4046efc41fbf25792be8d7f31a02a2da95c270074fa04764c8efd46c984a6b223ff9f6cce4bccf60f4b50afcb341e914038fd342f9e9a4e3e3321c82c3abf55bc860628935b5fca6f62ce5af74565b1816711a4165ca73930b6ea5f63fc2d4a708d290d9f1d1de1da082c86153240da7b9f05aed2c74501c5cf37c101ad9909c61330a0e09063d50bbfd22e9bc1ac4e1e70d00243372da8138cf6483921027c5ac8f675cff09707907a3f9e472094665aadbfca93b40c013709c825944a675b42dae03154067ecd13a8d4dacf0424c00e72239aa1f6e867e4c8e572cedc2725ec4379c7f905f07a90405971a6efddc11bf686738f32c1249be02c287ee9834b338705f5f236b09074261d4c88cac1f4ada75d24607c97f51a41d9fdff7d4e8834b15f3ecf0c35dd1065f69b7e8f9c72a58be22dab7f8bb07f8c3d60788832c40fec76dd468e1c0081ebd3e7b5133ef31c437bfe8a703c3c2da12c795b44f0b9425b6c763233de708334b36d7c111da3da23dffe65670cd7f9a3a9354706b5115ec7da52a8aaac609ad7a38a100e16e510bac1035edcfb040f933602cfc64fce959726f9717e89c69e08ad718ea46507d5a06fe6c7cfff8423e054088764caf29d7343695934a3ed0411609516723da3a0a4909675330d68b4791551d1533236bda4759e091936f6cdbff365d282cc63df96bf784ad159c6d57a73a40ed3b773501f438a30a55327aa68fbcf4761db37eb49b9fd93d1c4853ccd197906a7d83dc63eb28d2a629f4e7a0d5855fe99a15accdef0a6984643b3235d6e095ce8c90264fc45fa7ad6659e16cb29b4bdbdb3614f9f50bde6e05ddf00d10a9fad8c20d3078b3fcdea8cd7defabb106e2985629a15695bd16046aa2aff807b7cf212d331937980ae3a326d0c234a43746955a8054a5c0bf9e132f8eaa3bc9fcfb4cf63c37b26d3645ebe975a66ddee2d482577c135b73b3d4618b7ca8d7858017dbbfed5950ebe0f03d5b1d98c4066693ac83f4681931226309e4669bc4be27232af7c03b6e1557136d908191886a7b1237da140b78db6b8c526b15a73b4083c86d4ff273cd61c7f78d1e8ea410518cac4a33a12211fd9d74e3cb69a21729e8019aebd2e02db7b1df4129ee82e11a7d88d2b77d6afe9c9548402ca84076f70272225cf8dae3696f9bc98c0e3f38ccf04e92ab9d508eb6fc53d4c0b018e32f3a8ae4108f6e8459542f4a780d2052e2d835a6f70ce8a54bf903a8271e210c4b91feb680da75b64a82aed9623ca80f61bfa0c8e8578bd75972c2dc5e2dc9850aabbfc9c29a7f1c13942880d437ac677a454e2e3c27006e7156dd49aeac4fb9", 0x1000, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$unlink(0x9, r0, r1) [ 717.655607] binder: send failed reply for transaction 1765, target dead 16:06:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 717.708038] EXT4-fs (sda1): Unrecognized mount option "grpgÞÐ…+ÆK7aÌ"kXYɱHØ;ÚêËšVr2q^„{\~å8E3'Åѹ£Ž›ƒäR [ 717.708038] ܵóò$$Þé¹cÑ<¹‹YÐ4‰K*d ç¹ÃZñF3ÃU=‰ucñ§­aFÓÛ¶ «zä‚&¦zÏ/%-âlÑ=!Š 7ÞLéÖòFHqª–mÙÀLHý{Õ{ [ 717.708038] ÿcÙOü„æßñrÑ" or missing value 16:06:37 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x20000270) 16:06:37 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 717.867691] binder_alloc: binder_alloc_mmap_handler: 31555 20001000-20004000 already mapped failed -16 [ 717.924511] binder: BINDER_SET_CONTEXT_MGR already set [ 717.953963] binder: 31555:31556 ioctl 40046207 0 returned -16 16:06:37 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TCSETAF(r0, 0x5404, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$TCSETS(r0, 0x5403, 0x0) 16:06:37 executing program 1: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x141000, 0x0) getsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000080), &(0x7f00000000c0)=0x4) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 717.995628] binder: send failed reply for transaction 1770 to 31555:31556 [ 718.035282] binder: undelivered TRANSACTION_COMPLETE 16:06:37 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000180)=ANY=[@ANYBLOB="01b57de216838c39e54ac23f00000000000000fcffffff000000000000000000000000000000000000000000000000000000000000000000"]) [ 718.062981] binder: undelivered TRANSACTION_ERROR: 29189 16:06:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = creat(&(0x7f0000000000)='./file0\x00', 0xc) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000140)={'nat\x00', 0x0, 0x0, 0x0, [], 0x1, &(0x7f0000000100)=[{}, {}, {}, {}], 0x0, [{}]}, 0x88) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:37 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:37 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x14) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10002088}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r1, 0x408, 0x70bd26, 0x25dfdbfd, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @l2={'eth', 0x3a, 'vlan0\x00'}}}, ["", "", "", "", "", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:37 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x8912, &(0x7f00000001c0)="0a4c000240316295717070") r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x180, 0x0) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000000200)=""/120) setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f0000000100)={{0x2f, @loopback, 0x4e21, 0x2, 'fo\x00', 0x12, 0x9, 0x3c}, {@loopback, 0x4e22, 0x2001, 0x0, 0x400, 0x537d}}, 0x44) r3 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000080)='ip_vti0\x00', 0x10) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendto$inet(r3, &(0x7f0000000040), 0xebff, 0x0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) [ 718.285030] binder_alloc: binder_alloc_mmap_handler: 31582 20001000-20004000 already mapped failed -16 16:06:37 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 718.347320] binder: BINDER_SET_CONTEXT_MGR already set [ 718.355016] audit: type=1400 audit(1548777997.701:151): avc: denied { create } for pid=31590 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_rdma_socket permissive=1 16:06:37 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x5cf, 0x130) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") r2 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x1, 0x2) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r2, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, r3, 0x301, 0x70bd28, 0x25dfdbfe, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0xffff, @media='ib\x00'}}}, ["", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f0000000000)=0x49c3f0c0, 0x4) setsockopt$sock_int(r5, 0x1, 0x2a, &(0x7f0000000040)=0x9, 0x4) sendmmsg(r4, &(0x7f0000000080)=[{{0x0, 0xffffffcb, 0x0}}], 0x40000b7, 0x0) recvfrom(r5, 0x0, 0x0, 0x10062, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="d25180e920faa70ae231"], 0xa) fadvise64(r0, 0x0, 0x3, 0x1) setsockopt$inet6_int(r0, 0x29, 0x7f, &(0x7f0000000040)=0x6, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2, 0x11}, 0x1c) [ 718.392814] binder: 31582:31585 ioctl 40046207 0 returned -16 [ 718.396218] IPVS: set_ctl: invalid protocol: 47 127.0.0.1:20001 [ 718.449261] binder: send failed reply for transaction 1774 to 31582:31585 [ 718.467509] audit: type=1400 audit(1548777997.741:152): avc: denied { write } for pid=31590 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_rdma_socket permissive=1 16:06:37 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 718.511235] binder: undelivered TRANSACTION_COMPLETE [ 718.515805] IPVS: set_ctl: invalid protocol: 47 127.0.0.1:20001 [ 718.532537] binder: undelivered TRANSACTION_ERROR: 29189 [ 718.613104] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 16:06:41 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f0000000180)={0xb, 0x10, 0xfa00, {&(0x7f0000000040), r1, 0xffffffff}}, 0x18) 16:06:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00@\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 16:06:41 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) execve(&(0x7f0000000000)='./file1\x00', &(0x7f00000004c0)=[&(0x7f0000000080)='ppp1ppp0[vmnet0\x00', &(0x7f00000000c0)='\x00', &(0x7f0000000100)='\x00', &(0x7f00000001c0)='#--mime_type\x00', &(0x7f0000000200)='}\x00', &(0x7f0000000240)='@vboxnet1+\x00', &(0x7f0000000280)='vmnet0\x00'], &(0x7f0000000480)=[&(0x7f0000000300)='\x00', &(0x7f0000000340)='eth1*eth1', &(0x7f0000000380)='\x00', &(0x7f00000003c0)='cgroupkeyringmd5sumwlan0{-GPL\x00', &(0x7f0000000400)='ppp1\x00', &(0x7f0000000440)='keyring\'\x00']) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) 16:06:41 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x22, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000, 0x0, 0x2}, 0xfeda) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) dup3(r1, r0, 0x0) 16:06:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:41 executing program 4: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) 16:06:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 721.951147] binder_alloc: binder_alloc_mmap_handler: 31616 20001000-20004000 already mapped failed -16 [ 721.981411] binder: BINDER_SET_CONTEXT_MGR already set [ 721.989025] binder: release 31616:31628 transaction 1778 out, still active 16:06:41 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:41 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) r1 = accept4(r0, &(0x7f0000000080)=@ethernet={0x0, @remote}, &(0x7f0000000000)=0x80, 0x80800) symlinkat(&(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='./file0\x00') r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-monitor\x00', 0xc0000, 0x0) ioctl$BLKBSZSET(r2, 0x40081271, &(0x7f00000002c0)=0x4) syz_open_dev$mice(&(0x7f0000000240)='/dev/input/mice\x00', 0x0, 0x40) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x410000, 0x0) ioctl$RTC_AIE_ON(r3, 0x7001) sendmsg$nl_crypto(r2, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1480000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=@del={0xf0, 0x11, 0x406, 0x70bd29, 0x25dfdbfe, {{'sha256-ce\x00'}, [], [], 0x2400, 0x400}, [{0x8, 0x1, 0x1a0}, {0x8, 0x1, 0x9da6}]}, 0xf0}, 0x1, 0x0, 0x0, 0x40}, 0x8000) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) [ 722.004006] binder_alloc: 31616: binder_alloc_buf, no vma [ 722.012481] binder: undelivered TRANSACTION_COMPLETE [ 722.017971] binder: 31616:31628 ioctl 40046207 0 returned -16 [ 722.031621] binder: send failed reply for transaction 1778, target dead [ 722.038659] binder: 31616:31632 transaction failed 29189/-3, size 24-8 line 3035 16:06:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:41 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000080)='\x00', 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$setlease(r1, 0x400, 0x1) fcntl$setown(r1, 0x8, 0x0) ioctl$KDGKBENT(r0, 0x4b46, &(0x7f00000005c0)={0x4000000000000000, 0xff, 0xfffffffffffff8e3}) execveat(r1, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) listen(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x20032600) recvmsg(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)=""/243, 0xf3}, {&(0x7f0000000000)=""/60, 0x3c}, {&(0x7f0000000100)=""/63, 0x3f}, {&(0x7f0000000300)=""/9, 0x9}, {&(0x7f0000000340)=""/35, 0x23}, {&(0x7f0000000380)=""/130, 0x82}], 0x6, &(0x7f0000000540)=""/73, 0x49}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x7a0f, 0x1700) [ 722.079069] binder: undelivered TRANSACTION_ERROR: 29189 16:06:41 executing program 5: r0 = socket$inet(0x10, 0x3, 0xc) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000013c0)=0xffffffffffffffff, 0x4) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x100, 0x0) sendmsg$kcm(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000080)="375454eca173494498dd28b0673cce9fb45531d3c8a2f08860b16213eb322bb002b9e9e6041fbe714a25c45bea5a6d66833cf3b2578cda377554a6468abd54bc0572e49410615781f865f6d52aa63ad13b0e6098b178a6fe1f7edc5b4be5c0d1ba8f98bef0b487c856b1fba8ef291037c82524b0cc0553f2d2e87b00448244abff9b926b0a958ec3b41fb5754ba20ca4ce56e7136592c3249821f5becdbba88cc8b9b7863ba88a1d57829b26e2b137e1fa379178861abb32382c1971f0cb4800f58557a1e021f97c149648b69cdb26fc5026c14b05fc3a42dc2e2fb93d1e1c7d", 0xe0}, {&(0x7f0000000200)="e84e056c30a8ae6324e43a6088f28a29540b03c07bd17008a7e75f112c6a74c35fe5d78a380ffbbaa4826b8292ff15563e", 0x31}], 0x2, &(0x7f0000001400)=ANY=[@ANYBLOB="d000000000000000000000006d0e00003dbb82654a7aa6e4266828bba1b365aa91f8b180054525dbd106653fef8d2a3d1e9f0bea140063760fc05aec79eae8dfb5d231ec77b8bb04ff21147d40e15a01a7e123233d6ca0589da793e23ba73699974c0b174b61a5ad808ece1b830804688d361c27134636af30ddbee89b844b33fbaabe45b96394c36df8627d6895a3ac24ee1efa35644efaddbabd61865dadf73d4e543a7849135577b0c7fedf516ddb937fa59c22a80ee72e3535cfc9f1356fde50e9c88d87c0a12fcd000000000000101000000000000014010000050000009b184ba07c620e5ded5a8cdf4fe5d67ac257fc27219c48144757122fb3cfb4b84083b534fe092fafbe911c2c845f2d9ca0e958f753573b832005db8673442f22624c03d9fe08d2dc80df2f097b77d1d1ee39c301fc53ec9ba81258aaed33f4f59db8c7d2d91dbb6dfefa0f6d817a26f2c7dbf2eff3ef6d2e3a24cd3ed581281c768455e06c6c3cefb43196132eca49d1ab83eeceb443cfd344e5f5911c9db70a7d6170260098dafc349ebffbb6c01a11549d68ed7c39ee317bed0e68e0445c013f3e1f5969ee143333b977f63b5d9c941d1ab440a946c27b8f1c15f66ce7f2d51c902a45bc44a1c0ffc704761da899d2986f0a240e2cb07ae0cf6483a07973dead7cad3c35ecd1d9c496b0f439d9a34acd3339405e4a1eb7eab51344668b8d609819d9974d034d7ff6428fa3a83aea70eb78afcea6efd578b0b41774cd65802718b57fa1adf032617f702b9cd278416a643e7b32933b26ef59cfc560f2c97c3d0297e72726e18e4c239a9d81fff936b4716f29cf7ac17dcc99686fd2cc6651b02ad7d7ac94765af0c13a39247c52dbff37f7d5be62ee098d479e105050e94caf1c262ad2f41d6b8a75f84ba022154f380fc2874cf807fe19ebc1c9fd1a55cb04265401defc3c93daab65d6ee1eb2754879f8fa23598a0392731514799d1d81bfd189ba0cdd51d9a5b73652af8eb8f309217e35d7c54b13bd4308cb6d0454c5c0e6dfa5b955ecea9816641a987f4b37b997101171aa2e4e4f425a395d1827f89d7f3181341e19087f3d47630b82b4dfc8d9e22d2f0ffdcb4c5e47af6a3727df8792938797fddc24a441a2e986521e4e48b49f7520d17b10fabc8c969fac5921dc82afdff895a2991349e6ae1545c8433f94febe08c36ef6d6a436c95051b3b2773826a327d9aa713c5eb594f431fa02f29a83ce2a04cff97af59cc0ad69ac753e4c3ad1d3c635ca896d76a78bc821ba3be8e0272626e1b8139dcda238d3170aedf1d7956169b375fc14fb2f4a77414893e01843f4cd6a6bceff78a4ab6f46ceebcccfd966909579b7c30a284244e7ee2d42bf586e4fac241e8aacc86f4c46c3706b91a53670a047475c0304812d1e65195e4ecc21f3431e658625cdfadcdb4c77f7b7697a5fbf618209ba5075bab5bc15b734712b7ae194989b533ed0f3748afc580328e973b1beca1363becd13d0fa78f69cb896c3ad560473a5268affc6fcfcc562dcab0ca355d4916d81d0794fa3ee10bcf03e43b45983c95d2b14a0d329dc596d950c0c11eeec1833d9728a3c239df0e7f54a16ae2221f075296259b1211ba719257c1b363178eb20399326ab17da7dc86d640fed24245832d79a55455ebcd2d0074d07b42edbad3a4fa1310acb7c5c1aa70f23e77f0e6483cdfcb1c9f2736bb8c4d76a275a2d08399d21fe4b4605e3a28e3c559923c155d45b792b90960b536c924d8cbb379916d54dea849c7ed333f3dd9d3e6eb9330925001fd7f9238b6d5f2dc85e861ec9cb5d13ebad5124c670f1dac3046351d5981d33ed923b748d9f72404f7c54864cceee02cc88e67eab7b8edbed34876e02d2dfd0c221d890e0579b560d82ae466d698e3ea5d5377f940cd6d387d95bf2982fcbca9af871ed232091f10f574b3397ca2d68adc9809b02be869da40ad75e4d34c89e10996ac3b530777ff3263b5264c4d9fc7c80a8fad6bb1d39f6f82b31ed0581c0e6ec47889a8a5cc00307a8006d0b06481d629984f3ba91d9cbbbfd8ad212778aa155e38203a3004180b99423dec4f978fff6b4bb8cf63ae3c8a763a24fc9c9e607ce738a9240b47555711f229038fd60239ae6cc7fec7a93b92e44cfd567b80d20018f896fabc8544751b36ace2e386f7760208d03a3b153fa32ca541d42700883327b3cf19549586b597e1a15dfc05f77d48168b74df8e190fba17211f8975d4f124c57e93d21c54b8e7cceca05d661fee086f1ee2f24bd4950a113cd9236891a8022af774b765033463addfc527f40854fb487a45792bd6cf0ece3cfea08fd5b22537df406e6701055c8a172b0f295b1e094e2b952e80e43a17d3fc60aea64fc427ca4bf3898c846994e00c25b86513935903698567b9b04b7602ccacb361be8f18b75dd61509de6dcaae9a306ebe915dd788072eb994a582edbb61353ee5bd1b117cf63a51cb6feffd8db8d70035c0db2e54e075aad19854295447bc30f98b568f9a29f50f4c89a6e5d207d0fb75a3f2bcd0be58952d7772fd1c2cf51fc3520405293f8bc6889bd228df75d56df9107ce79811f932485ad047d4070e93a398a086b8dbc24e0466d4c333b88e74681e2eb911f8adc1bbf03ba48afd8ef06f538f803125f4e5cec1cd06f6adf2aa622366ba5e81f6825395596980f7619866dd3c0c442271798e139c07739b2bdedd58542a0fff882e2d4a598c4cb745181b5b78971753a55a8f691f1e8eba954488f3933c210b0960b1fa2a18ce62f8d25214aab23b4562a488af34feaf8f7f734e4e4698c8e3364fef5a7bd3af71e6ca4fc837fa12eb1ea6a8c709381407aed4f6adc7aabed8b81df12af2a31c6e10f30e949543a7fd8641bb1202e42034f820b2dfa4eecec5d302abf8498f92f32f59a59af22add0afe5cbd3910c52af86c8cafc2bd4fcde8a329f313021c4ddc0263de75f7b580bc1d40879f6cd270d786e495dd471d5ea7937b79975b21b08a341f46683717400cb53316210b72416dd115e7d55588507b610a2571fe6248cac4f332954b1a8967e69c19192d4b1adee3678fe4254297b901ff828dddb3388324a1a3ce7d29a8a3d19482d6221668ed14ab280963e7b60a45e13f2473205b57edfdd62105be2395b27e73f66dc7f8839afceaa70ff32c80be9e7b47be033b9e200f4900638e680941ad50f4b705fada7110255dd18615b819af8ae2deed3484a64514cac591f6b26234925abfd2bf42168616a1fda8bd3d653ff1f68815a0cce859df41e86c3ca4eaece109c2e829d351edeaf3727a320bc483023026cc2660274249bad42a46083a6e99d3109fd524dc4834a9a45c960666fed8ebb8c11a2d18806ffc5ce13743a6dff5208d2d299175a9b3492507d5a8a1d2ba992e179f468da467fbea7ec7dc31e9a5f79addd82e38ce13bf8cd33c829a3ee6f961014219729700306ade1e5a0706566751016bc6f78cbfc2778f1246758d94be7aad03f7dd73feb789950daae014b2fc2b69ce4e0240114ceb54402a281603dd5feecf5a1bf1ca16b354159dfa3ca2175f219e677d0d57ad2a737df0376ee7aa70f3cd3fe29c6b9df4f8d9bb129918a9f15d97c9d92f38b7f6e6acf023242ebc637e35b814789ab15428ee2fd1edef26f53795103026a825daa14f72f4ca476cdd725a009da1a622fd856550a27d4a1b783ad3c5452de001659302fe163b898c862d0de617eadcd9fd5c4a1c482200dbcfe8f6025ddb5014db2bb71a5642d84eb0101048eb2b44a5740212d4055f1bcb5e49000bc32d67154bb8676b06250ca813e8a9ea8207341b651d9f59c321ce53dbd1e8d8fe1864574dc985b1c570ada189118bafe64df4e6e9c79bc7898bbe9030cc1ae51dc559544fea107eb50586a15e7424834144e56c6764bc36b6313f31187acdb2c1abd5ef695b1d179d8cca7fca87b4b30910cbd4c6c3174f84ba4519b0e9e0d1db1a95cf75baf31fac41bd8bca5cb575c7bf404e762a8c6f7e971a9c846bf1d0a50f2faaa470a99cbe5d259d3a30d5c51f89271ba442ba911045befe72d84cdb10b2ff87a9033d7ef03d5028f8accf7a1a59e8b5a35c556522b886495f356f246c2e8cca72aa89bf5c4a1888f160b5ee6c2d1d387117d09207475c9b36d9e37236d62eb72fa60dd757079f329774b9374e0ce83b4f81b0a1d990081d47e90d7622b6a0e867fb140648ac0d7724e60ef1596e04c138850d2c91caa13adea2a30159999719fecf603daa3414dcb7d002988975c143d307c652585b0d217f26926d5154f4624f93f75665ad3a90326a843049d1dc40cd87b5142df3e41b81365ebc3fc8e34363e9198cdd1978cfc6c4d1ce45d9c22f648365e3345f3de8e5889ab7c5e8fc2b92c644a47572647a8b43b61dc26f25e2feba1ea3d9506474cec8a842c26726518f2232f20007e02ff230082f678c40f47082ce401818d75176907698995311efac405c78895174f9c794ed83acf6dfe0e350ca6b9d3b711dc08670e6150442f7e9c09ac55c4ea43a0d80ea7113dd091c3c9506a044a113077d6b49fe653e1e4dde527fc6dd631c8e3a45cf2560ff909e34b2175c285987cd601af85cccb972effcefaf637f6a09514aeefb8e3c9e4f0b1c0193659cb5ff7315b7dbd5b5f09b0cfc3a72cc876503210a290124648560597fdeedca78340106621b438248be292a1a43397a84cba56d3d0cd6350a24bfdd0affb0a3188bb9b98bd1a9ef939f2e120974f21af8bb008c5d1a1bebfcab5553905f0d0ad5b4b38ce548f677b9a85e8f3e0bd1ac20a3d03f0c737bb1638e4bed24a671c7bc5521a119d301e34a0d4bc6af63a27a91d59491ae3c063e47e991881a28afcb1fa3edf955c9658282cca184519cfd78b8b2c8ab4e964b906f4c1ff73aa461bb0b1b4d27025a6bfb341354b22f7a0406dda4ca1ba43cd554585df3b19a23c7a27f53ac7bc3997a3b43fdca0338ce6163a640e2793e16096489e9e1e3f7cd71a6aadbf5302b3e6122645b457eb119d8fa6d2bf886f7deff29e29e2bea8eacec4c5c8f725b0a17af23eb057dc85493e5366685bb25ec711cace04d8f51af177fcb4525f6741fd01e3fce914eaeac7b3d5ad73d5861899e6a336554d30129cfd75a7605ec8fb2ef776d30e11d94e787b562b81044f5f77979404995f92c06f31fff9014cf51755b2fbb8a46c1afc64e334ee13514e865eba157bd0c2ca04a1556d6c9cfbe7a2a48e3dc274415345e5edd254d841e694d0bd737f1a8bfa04e7040d6d91d378763f6d90e07959daf197da661b2fb4b3f671a79d3877517d534fdca1c1fb4f640ac2ad57ea76a4da001f69c50f3e44d7410a11d173223debd64032a0eaf175ea2ffbefc1e68dce1dbb49292ddf55f0602c105bf750f6d778203b7ca2d9b803365e231cd6467f0ec0a3d0e63b9bf691daca0d93d00237b93a28a6be00d8fee431b40e4cde956532d7c314e7aff355e8741530b6e4ace1d9c5ab04fd0da10c6a07e2955642023f051df4b9c8c5ebf8926e6a8c403dbf2914a9d73d5422da6b916b7014afbc1fe72b0036f406da4cb3571fc6e4b8039d03a23dcaf76e14bda9aeea0ba1fdb34f6eb2e26253c304f91ca5c0b944624e0877c97a5935b69b2d9f11103b2438390e05037fdac101c718ab95c340aefa83c9c4372c2459b3562b6e49c551278fdc3d0c33bc738d7685be1a446947cb2592d5838f257d8a1b1bbf4e1eda34d8633afd3d3b8304a518bd2b167b2ad394b4f6b5a88c42c80164dade93276185d3d00e398641fa70c07bea7c2559be7a2c78615b25bb2862df4a0e31d6bd4d1461b0480fded7edc70ebcf864e625781214a4957c348472549b2f525cb2a8ea27fc42dd2a6138c4d74993a4df6195da84d288f46ce5fdae07c27e8d8de21e4310e47e7eee160699f21590bb8b351ef03282de7ec0f7dc45f2aef1bb2dac1a981dc7c7b5ecb2ee8c047dcd1b889330c683f24433099d9fc47e5fc86a6557e5a1efb1ba355d195018f3d48be11c31ee7087d2b83dd26d97c3ee0cc1fbc864a0ac18f3a9b22835df3490088da1697dbcd0240c3c0bacffd7385dc9fae3223f6a09b3864fff8ff26a4124956f0f827ed9a268800993471ed22d7008868a03944a4d623ce5cc8a6380278362d7ffffbc47cca4594d76adff572632236a4cc9ad2df9aea6eadad0557302d68b224b5240bb7dc80ea74d12d5fb83f393d301da59ff53eb"], 0x10e0}, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000130a07031dfffd946fa2830020200a0009000300001d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0) 16:06:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f0000000100)=""/11) [ 722.194500] audit: type=1400 audit(1548778001.543:153): avc: denied { accept } for pid=31639 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 16:06:41 executing program 0: r0 = accept4$netrom(0xffffffffffffff9c, &(0x7f0000000040)={{0x3, @bcast}, [@netrom, @bcast, @default, @rose, @default, @default, @netrom]}, &(0x7f00000000c0)=0x48, 0x80000) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'veth0_to_hsr\x00', &(0x7f0000000100)=@ethtool_coalesce={0xf, 0x400, 0xffffffff, 0x222, 0x8, 0x0, 0xe9b, 0xffffffff9aa43009, 0x80000000, 0x4, 0x9, 0x7f, 0x7, 0x1, 0x3, 0x3, 0xfffffffffffffffd, 0x9, 0x6, 0x6, 0x0, 0x7fffffff, 0x7f3}}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 722.314119] audit: type=1400 audit(1548778001.653:154): avc: denied { setopt } for pid=31648 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 722.361898] netlink: 'syz-executor5': attribute type 3 has an invalid length. 16:06:41 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) r1 = syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x101, 0x280000) ppoll(&(0x7f00000000c0)=[{r0, 0x6000}, {r0, 0x4241}, {r1, 0x100}, {r0, 0x2000}], 0x4, &(0x7f0000000100), &(0x7f0000000140)={0x6bc}, 0x8) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0xc, 0xfffffffffffffffa, 0x396d00000000000, 0xeb, 0x1f}) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x2, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:41 executing program 4: r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000200)={0xa, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r0, 0xc0305616, &(0x7f0000000000)={0x0, {0x100, 0x1}}) r1 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000040), 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000100)=0x78) [ 722.414614] binder_alloc: binder_alloc_mmap_handler: 31660 20001000-20004000 already mapped failed -16 [ 722.418979] audit: type=1804 audit(1548778001.743:155): pid=31661 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor4" name="/root/syzkaller-testdir756555719/syzkaller.53H6uT/26/memory.events" dev="sda1" ino=17241 res=1 [ 722.435356] binder: BINDER_SET_CONTEXT_MGR already set [ 722.492510] binder_alloc: 31660: binder_alloc_buf, no vma [ 722.517802] binder: release 31660:31663 transaction 1783 out, still active [ 722.531334] binder: 31660:31667 transaction failed 29189/-3, size 24-8 line 3035 16:06:41 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:41 executing program 5: r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000009400)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x5}, 0x1c) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000000)=""/126, &(0x7f0000000080)=0x7e) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) r1 = syz_open_dev$vcsa(&(0x7f0000000240)='/dev/vcsa#\x00', 0x5, 0x101000) getsockname$llc(r1, &(0x7f0000000280)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f00000002c0)=0x10) syz_emit_ethernet(0x8b, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa9100430081001c0086dd601bfc97004d8800fe800000000000000000000000000000ff02000008000000000000000000000100004e20004d9078e29607149378d33e1db1c73936c77aa3f7fac33b042bd368236862531934ecb1c373d6ea51369e92fb96cc7c6fe4e24d1fcafff87429e50b32881721afab69cc3712c37ed0"], &(0x7f0000000100)={0x0, 0x0, [0x0, 0x0, 0x0, 0xfffffffffffffffd]}) 16:06:41 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101302, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000080)=0x14) [ 722.540817] binder: undelivered TRANSACTION_COMPLETE [ 722.546004] binder: send failed reply for transaction 1783, target dead [ 722.570112] binder: 31660:31663 ioctl 40046207 0 returned -16 16:06:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f00000000c0)) write$sndseq(r0, &(0x7f0000000080)=[{0x4, 0x2, 0x0, 0x0, @tick=0x9d, {0x0, 0x9}, {}, @addr={0x5, 0x7ff}}], 0x25c) [ 722.630579] binder: undelivered TRANSACTION_ERROR: 29189 [ 722.634587] audit: type=1800 audit(1548778001.743:156): pid=31661 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor4" name="memory.events" dev="sda1" ino=17241 res=0 16:06:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000140)=0x0) r4 = gettid() lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000015c0)=0x0) getresuid(&(0x7f0000001600), &(0x7f0000001640), &(0x7f0000001680)=0x0) r8 = getgid() ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000016c0)=0x0) fstat(r0, &(0x7f0000001700)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000001780)={0x0, 0x0, 0x0}, &(0x7f00000017c0)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001800)={0x0}, &(0x7f0000001840)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001880)={{{@in6=@dev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6}}, &(0x7f0000001980)=0xe8) getresgid(&(0x7f00000019c0), &(0x7f0000001a00)=0x0, &(0x7f0000001a40)) r15 = fcntl$getown(r1, 0x9) r16 = getuid() getgroups(0x2, &(0x7f0000001a80)=[0x0, 0x0]) r18 = getpgid(0x0) r19 = geteuid() lstat(&(0x7f0000001ac0)='./file0\x00', &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001b80)={0x0}, &(0x7f0000001bc0)=0xc) stat(&(0x7f0000001c00)='./file0\x00', &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000001cc0)='./file0\x00', &(0x7f0000001d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r2, &(0x7f0000001ec0)={&(0x7f0000000100)=@kern={0x10, 0x0, 0x0, 0x10000004}, 0xc, &(0x7f0000000240)=[{&(0x7f0000000180)={0x70, 0x30, 0x21, 0x70bd2c, 0x25dfdbfc, "", [@typed={0x8, 0x86, @u32=0x9}, @typed={0x14, 0x0, @ipv6=@local}, @nested={0x44, 0x8e, [@generic="a585f53ae30cd9b5e4479fc7e5c42a28caaafc4a7e79c3cb5aa80b9789b5133075d82016", @typed={0x14, 0xd, @ipv6=@initdev={0xfe, 0x88, [], 0x200000000, 0x0}}, @typed={0x8, 0x8, @pid=r3}]}]}, 0x70}, {&(0x7f0000000440)={0x115c, 0x21, 0x204, 0x70bd2a, 0x0, "", [@nested={0x1018, 0x56, [@typed={0x14, 0x3, @str='/dev/binder#\x00'}, @generic="0f113a6111174cfc7f5d08b8333b22d1083ea828520c8d1d80bcd03814e75f8795d328857807a203e021e7c7591849f5e58a02e1235e1b2fcd33c555a485d16f9aa57a912d6ffab1af5f6e755456af87c10bb9fa5792589537d74c2ee6a3b986ef20af66630c0b551ef62af83178d1a12314c7b238362fea61dfda6f498b0c28bf5d95c1e05cea252fc63d82da677c271761823013e46ffe8cb802a156b221c6014e0ebbedf2bb81d603ebd1186a0992af5b5710ed1cd4910303e9535066d7126ef3bbcd1e27927225106635ab72406ad8ebc5adcb750373b5867b2ad458496b5da7e8e7416c6f413b7bc4272fa0a6927a958075b8674d5f432bb1ffc5a129de759132e5da23907ca63713cda82351162d99a3688836e2815cc61bdcb2c985c24f05553020b1ad5b794652aca7a6dd8f9fea2ac950c8fdde9fde916f96634528ffc8d17dea134a71fe673e831740782dbd367117054bc85f042000982fd69e5cfb5f6f0089a504be93df70e6ce0eab8f0a2d6551894a62322f7701e54ef59bdece685c0bdc92fd51be2dddae5d9e2474c4a80cc63a973a668a428a3d84e6e85ee25d61c3886b00d535c0f59fbc26cd2bc1c1d52847bd3a963ab02da164649216236a63f0b9d43ca1559d1033b06bb320e5621da133f0a7b717aa06a019b84cf64f208a8c928fa02b3d6083c6a84e1b15c606b27f70f7809fb6149bdabb364069804bd305e25ebb519d9ac73905e8e72d3eb036af96bae150132abfb3d4f7b8a7d0523ff0cf9559cbf380f3086ad1830c59a4389a69be8e9705891dcb90f459a2c2c2efac0c1038cf4646382bb7f8b8041d7f1638c2ac942a163524cee6d5ad883ff897832e514748bd0dd834d352a7a79aa487c10d16c3857b641885ce2e95416232b3dd582b4d4353163e5bfe97eb8169d04a806af7c1cb84848381332e0dbf1a3e3a39353448eac6f9b8de93336ea96a9c57b955e00138ac82efdc4275acbd4b702838355313598c64a85f193606b62bea1c9b27e9bf9e80300d59bfbd94737e7b24fefe1d15d77d542de00896df6358d2519e71018e2ce44001d979ca141d64d4c19f712c7856a2a2e5b345c5c8efc5d85bc121b7efbe5487ee179fdcfa5520f97d55d7292c066179606b251562919296ff0b66d2080e516faac860b43ce0b4418b7a06d8ffca12c9b04d6c3686d4374238a7135a6f7bfaf746fdcde1d72e955065f05b52293a622903cdf237ecdb22e26020b911d2a40fd8e98bfd5914f7adefd4a772bb723ccccd10bf2cacbd352b8dfc03a55609ec22e585d4bf44bfea493a4e3494b569c033c3079ac2ac5ccaf58b553f84fe934d0ac791e8b5328f6a08d99ce15f5a9f95171d69beeaee05b7eab0c1b182988543d08e4af654b414d41f87f6f82e243a7dcb5dde6bf8e431581c8a415e953884a01a0792b1c7f0f4c1c0ba95d90972d6c3edd9e0bdff47f5d6df39fd095dacc2b207d0434918d8dceb5a28c915955e58455c64bb9e8353fde0b83e9bb0457ee044b1671a7924710cb2b11d23929a07fe466ed43553167bca03e767c0fc728678b6dfada46c83ac9f071f0b481a06ceab0d16c1314be5b50e15deccfffcab3ca33c6522ddd7c5aadfbd2d62d330b513dcc62502e1545d81666e9be68a3e66015278c5e999a0b3854e80f81a3a0914dd254f335a113dcc7848dd6a5f7310e028df7ff65791ee706f359bc28d0f8490cc46505ae3fc653a5dda290e8f9baaf822e01af92fa237ec802f67e99e8e1addcfdbd9590eea498d3f357ea5690761f0efefbf014edf129a05a44c9756c37792de234b9ad2e625e4359a5f5d1873eaba0bab8345ddb62233ac0441470771335c71054f17b02f5c7f1e8e07d677c4f0fe54fcd97669be7b5c17c77b5bdc3c99cd5b555e98df48230f03d5648403bb95942834e28670adaf1e2b992fd7a9073228eadd1b59c461e9314b9c65df7acd6ad1f68d009504d9d128e00b2f0f5c21d625d74304b6c58e02ed283b72532c6d3902be212e35d0cb42099a621ab02761901765cc6541763705d73a5986c330c24d63835920477957df1fa4a7de2dcf50ce630a6342a9f92583255d4b587d23adc99663715529446ffabe4f548819e3370e656b5face809efcee4aab55bf5e6a13370e6bbfdbedfe2a98d4d2a7eb8f49e9b165ab0238209e9a2bff6d09ad7ed954775262c2d122bba9b5874a0a238fafad2455aa0c2a0ae9ba0113863eff208b9f4cbe2b4d5de61a7841194f3ae8ecd70f21539d2c83754d4b65f8e70e3059c3ad2d252fc6f652b900f1404c5961f19ddc5076bec22bc662eadf614027868d4b264deeb9de5eb9c0e79c10e36f78da89062c82a3ce96551a35c2425c1c36eab0c6755061cf56bd03fb274f9daed8f77be0841010490026b23e2bed49d49817123d3178f1cab12e5e3bab2774178910b4ac81c0f916fe278c43d942db985ab2dcbfb0b0746c86486d1ea2e051a78bb515363dc732996580a99cc7b25bef06ea3219d0fb8e3249681a9a253322aad752fefb5119636ef57d01caf21d62b94de2c057fc4f6daa67a14f75a12f4929327e7722614bc7686100e91f5f8339dae32d4a5f2f5267599f243e6882041a04d8d802396c3a7bb0de4c8ab34c446129918962e61e205f8d31617676fbc03da0839c914ccb1f59d96424c517545ae6322ae930498d0b2ee32ff7289615afb56497fda070fd6e43bb5951bf98e984f150d6e51998eb7c404b25324cc0073eca01c9faa45dac2ab64b4d4b4f44eb54a5e5ef04b0c533175e38b01b01a420d570374f288a34cbef5aa757074cf14064edc20f35e751cbeaa0f2774bb4aed1e9f5dc9e2cc04f1d34f0bfc8df289be1269776ea5288a5621fea15f66234ca366de3f6e18d0343803dc1d259bcd8781ddadb9eddd377d52396ab67d68afaf3c53c8b459632efa68892738839fa0971db75d4c10b6d4b0088985129fcb7f0950454dbbb79169e20b5e54d35da3e111ca33d69c96342eb4937c7fa57aedc7713882eec5cb8db63245bb92287adc00b926658c9db2f5cf1189f2dd23b0c2fde7a9e9e5519c1da9664af271758fe19b129b9abeea485238ced3f18aba19163c9f0b238bfea4dade44aec8898c3b0728db2b8ee4d0a6b9da7d172dbe1bcae065c308537ae07d77ce1114be1e979ff22f5e11560fcf6c49a5ed82385cdb96117eed90223d4669c983c13e47fb94757818176f12e062cb74ef3459f7ef4477cdcca5feb7ed5607e56431cb58268fa4ca8a050b770327c0df3ba34cc81f88300b7e8839f81e254bf928009a61cbda99f62ded43690d4e5f862f2a066fcfef9c0a708ac622d2d507610a378c7bb31b6aaa654c8475033e295bb307f2c3417969df4c8465fd5d8411c623e4c62ab36efd4b0a76930ead83a4f79235f73c9638a38fd45acc1af81fc59967f52546696434bf53f3e0dc87948370c29c5b70680b68d2c82333dc3b0c78c975ce927bad989ee1c27163523624163b094026b4c05da3536e97972f68ed0a6fcda72f0dca555d1631da09b6b79d8f107b66e2c7ac5097117c91b80cac594e4751b4c366731170b10b0d85e0384ab4bb621279034bade79944188b5bb3fc0276b9caf6045ba4192bc11b5a48164b4753f1b763413bb19054e5cc13627b771a48828862427294f8a5da938f88d43f19aa6f45bf4471f24f54401a0ce2c7d6312c8b20fe557bcc7d8f932f9d2f9a407b30ec61598a1d12828ef708b262b47256fa90ec0acee167153766ce6113b64b624944761e31e131d7adfa46ca5cc307e7d3f2fbbe1e7419d84327f112296708d699496f7eaa580930b3c8a4382e973f25ed53cdfab043c5ae49e492560978d140a77e084b112028856552faf3521801b1cc6d4efbb9dc3b3aa40d95fd24cd1be2d980579a0c307a175bfedac4ef0854bb3877c559533c3c323224172c77f7f5ab871624a64d208c28ad50163011dedc2493ff11da029087b5107470a6702b59b6dcf4d1f7b51f26847eefc96fd52893c31564057581d9dba4c0b3f6232331e8c1c03605c0be1d08a676926bb6ccce3e089d6bad8dbad8e66a676baf2dec45924b2061e417ee99f39a4a3491e78a86a126df62b8b97f1ac1dd0c940280b58a7551929ddcb42a56127294c0a0c6803901458b4aded8e90c7a27049a3dafd8aa238d16fef86a8e0e112448ceed14e4ff6f6ae1d1d6eb31c6c3b495004d193c6dc19ad9f545913c2aada4fbce4a90b48e8a97638b4433ff801d738fdce609a1d5bcf94401648a91f17fca0efed9b0f54492b449cea69e037165396b4edfb74c838bc57dd4d236c15ea40efa5657f367836fbe2056a89f53e6be6eea1eb4686635f5172dd326c59b6034db24a80ca00f5d35c9848423dec10b7d3cb659f9802673b7a43f7b47cd22d170ec20516b03cf7c80301274f96b33d08dbab283184bee1683f96bb0e4b1d968c07faf7ff60be0e9470904ea58e97392b21e5c668fd9fdd6cdf41796c5f9f530aa16c2d9a864fc2da5bed41a001e27be4eb74c274f289abf52abb4d1092349db5bce681fa72077afdc501837fc4de65b8ca1b7786b1cae247aa056422a6109444852ab9db2b0ceaec3bb2ac5ff1372a340e40bc92f5d4600f0d3dbd9a975143057ca6dd5a742cda8bd8fec3fc083ffabc9c3f100100317fe1b2cfeb94d51f70da119010f870e4f8ba879184ace8379870deef38dad616c38c4163d29a1bac07b6b24c1e512078168e7c1857ccfdfa2d79ad8e8b9a6306d2a3f0f4adb1e2f0f3c22d83b901ee8887a2eef1b05d49a095e04a211387de3fac4270746371a478bc0f83b0ac8b42a2acb3b16f97d8ae741611dd1f4202566373a9f24fdd5e10d099917300e26d565029199e2591d0c46d2d0d56ac9b9fccb96e4ee65f4d9dabf3c3064c54ab8de1bf7d9c8f017625ec3fb3046c239184c936609fafcb1fd4eeae7d9f5d6d5495ff6a24f4a5a030efca97bca2155e7ad1e683a430055590779296a8415d4a4ab8faf9648457c1ebab192828e575c65ab8580edf036d38ee5aa4f9210cf1291df14f5028768fcfdd4a57f17bbc136194e28c47b1026816e5ddc0bae262b08bd3d1d61f0f6cf28a2815ca03addeffb01a7eeb4dd3d622cc3ea0661d122a2a8d7c2699c7500de89def07922a174758d271a486a6b143facc4ee3b96f9ae6cfef9682be4676a83485eefd76e2d4a2ee259bf311a5f1fe368ea20432647753c417900c035c46c0323a820b4a31886d6cd8907a6fbd8b935d85ea0ea2e1843bcf5bc35bccb48161401daed440d8fcaea16496303cd317ad234a0fc13372bbcb0f54230232d7cae13ffe609e7c27d99f8523c64235dcc704462f1c808f1da26e1e32e8f111a95e001d4705a26a1e8b93b62fbf4d42a6fe9f4fa4d27ddfb6edd5cc07b0cccfc2fc9414f0a8a3290aa1eb1878afcfbc2197d28bf3e2836aec4600d6cd4cbfff7733ecc51476e714eaeee0b37d1ed9b6462e0caab024bf770d091a85dd1a8eabb5d9acd4e6b846d060c9be594a8e8c5819a902cdd432b41702f428d779dae2897f6148e58f69372b51d079d5f8ba6ca971d2b80c071ffa997ea996fefc76cc6b28347e168e5b900e5fee24e25fa1f302e5f037c4dffc74fc4df3b5f115ea7f02f7607a951de333bf48d1ce5ce2d3a19b790701e5b38f434d0ce8705f5dffe8d2e986d91ccb12be45599498da41568975b681cd310d4c817f05b95ca067812ca25ee65539e80fd0fdbc1b090ab9c2a5ba8fe8445f6ae4a1962d14d7f851ada0fcb0337d90c"]}, @nested={0xe8, 0x7f, [@generic="32062ac6f24d59751a69a0f587d1eaf29e1264d82bce3bd2b179e5b5f51af233393a73942658c098dbd2c4c2b0e3619d31aca85de865b4de79ff28ed0d095729d7ac936e5b3416d3ff16dcad7673bdddc808038c2ab2e8ab582bf179a6c6c673a3a81c96fdb5d29e20dc490f5a9da808ba8eed532242cea0e474d9947096b620a3f0e573a552ec1ad107a08a25e764bba62e3e8d5a3e79e9f13854c9862ca7", @generic="b6b36d3f19c935a3f91bdf37591f802114b87c4a0f63621bfc6a5fb41118ed4e7bd67becf4512ccad58a06a4d69d5bc76c407b30886c30773163540e1e0ea3df243eb13f"]}, @nested={0xc, 0x24, [@typed={0x8, 0x96, @u32=0x200}]}, @nested={0x40, 0x4a, [@typed={0x14, 0x39, @str='/dev/binder#\x00'}, @typed={0x8, 0x6f, @pid=r4}, @typed={0x8, 0x22, @u32=0x2}, @typed={0x8, 0x37, @uid=r5}, @generic="42af4c565be86919d55458a1ede379"]}]}, 0x115c}], 0x2, &(0x7f0000001d80)=[@cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x38, 0x1, 0x1, [r0, r0, r1, r1, r1, r1, r1, r1, r1, r0]}, @rights={0x28, 0x1, 0x1, [r0, r1, r1, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @cred={0x20, 0x1, 0x2, r15, r16, r17}, @cred={0x20, 0x1, 0x2, r18, r19, r20}, @cred={0x20, 0x1, 0x2, r21, r22, r23}], 0x120, 0x40000}, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 722.728879] IPVS: length: 126 != 24 [ 722.748154] IPVS: length: 126 != 24 16:06:42 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x2800, 0x0) write(r1, &(0x7f0000000600)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d", 0x200) connect$bt_sco(r1, &(0x7f0000000000)={0x1f, {0x7, 0x2, 0x1f800, 0xa7b8, 0x9, 0x101}}, 0x8) fallocate(r1, 0x11, 0xff, 0x1fc) renameat2(r2, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x1) 16:06:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r0, 0x80045700, &(0x7f0000000040)) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) prctl$PR_SET_FPEXC(0xc, 0x110000) ioctl$KVM_GET_CPUID2(r0, 0xc008ae91, &(0x7f0000000280)=ANY=[@ANYBLOB="090000000000000000000000000000000000000000000000000000000000cdef390000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]) 16:06:42 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6005, 0x1) 16:06:42 executing program 5: bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) socket$kcm(0x29, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) io_setup(0x0, 0x0) dup2(r0, 0xffffffffffffffff) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0xff4a) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x20032600) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f0000000100)={0x6, 0x12, 0x1f}) ioctl$FS_IOC_MEASURE_VERITY(r2, 0xc0046686, 0x0) flistxattr(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a0f, 0x1700) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 722.931228] binder: BINDER_SET_CONTEXT_MGR already set 16:06:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 722.961210] binder: 31700:31704 ioctl 40046207 0 returned -16 [ 722.997777] audit: type=1800 audit(1548778002.344:157): pid=31711 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor4" name="file0" dev="sda1" ino=17246 res=0 [ 723.030505] binder_alloc: 31700: binder_alloc_buf, no vma [ 723.047758] binder: 31700:31704 transaction failed 29189/-3, size 24-8 line 3035 [ 723.088196] binder: undelivered TRANSACTION_ERROR: 29189 [ 723.109634] binder: send failed reply for transaction 1788 to 31700:31701 16:06:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r0, 0xc0106407, &(0x7f0000000000)={0x100000001, 0x2}) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0106401, &(0x7f0000000140)={0x4, 0x0}) r1 = dup3(r0, r0, 0x80000) getsockopt$inet6_dccp_int(r1, 0x21, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) 16:06:42 executing program 0: r0 = fcntl$getown(0xffffffffffffffff, 0x9) ioprio_set$pid(0x2, r0, 0xff) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @tick=0x1000000, {}, {}, @raw32={[0x40, 0x4, 0x6]}}], 0x30) [ 723.116803] audit: type=1804 audit(1548778002.464:158): pid=31724 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir785229837/syzkaller.fdBXuu/101/memory.events" dev="sda1" ino=17345 res=1 [ 723.182920] binder: undelivered TRANSACTION_COMPLETE 16:06:42 executing program 1: keyctl$session_to_parent(0x12) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x100, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000100)={0xb273, 0x0, 0x10001, 0x9}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f00000001c0)={0x3a, r1}) ioctl$UDMABUF_CREATE_LIST(r0, 0x40087543, &(0x7f0000000200)={0x1}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x404000, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000240)={0x2, 0x7, 0x1, 0x4, 0x3, 0x0, 0x1}, 0xc) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r2, 0x114, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="03fb7219"], 0x4) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x4004, 0x1) 16:06:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000480)='/dev/input/mouse#\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000500)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xf8, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_NET={0x34, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7f}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x81}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}]}, @TIPC_NLA_BEARER={0x48, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xda01, @loopback, 0x5}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x7, @remote, 0x8}}}}]}, @TIPC_NLA_BEARER={0x54, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x1, @dev={0xfe, 0x80, [], 0x1a}, 0x5}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0xfffffffffffffff9, @dev={0xfe, 0x80, [], 0xf}, 0xffffffff}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4000000}, 0x2400c000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000440)={0x3, &(0x7f0000000400)=[{0x8, 0x4, 0x3, 0xfffffffffffffffa}, {0xffffffffffff9798, 0xff, 0x880, 0x6}, {0x3ff, 0x200, 0x1, 0x20}]}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0563044062f547c602b1ed5d6807660ee0d40b4e5f32f64f9ae133ce14944299b4838f44f4adfe56fa1bdb00f6f1c131b9085a8367e030d25b81101e124f3523660d925b1e5c9106269a11556f2e7840a6fef859779bc69e0402f411d1986342e46ab912f840fe0a4cb33e9a632a3fbd42581e12ac1968f5fdbf08031a64a7f1ea76ee5ac386cdb831d8150badc47d9fd2ab2f4c9bf74f8dbc7f29ffc417f81dd81b268ffb82e9ec1eb481a8d636a750bee1f0983de2e9e17b343aec"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000060000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r5 = fcntl$dupfd(r0, 0x406, r0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r5, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40408002}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0x68, r6, 0x500, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x38, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x360}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9c5f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3ff}]}, @TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4008041}, 0x4) [ 723.230216] binder: undelivered TRANSACTION_ERROR: 29189 16:06:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 723.310262] audit: type=1800 audit(1548778002.464:159): pid=31724 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor5" name="memory.events" dev="sda1" ino=17345 res=0 16:06:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000040)={{{@in6=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@local}}, &(0x7f0000000140)=0xe8) sendmsg$can_bcm(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x1d, r1}, 0x10, &(0x7f0000000280)={&(0x7f00000001c0)={0x0, 0x102, 0xfffffffffffffff9, {0x77359400}, {}, {0x3, 0xfe00000000000000, 0x48c0000000, 0x1f}, 0x1, @can={{0x1, 0x6, 0x0, 0x1}, 0x7, 0x3, 0x0, 0x0, "fec8a9e92aad161e"}}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) [ 723.439001] binder: 31743:31747 Acquire 1 refcount change on invalid ref -968362654 ret -22 16:06:42 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2000) setsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000040)=0x9, 0x4) recvmsg(r0, &(0x7f0000001140)={0x0, 0x0, 0x0}, 0x10040) 16:06:42 executing program 5: creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/igmp\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x4, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) getegid() fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = shmget(0x1, 0x4000, 0x401, &(0x7f0000ffc000/0x4000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000000)=""/48) 16:06:42 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6004, 0xffffffffffffffff) r0 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x1, 0x2) ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000080)) 16:06:42 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 723.465257] audit: type=1804 audit(1548778002.744:160): pid=31736 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir785229837/syzkaller.fdBXuu/101/memory.events" dev="sda1" ino=17345 res=1 [ 723.502404] binder: 31743:31753 unknown command 1 [ 723.523584] binder: 31743:31753 ioctl c0306201 200003c0 returned -22 16:06:42 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x42005000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="08010000", @ANYRES16=r1, @ANYBLOB="01032dbd7000fedbdf25040000000c00020008000800080000001c000300080007004e21000008000400010000000800040024070000080004000100000008000500040000000b0006001600000028000300080008000000000014000200626174616476300000000000000000000800050000007fff080004000100000084000300140002006e657464657673696d3000000000000014000600fe8800000000000000000000000700000000000000000000140002006e7230000000000000000000000000000800050000000000080008000600000008000400090000000800010002000000080007004e2100001400060000000000000000000000ffff7f000001"], 0x108}, 0x1, 0x0, 0x0, 0xd0}, 0x20048044) [ 723.564843] binder_alloc: binder_alloc_mmap_handler: 31743 20001000-20004000 already mapped failed -16 [ 723.586328] audit: type=1800 audit(1548778002.744:161): pid=31736 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor5" name="memory.events" dev="sda1" ino=17345 res=0 [ 723.625325] binder: BINDER_SET_CONTEXT_MGR already set [ 723.675250] binder: 31743:31753 ioctl 40046207 0 returned -16 [ 723.694044] binder: 31743:31747 Acquire 1 refcount change on invalid ref -968362654 ret -22 16:06:43 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x40000, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000080)='security.ima\x00', &(0x7f00000000c0)=@md5={0x1, "b8203fb832732cef9c1765f87c670330"}, 0x11, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000000)={0x4, 0x2, 0xea37b1d3f1c60bc2}) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {0x0, 0x5}, {}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) r2 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x2, 0x1ffff) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RGETATTR(r2, &(0x7f0000000300)={0xa0, 0x19, 0x2, {0x10, {0x2, 0x3, 0x5}, 0x4, r3, r1, 0x6c3, 0x78b, 0xfff, 0x8, 0x4, 0x9, 0x5, 0x7, 0x0, 0x3, 0x2, 0x3, 0x3, 0x8000}}, 0xa0) sendfile(r2, r2, &(0x7f0000000200), 0x10000) 16:06:43 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:43 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x6) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) connect(r0, &(0x7f0000000400)=@can={0x1d, r1}, 0x80) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000025c0)=0x204, 0x4) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x200000000004e23}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='dctcp\x00', 0x6) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) sync_file_range(r0, 0x1, 0xbef9, 0x5) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) 16:06:43 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4e21, 0x0, @ipv4={[], [], @remote}}, 0x1c) connect$l2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) r3 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x9, 0x2) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x7, 0x2, 0x6, 0x81, 0x101}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000480)={r4, 0x9, 0x7, 0x0, 0x65, 0x100000001}, &(0x7f00000004c0)=0x14) ioctl$BLKREPORTZONE(r3, 0xc0101282, &(0x7f00000002c0)={0x6, 0x6, 0x0, [{0x8, 0x7, 0x9, 0x9, 0x7, 0xa863, 0x5}, {0x0, 0xfff, 0x4d8, 0xb5e, 0xe9b1, 0x6, 0x8}, {0x40, 0x2, 0x4, 0x4fa, 0x7}, {0x9, 0x10001, 0x3, 0x20, 0x51820000000000, 0x4f5, 0x200}, {0xffffffffffff7153, 0x8001, 0x100000000, 0x8, 0x6, 0x6, 0xff}, {0x6, 0x67, 0x5e31, 0x6, 0x100000001, 0x2, 0x400}]}) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000180)={r4, 0x800, 0x10}, &(0x7f00000001c0)=0xc) fstat(r2, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = geteuid() syz_mount_image$hfsplus(&(0x7f0000000500)='hfsplus\x00', &(0x7f0000000540)='./file0\x00', 0xb5, 0x6, &(0x7f00000009c0)=[{&(0x7f0000000580)="7cb3e658d12bec173653c6f693490093dbb70f9556ebe1d03a2f673e8b0b49d222c10c416bac113d10ab209d1ad6fc1a56229f3b2c58ef2dee49ffe1b95d7c6b85ea6753bab5a2d848bfef41a43eb93c600969198bcbed233f132950e714e70bf9498a7bc459a1f2d0217bf4cd9c444538e49a549603e4e1ae672dddc623ecd584f599218a4f0cdb36e3a217f0b01fe624f0e87480cd90ee49fee2d1546b2bb77eeb10a3e3f3b4e27998010457ac977885d99c41b7988afedb94727d4ffe52666d989050fd4b292118742f773e1d8045daf0b64cedf89f69254a50f023611863d0491db2a7b6bc1505d4f93e3399cf3d7d0b44f5689ec2a9", 0xf8, 0x100000001}, {&(0x7f0000000680)="dfb5adc36da4bae778b8e2b054bffbb50b5abbdb05d429a0117ff5cd93169b0d700093ab86441769909317f8ebbf9a72a1af5c24f4d50b5830c481757846e9adcd24f623576ed583627188f144493343f8e0ebc35e1cb7bd9796a32ef65f687cd9bbb46fa12d29379373a9ea4d2c17fa253a6a9b843a6530e91c83a8b2ec412b060eb97165292598508fd9c11e6b10112d4a41563a60c30ad355a252a96b86f67e14ccd9baed7295189d18e32c432377f8165d917b3261431df7f7c462b368197a00e3c5264b106486973ec7326887ea02b16e33f3540895f547574ffab7e13b400a29bfa93679a8412e382feee113678f9f892c49e4", 0xf6, 0x7}, {&(0x7f0000000780)="6654a6e3a8ab89a18eefc8beeab8c544910eca7795eb67e3ec40f11acd486a172562156bc2ca7a08dc1124f77b72e589219f6e9945c774c8a61399a94dbeaf57d90f5022f528a759", 0x48, 0x74}, {&(0x7f0000000800)="eca41f873995eb27a61c01bede52423cc5e62950b216b076530b848e2aec2e8a3a208c6f11a0507267", 0x29, 0x100000000}, {&(0x7f0000000840)="0767a516acc14b115087365aa5cc4363ca423a116192186f983148373d89f0fb798104f7f813a882fa14fae00ce6cb8f5f97a097c7de2c85be69842cca373d6d0274dbb6336e0383be12c59309a7ec4cb3cf96e6aa07f97792645e62b408ed7c84233bbe3fce8bec380d38086fe0dcd224b48bf6509880778b1383a45ba660ff7833837de12b5da14d7869e87fc0ec2d42245f44139f69833a3b39b717aafea75ac79236900504b420910b66eb5cff53cbb8b0c21972025b75e89ed3fdedf1e98b4cec7e30ddabe793e781587e95571b94175dc76902acc8", 0xd8, 0x800}, {&(0x7f0000000940)="cd4aa73aa60e1fd5e46f33113df2d140e42bb7ebd917658a795bbd03ca97ab21201a98e468dbf7ecb6c9ea73ce92f187638b9aebb81a7bd6d2fcafa08e7a1087c065917f37167ae020228d8170cde8dc65446314b0d040199e", 0x59, 0x6}], 0x200000, &(0x7f0000000b00)={[{@nodecompose='nodecompose'}, {@part={'part', 0x3d, 0x626a}}, {@nodecompose='nodecompose'}, {@nobarrier='nobarrier'}, {@nls={'nls', 0x3d, 'cp1250'}}, {@type={'type', 0x3d, "77804ad2"}}, {@force='force'}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@func={'func', 0x3d, 'BPRM_CHECK'}}, {@subj_type={'subj_type', 0x3d, ']vboxnet0selinux'}}, {@appraise_type='appraise_type=imasig'}, {@fowner_gt={'fowner>', r5}}, {@appraise='appraise'}, {@euid_eq={'euid', 0x3d, r6}}, {@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}]}) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) write(0xffffffffffffffff, &(0x7f0000000480), 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000c00)='/dev/ion\x00', 0x800, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r3, 0xc058534b, &(0x7f0000000200)={0xffffffff, 0x1, 0x48, 0xf9bca0f, 0xc3, 0x7ff}) 16:06:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="02000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:43 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x28000, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:43 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 724.042822] binder: 31788:31791 unknown command 2 [ 724.104002] binder: 31788:31791 ioctl c0306201 200000c0 returned -22 [ 724.178044] binder: 31788:31795 got transaction with invalid handle, 0 [ 724.232187] binder: 31788:31795 transaction failed 29201/-22, size 24-8 line 3126 16:06:43 executing program 0: open$dir(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000480)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) accept$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14) bind$packet(r0, &(0x7f0000000200)={0x11, 0xff, r1, 0x1, 0x7fff, 0x6, @remote}, 0x14) fstat(0xffffffffffffffff, 0x0) r2 = socket$inet(0x10, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r3, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 724.273981] binder_alloc: binder_alloc_mmap_handler: 31788 20001000-20004000 already mapped failed -16 [ 724.330053] binder: BINDER_SET_CONTEXT_MGR already set [ 724.341498] binder: 31788:31791 ioctl 40046207 0 returned -16 [ 724.350116] binder: 31788:31795 unknown command 2 [ 724.384470] binder: undelivered TRANSACTION_ERROR: 29201 [ 724.410156] binder: 31788:31795 ioctl c0306201 200000c0 returned -22 [ 724.413263] netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. [ 724.456755] netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'. [ 724.499382] hfsplus: unable to parse mount options 16:06:43 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000100)={0xffff, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0563fe44"], 0x0, 0x0, 0x0}) syz_open_dev$sndmidi(&(0x7f0000000140)='/dev/snd/midiC#D#\x00', 0x1, 0x4000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:43 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xde\xe9\x01\xd2\xdau\xaf0\x02\x00\xf5\xab\xfb\x98E\xf9\xe1\x98Y\xc9i2\x06\xf2\xc6\v\x00\x00\x00\a\x19\xe1\xd6n\x97\x01#\xd8\x93\xd9t\xe5\xb9\xc3(Vw\xb2\x13\x98#\xe5P\f\x92\xab[\x94\xda:}\xe1\x9f\x06;\xb7e\xb0+\xd5\xb6`\xfb\x7f\xa8\x98\xc6\xf5\xc66\x9c?60h\xd1\n\xf83\xf6G[\xbe\x8byg%[\x17v\a\xba\x10\x0flFTq\x822\xdb\xdad\xaa\x1fi\xcf\x9a\xb5\xb3\xea>\xd64R\xb7\xeb\xd3|\x9d\xaefN2.\b\xad\x8f`)\xfe\x8f\xd0\xb3Lq\x17H\x04q\xae\xca\n?\xc9\xec\xeb(P\x9c\xa8\xa8>\xef)\x85\x13\x18H\xbc\\\xfbL\xc2N\x19\x01v\x9c\bL\b\'\x12\xb4pfkm\xdd\xf7L\xedi9s\xba\x1d\xed\x8b]\xc1ub(\tc\xa5\xc8\x19\nUg-\xbaA\x83\xed?}\x83M\xde+\x1e\xf2\x1az\xcd\xbbc\x88\xdc`\xd9\bx\x1fKGJ#\x9e\x1c\xf1\xc6\xddE\x83\x01\xd2b\xe5\x94\x8d\x91\xb7o\x11\xbctr\xa3,\xa0\xd3\x82@Db\xdf\xc0K\x03G\xf1\xbb~\x8b\x97OxA\x9eI\xed3-{\x99p\xd2@\x90\xc8\x91wq\x0f\xbbh\x17s\x98/KFd\xae\xdevg\x11t\x03\x84\xd5u<\x7f\x11\xbe^\xe5\x1b\xef$\xb7#\xa8D\xb89K&\x03\xf3\xc3K\x8e\x01.\x1d\x8dKC\xfa\x91pT(\xb2nv\xd0\xa0\x19dq\xc4x\x8a\xbasK\xc5_\xb00+\tW\x8d\xdd\xcaQ\xf1\xdf\"\xa6\xa5\xafJT\xd9.\x83\xdb\xf4\xd1\xb9\x9f=\xbe;&\x86\x86\xe1\x82\xe74h8') ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000100)=ANY=[@ANYBLOB="00000000003e1a763e78c5e85100000000000000000000000000000000000000"]) 16:06:43 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:43 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 724.666270] binder: 31814:31816 unknown command 1157522181 [ 724.694453] hfsplus: unable to parse mount options [ 724.714334] binder: 31814:31816 ioctl c0306201 200000c0 returned -22 [ 724.715430] binder: 31814:31827 got transaction with invalid handle, 0 16:06:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1f, r1, 0x411, 0x0, 0x0, {{}, 0x0, 0x4, 0x0, {0x8}}}, 0x24}}, 0x0) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x8, 0x2000) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) [ 724.757993] binder: 31814:31827 transaction failed 29201/-22, size 24-8 line 3126 16:06:44 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x280000, 0x0) r1 = gettid() perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x8000000000000000}, r1, 0xffffffffffffffff, r0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = dup(0xffffffffffffffff) shutdown(r3, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:44 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:44 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$KVM_SET_IRQCHIP(r0, 0x8208ae63, &(0x7f0000000040)={0x2, 0x0, @ioapic={0x1, 0x5, 0x0, 0x81, 0x0, [{0x7fffffff, 0x80, 0x7, [], 0x401}, {0x4, 0x78, 0x8, [], 0xa549}, {0x1513, 0x8, 0x215, [], 0x9}, {0xf56, 0x480000000000000, 0x7, [], 0x3}, {0x6, 0xa97, 0x100000001, [], 0x101}, {0x3, 0xfffffffffffffff7, 0x6, [], 0x1}, {0x1, 0x1ff, 0x0, [], 0x6}, {0x0, 0x5, 0x7f, [], 0x8000}, {0x404, 0x4, 0x2, [], 0x6}, {0x9, 0x7, 0x80, [], 0x8}, {0x6, 0x80000001, 0x8, [], 0x62}, {0xeb, 0x3134, 0x400, [], 0x4a}, {0xbc99, 0x3, 0x3, [], 0x1}, {0xfffffffffffffff7, 0x2, 0x6}, {0x5, 0xa4, 0x7f, [], 0x100000001}, {0x0, 0xffff, 0xffffffffffffffdf, [], 0x80}, {0xffffffff, 0x7cac, 0x8001, [], 0x5}, {0x1000, 0x3f, 0x10001, [], 0xffffffff80000001}, {0x4, 0x2, 0x8, [], 0x81}, {0x9, 0x1, 0x3ff, [], 0x7f9b}, {0x90, 0x1, 0x6, [], 0x2}, {0xbb2e, 0x20, 0x8, [], 0x3ff}, {0x0, 0x4, 0x59b2, [], 0xc489}, {0xdb6c, 0x5, 0x101, [], 0x9}]}}) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000140), &(0x7f0000000180)=0x14) 16:06:44 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 724.834270] binder_alloc: binder_alloc_mmap_handler: 31814 20001000-20004000 already mapped failed -16 [ 724.900307] binder: BINDER_SET_CONTEXT_MGR already set [ 724.932647] binder: 31814:31816 ioctl 40046207 0 returned -16 16:06:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup2(r0, r0) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000080)) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f023c123f3188a070") syz_emit_ethernet(0x207843, &(0x7f0000000000)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300004, 0x11, 0x0, @ipv4={[], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff83, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) [ 724.972308] binder: 31814:31827 unknown command 1157522181 [ 724.979711] binder_alloc: 31814: binder_alloc_buf, no vma [ 725.002690] binder: 31846:31851 transaction failed 29189/-3, size 24-8 line 3035 [ 725.003651] binder: undelivered TRANSACTION_ERROR: 29201 16:06:44 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:44 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 725.020406] binder: 31814:31827 ioctl c0306201 200000c0 returned -22 [ 725.024445] binder_alloc: 31814: binder_alloc_buf, no vma [ 725.070487] binder: undelivered TRANSACTION_ERROR: 29189 [ 725.082687] binder: 31846:31852 transaction failed 29189/-3, size 24-8 line 3035 16:06:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:44 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 725.122756] binder: undelivered TRANSACTION_ERROR: 29189 16:06:44 executing program 4: prctl$PR_SET_SECUREBITS(0x1c, 0x2) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000240)="0adc1f123c123f3188b070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)) r1 = epoll_create1(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000013000/0x1000)=nil, 0x1000}, 0x1}) r2 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000013000)) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0x40045402, &(0x7f00000000c0)={0xffffffff00000003}) r3 = dup3(r1, r2, 0x0) dup3(r3, r0, 0x0) setsockopt$bt_BT_SNDMTU(r3, 0x112, 0xc, &(0x7f0000000100)=0xffffffff, 0x2) 16:06:44 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:44 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffff84}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x265, &(0x7f000000cf3d)=""/195}, 0x48) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000000080)={0x7, 0x8, 0x3, 0x8, 0x4, 0x3ff}) 16:06:44 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) setsockopt$inet_buf(r0, 0x0, 0x28, &(0x7f0000000040)="50b0ec318a1b86642c0c0492aa2464313a4ac4a138bcd729c68aee360bd85ff8d1a018f8bb1a8ca5983e6f74b4a42b0f0e43ef01b3b1101c039ce89579d7750d548e289d42b970e05ac12c363e03e9fa0f89f03fcc57b2ba929bf6966f48b93b9d9c024d31769eb29631b0735f9f192866d03dcfb6b2b10a37fb06795b6bd7859f9c5d2ac0b2c2fcc9bd8c7e7e3486c5f4dfa29659ff003b8ae53a8e300a7c0ef93b0069d679aecd22ff403d22f73b4f60829c1fed22491a1ac66562688b5a1a809a8ba516d9d9fb7c1cd0d5336f09aacd2bf2bf10", 0xd5) 16:06:44 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 725.327357] binder_alloc: binder_alloc_mmap_handler: 31866 20001000-20004000 already mapped failed -16 16:06:44 executing program 1: write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 725.396547] binder: BINDER_SET_CONTEXT_MGR already set [ 725.413914] binder: 31866:31874 ioctl 40046207 0 returned -16 [ 725.456691] binder: release 31866:31874 transaction 1800 out, still active [ 725.469745] binder: undelivered TRANSACTION_COMPLETE [ 725.493403] binder: send failed reply for transaction 1800, target dead 16:06:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x408000, 0x0) mkdirat(r2, &(0x7f0000000100)='./file0\x00', 0x21) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r2, 0x111, 0x5, 0x100, 0x4) 16:06:44 executing program 4: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000140)="0af51f023c123f3188a070") listen(r0, 0x100000000009) r2 = accept(r0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000a68000)={0x0, @in={{0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}}}, &(0x7f000044fffc)=0xa0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x80000, 0x0) ioctl$TCFLSH(r3, 0x540b, 0xff) 16:06:44 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:44 executing program 1: write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:45 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x81}, @addr={0x5, 0x7ff}}], 0x30) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000425bd7000fddbdf25110000001c000900080002000900000008000200ff0100000800010000"], 0x30}, 0x1, 0x0, 0x0, 0x4000001}, 0x4) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000040)={0xd, @pix={0x2, 0x7fffffff, 0x3247504d, 0x8, 0x2, 0x401, 0x9, 0x101, 0x1, 0x7, 0x0, 0x2}}) [ 725.687366] binder_alloc: binder_alloc_mmap_handler: 31896 20001000-20004000 already mapped failed -16 16:06:45 executing program 5: tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x100000000, 0x0) getsockopt$bt_hci(r0, 0x0, 0x0, &(0x7f0000000100)=""/104, &(0x7f0000000180)=0x68) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x100, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000040)=0x80000000, 0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) dup2(r0, r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup3(r4, r2, 0x0) [ 725.735681] binder: BINDER_SET_CONTEXT_MGR already set 16:06:45 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:45 executing program 1: write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 725.762079] binder: 31896:31900 ioctl 40046207 0 returned -16 [ 725.782752] binder_alloc: 31896: binder_alloc_buf, no vma [ 725.814800] binder: release 31896:31900 transaction 1804 out, still active [ 725.823756] binder: 31896:31900 transaction failed 29189/-3, size 24-8 line 3035 [ 725.845496] binder: undelivered TRANSACTION_COMPLETE 16:06:45 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000040)=[{0x0, 0x0, 0x800000000000, 0xfffffffffffffffe, @time, {0x4, 0xfffffffffffffffb}, {0xfffffffffffffffb, 0x2}, @addr={0x5, 0x7ff}}], 0x30) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x0, &(0x7f0000000080)={@multicast1, @dev={0xac, 0x14, 0x14, 0x16}, @multicast2}, 0xc) 16:06:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 725.866325] binder: send failed reply for transaction 1804, target dead [ 725.896331] binder: undelivered TRANSACTION_ERROR: 29189 16:06:45 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:45 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 726.045833] binder_alloc: binder_alloc_mmap_handler: 31923 20001000-20004000 already mapped failed -16 [ 726.085826] binder: BINDER_SET_CONTEXT_MGR already set 16:06:45 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 726.102088] binder: 31923:31926 ioctl 40046207 0 returned -16 [ 726.115025] binder_alloc: 31923: binder_alloc_buf, no vma [ 726.120945] binder: 31923:31935 transaction failed 29189/-3, size 24-8 line 3035 [ 726.129320] binder: release 31923:31926 transaction 1809 out, still active [ 726.146433] binder: undelivered TRANSACTION_COMPLETE [ 726.186101] binder: undelivered TRANSACTION_ERROR: 29189 [ 726.208922] binder: send failed reply for transaction 1809, target dead 16:06:45 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:45 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x44800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x20, r1, 0x24, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0x20}}, 0x40004) write$sndseq(r0, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x1, @time, {}, {}, @note={0x5, 0x400, 0x200, 0x81, 0x6}}], 0x30) 16:06:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB="0000000000000003"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x28002, 0x0) ioctl$VIDIOC_ENUM_FREQ_BANDS(r2, 0xc0405665, &(0x7f0000000100)={0x0, 0x5, 0x0, 0x1020, 0x2, 0x1e, 0xe}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x10280, 0x0) 16:06:45 executing program 4: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x20002, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000740)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000240)={0x0, 0x70, 0x0, 0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1f, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xee, 0x0, 0xffffffffffffffff, 0xe, 0x0, 0x200, 0x1, 0x0, 0x401, 0x4, @perf_config_ext={0x0, 0x7}, 0x1, 0x5, 0x0, 0x6, 0x0, 0x9, 0x7f}, 0x0, 0x0, r2, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mkdir(&(0x7f00000009c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500), 0x14) mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000780)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) umount2(&(0x7f00000004c0)='./file0\x00', 0x3) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x60002, 0x0) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, 0x0) syncfs(r3) lsetxattr$security_capability(&(0x7f0000000180)='./file1\x00', &(0x7f0000000440)='security.capability\x00', 0x0, 0x0, 0x3) sysfs$1(0x1, &(0x7f0000000140)='![\x00') [ 726.554930] binder_alloc: binder_alloc_mmap_handler: 31946 20001000-20004000 already mapped failed -16 [ 726.572406] binder: BINDER_SET_CONTEXT_MGR already set [ 726.577868] binder: 31946:31949 ioctl 40046207 0 returned -16 [ 726.585693] binder_alloc: 31946: binder_alloc_buf, no vma [ 726.591728] binder: 31946:31956 transaction failed 29189/-3, size 24-8 line 3035 [ 726.600718] binder: release 31946:31949 transaction 1814 out, still active [ 726.611226] binder: undelivered TRANSACTION_COMPLETE [ 726.620414] binder: send failed reply for transaction 1814, target dead [ 726.771269] overlayfs: missing 'lowerdir' [ 726.792224] overlayfs: missing 'lowerdir' 16:06:46 executing program 5: socket(0x9, 0x800, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0x2f}) 16:06:46 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:46 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:46 executing program 0: r0 = open(&(0x7f0000000000)='./file0\x00', 0x400, 0x140) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f00000000c0)={0x47a5, 0x8001, 0x5, {0x0, 0x989680}, 0x8, 0x442}) timerfd_gettime(r0, &(0x7f0000000080)) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x100ffe, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0xfffffffffffffc01, 0x0, @time, {0x0, 0x800000000}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x1010, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:46 executing program 4: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x20002, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000740)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000240)={0x0, 0x70, 0x0, 0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1f, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xee, 0x0, 0xffffffffffffffff, 0xe, 0x0, 0x200, 0x1, 0x0, 0x401, 0x4, @perf_config_ext={0x0, 0x7}, 0x1, 0x5, 0x0, 0x6, 0x0, 0x9, 0x7f}, 0x0, 0x0, r2, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mkdir(&(0x7f00000009c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500), 0x14) mount(0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000780)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) umount2(&(0x7f00000004c0)='./file0\x00', 0x3) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x60002, 0x0) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, 0x0) syncfs(r3) lsetxattr$security_capability(&(0x7f0000000180)='./file1\x00', &(0x7f0000000440)='security.capability\x00', 0x0, 0x0, 0x3) sysfs$1(0x1, &(0x7f0000000140)='![\x00') [ 726.973339] binder_alloc: 31970: binder_alloc_buf, no vma 16:06:46 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:46 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 727.018373] binder: BINDER_SET_CONTEXT_MGR already set 16:06:46 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x2, 0x0, 0x5de, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) write$sndseq(r0, &(0x7f0000000180)=[{0x40, 0x1f, 0xfffffffffffffffb, 0x7f, @tick=0x1000, {0xfffffffffffffffc, 0x9}, {0x8, 0x1ff}, @ext={0xd7, &(0x7f0000000040)="80fe410cab69305bcc66cb19929ec785f4c5f5f3e255dfea3218d121c619b65b92b9c5d48ef2000e5c3d34e9d40e694744edebc5a39fd5561ce8a876dd47f9171c5b0844a6e6bb28fc69794841e8f2560dc213c057a9807400c1e8917e4e2185ec8a01ec18c2c55c36577d9fac82a2a46f6eeb10b3c3ce1379c5e1a4ddefb543ef3e6f5723f4aa8947c42d6ce6204ceee2e9e7b1cb7f652fbbfff4f45b9f5495ce7efdc97713de549f4add90ee5964eadfd216228138f34f2b3f25932eb35004d918e363738b8c47c797636b0c9aa93ae8f9fae8b39c98"}}, {0x5, 0x3, 0x1, 0x0, @time={0x77359400}, {0x8001, 0x10001}, {0xfffffffffffffff9, 0x6}, @queue={0x9, {0xd50, 0x100000000}}}, {0xf3f, 0x80000001, 0x9, 0x2, @time, {0x330fee80, 0x6}, {0x5c1, 0x6}, @quote={{0x96, 0x2}, 0x9b, &(0x7f0000000140)={0x400, 0x1, 0x34af, 0xfff, @tick=0x1, {0x10001, 0xbd2}, {0x2}, @note={0x0, 0x4, 0x4, 0x5, 0xff}}}}, {0x2, 0x5, 0x10000, 0x10000, @time, {0x3, 0x2}, {0x3, 0x3}, @queue={0x2000000000000, {0x3, 0x8}}}], 0xc0) [ 727.119257] binder: 31970:31976 ioctl 40046207 0 returned -16 [ 727.125258] binder_release_work: 1 callbacks suppressed [ 727.125265] binder: undelivered TRANSACTION_ERROR: 29189 16:06:46 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$netlink(0x10, 0x3, 0x17) ioctl$PPPIOCDISCONN(0xffffffffffffffff, 0x7439) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x90, r3, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000001}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x400}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xd8d}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffffe01}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5e9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2dcd}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x80}, 0x20000880) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) open(&(0x7f0000000440)='./file0\x00', 0x4000, 0x40) 16:06:46 executing program 5: r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000400)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000ac0)='keyring\x00', &(0x7f0000000b00)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$search(0xa, r0, &(0x7f0000000a40)='keyring\x00', &(0x7f0000000a80)={'syz', 0x1}, r1) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) setsockopt$llc_int(r2, 0x10c, 0x3, &(0x7f0000000100)=0x7, 0x4) 16:06:46 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x1100ffb, 0x0) write$sndseq(r0, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0xfffffffffffffffe, @time, {0x0, 0x8000000000000000}, {}, @quote={{0xffffffffffffff01, 0x5}, 0xffff, &(0x7f0000000100)={0x0, 0x2, 0x5f, 0x9, @time, {0x1, 0x9d0}, {0x1f, 0x14c7}, @raw32={[0xffffffff, 0x5, 0x2]}}}}], 0x30) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x19c0, 0x20000) [ 727.315688] overlayfs: missing 'lowerdir' 16:06:46 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:46 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 727.344767] binder: 32001:32003 ioctl 89e2 20000000 returned -22 [ 727.365705] binder_alloc: binder_alloc_mmap_handler: 32001 20001000-20004000 already mapped failed -16 [ 727.439084] binder: BINDER_SET_CONTEXT_MGR already set 16:06:46 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$gfs2(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x1020, 0x0) [ 727.481261] binder: 32001:32003 ioctl 40046207 0 returned -16 [ 727.484584] binder: 32001:32021 ioctl 89e2 20000000 returned -22 16:06:46 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x700ffd, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x4, 0xfffffffffffffffe, 0x0, @time, {}, {0xffffffffffffffff}, @addr={0x5, 0x7ff}}], 0x30) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)) stat(&(0x7f0000000000)='./file0/file0\x00', &(0x7f00000002c0)) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f00000001c0)={0x0, 0x80000, r0}) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x300000e) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000200)={r1, 0x80000, r0}) write$9p(r0, &(0x7f0000000340)="203ccdbbc12770a71b361b3bd3203ae8ebbe939a412f47cae323b9970b886c1df210dc0995073eb42113a7b8", 0x2c) 16:06:46 executing program 1: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:46 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:46 executing program 5: timer_create(0x1, 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f00009b1ffc)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_procfs(0x0, &(0x7f0000000c80)='timers\x00') sendfile(r0, r1, 0x0, 0x22) [ 727.573338] binder_alloc: 32001: binder_alloc_buf, no vma [ 727.589711] binder_transaction: 1 callbacks suppressed [ 727.589731] binder: 32001:32007 transaction failed 29189/-3, size 24-8 line 3035 [ 727.655474] binder: release 32001:32003 transaction 1823 out, still active [ 727.669326] binder: undelivered TRANSACTION_COMPLETE [ 727.695371] binder: undelivered TRANSACTION_ERROR: 29189 16:06:47 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:47 executing program 1: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:47 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000400)='/dev/dsp#\x00', 0x6, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000480)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000440)) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000003c0)) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des3_ede)\x00'}, 0x58) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, &(0x7f0000000040)='nr0\x00') openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x100, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r1, 0x210, 0x70bd28, 0x25dfdbfc, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x7}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x8000) r2 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x1003fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xa00000400, 0x0, 0x8000010004}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='nfs\x00', 0x0, &(0x7f000000a000)) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f00000001c0)={0x0, 0x3}, &(0x7f00000002c0)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000680)={0x15, 0x110, 0xfa00, {r4, 0x4, 0x0, 0x0, 0x0, @ib={0x1b, 0x5, 0x5, {"5869949aff376cb5d5975d04e9e6f6e4"}, 0x7, 0x6, 0x4}, @in6={0xa, 0x4e23, 0x5, @loopback, 0x1}}}, 0x118) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, 0x0, &(0x7f0000000440)) pselect6(0x40, &(0x7f0000000080)={0x0, 0x0, 0x5, 0x0, 0xfc5, 0x6}, 0x0, 0x0, 0x0, 0x0) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) ioctl$TIOCGETD(r3, 0x5424, &(0x7f00000004c0)) [ 727.735826] binder: send failed reply for transaction 1823, target dead 16:06:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) r3 = epoll_create(0x8) epoll_pwait(r1, &(0x7f0000000200)=[{}], 0x1, 0x202, 0x0, 0x0) dup2(r2, r2) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000240)={0x10000001}) ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000100)={0x31, 0xc8, "d7e4aca1a8be08ee2a1034979a5c6004f4eed73ecefbfaefcf585cfad0d16644fc364fd5eb06d117b8b33922adb990ceb897e207cbcdb1797a7872949e650ee61590267ec30e10a3be55153db3cd49ec9003ee43f1ed2ee2df764df4deff7c870fc1aae6a6a8d2fdec9d1df8d4aafc1710d65e05f3b63e8eb4948232e2cec7ead2fe93cc076a9d0e4d6aee49c7f3fdbf402970334ebc89cab6f87f188058ab85fde1f78e09cac761fa5bc41d83734962e5b514eb42f8ac3aa4b64238c85d4eb899d4fa4205e13725"}) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a0676ffffff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) [ 727.899329] binder_alloc: binder_alloc_mmap_handler: 32048 20001000-20004000 already mapped failed -16 16:06:47 executing program 1: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:47 executing program 0: write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 727.954435] netlink: 64 bytes leftover after parsing attributes in process `syz-executor5'. [ 727.958245] binder: BINDER_SET_CONTEXT_MGR already set [ 728.014306] binder: release 32048:32055 transaction 1828 out, still active [ 728.022236] binder: 32048:32055 ioctl 40046207 0 returned -16 [ 728.031662] binder: undelivered TRANSACTION_COMPLETE [ 728.052031] netlink: 64 bytes leftover after parsing attributes in process `syz-executor5'. [ 728.059936] binder: send failed reply for transaction 1828, target dead 16:06:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) set_tid_address(&(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) creat(&(0x7f0000000100)='./file0\x00', 0x142) 16:06:47 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, 0x0, 0x0) 16:06:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:47 executing program 5: socketpair$unix(0x1, 0x8000000000002, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$unix(0x1, 0x2, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000006440)=ANY=[@ANYBLOB="b800000019000100000f000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0xb8}}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x18, &(0x7f0000000100)={@remote}, 0x20) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0xeb6b347d837daac9) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000000140)) 16:06:47 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200, 0x0) setsockopt$RDS_GET_MR(r0, 0x114, 0x2, &(0x7f0000000180)={{&(0x7f0000000080)=""/176, 0xb0}, &(0x7f0000000140), 0x5}, 0x20) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:47 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000400)='/dev/dsp#\x00', 0x6, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000480)) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000440)) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f00000003c0)) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des3_ede)\x00'}, 0x58) ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, &(0x7f0000000040)='nr0\x00') openat$rtc(0xffffffffffffff9c, &(0x7f0000000500)='/dev/rtc0\x00', 0x100, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r1, 0x210, 0x70bd28, 0x25dfdbfc, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x7}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x4800}, 0x8000) r2 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x1003fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000000a000)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xa00000400, 0x0, 0x8000010004}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='nfs\x00', 0x0, &(0x7f000000a000)) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f00000001c0)={0x0, 0x3}, &(0x7f00000002c0)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000680)={0x15, 0x110, 0xfa00, {r4, 0x4, 0x0, 0x0, 0x0, @ib={0x1b, 0x5, 0x5, {"5869949aff376cb5d5975d04e9e6f6e4"}, 0x7, 0x6, 0x4}, @in6={0xa, 0x4e23, 0x5, @loopback, 0x1}}}, 0x118) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, 0x0, &(0x7f0000000440)) pselect6(0x40, &(0x7f0000000080)={0x0, 0x0, 0x5, 0x0, 0xfc5, 0x6}, 0x0, 0x0, 0x0, 0x0) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, &(0x7f0000000580)) ioctl$TIOCGETD(r3, 0x5424, &(0x7f00000004c0)) 16:06:47 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, 0x0, 0x0) 16:06:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 728.323267] binder: BINDER_SET_CONTEXT_MGR already set [ 728.328698] binder_alloc: binder_alloc_mmap_handler: 32084 20001000-20004000 already mapped failed -16 16:06:47 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x1f) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000900)="f42e37ff38f1c0d24f415b8828bf82245850749b7889f2d8940feae0550f9083fefd44072bb7c9a90e4102cf7d79e042ec982050eba30e6b22184f39d71127b44e8475d7c4a1d4e8aa6078685fae978255b36e7d7a5958d72197eea7d3f3523b1e0f641ee21bcf95d5d2a1ae52caaa2b40dce518131cd295e259e823923707519d7505d4431a92bebd056c42d511b376199c959a60a8afb827f92ca3dc031c2fb0bcbeb72dde0ebeeba624bfd035f3e36e994679accc61e3c13b9dd00826f0492caa885315bd64f0a0256ba1b3315a00d3d6aafc4bd05856b3d643f1daef605171adbed4fd4b0c68758e7097980a767f341f65d3e8ded1a60d5b4567ddf2ca42495144fbb2f988bc6a290b088494271b47bc051cabd99a7eda3d6b6cbdc05adf855c456273b757eed383de433d4fdf62e943f97a5600a3cf7a26fab609a02699d2bb50b732f36edb1c9c92c7ab6cb08dc2349a06fe4265e2f94e1fce7d9d6164cb4143716bbe4a4505047765f4c8d152b8a51e26c8c9c17867d3be3fcb4a9f542757ecbc77191088d4710e7ca6c519d619884703680f21fd5bcc52d7301fd8a773d9dcbe0b93f66c42f1af2422f58375db35b99fafbbe8d9854ca07f83edb9662dd07ffb8e970f5a90fce0541240ee4e98e4445c4d57c34628c5e05b1c85721d92794968d6dfd506dbb97182168e7bc6feff9fd9d0cf921d37142a4a10be4bd99db4220f94c607383c33d56f8c067ff0f2ec3e77bcd408a8d9a42b72a1f7b4baab70f69ac3ad7717ef79aed0532603a31877c5450788dc296c69de4c6b7bad65831e893911227f3eea06086b0b711b5b365d2e60c53cf4544eac91eb2ad8b6a4bbfa34d3f7be14b42354d7488e00c1b9b43fddbcfb5e96de54f0e5cc74854bd04ffcad4add9272d0b969a33cb8ab8c8cec48a7d85f868532a123aae68dce79675b8f5f0ba53cf8cc5dd334b286c7a12e5ae2565717636b1804309883177530a2853f539cba7e50beab27fbf24a2d19f94312e99317612df1b4781f728b1a928bc39eb98776df16804b9508b66ccffb8bba2714a9118697fc00075c4e8533be2c83bdb6cdb8df8e7ec35cd4fb8004a1b972e32ecfdbf6aac874da03dd967d50ac9a7a3f543521c5a8cd4546dea4fcf88790566c426b1b032aee326a89c0b3777550d74bc39013f151b8dc007757e1fae184e8f17218e2c98d9a2f6de65ed5b465ac7a58e15a4ef85f7d5ab5167f51f4fd61c117dfac923ceff28fc09508e8df4615faa15173524c6a623333221c53e734144977044b8162edf7b41faddcdf455f473dffdacccd61a2ce34eb55523d5b3c9cf5965e4e0b1ff11b7da2b14fe72c6c6f9e53c11562a8711c7b958d4be9c7e847a3661c657cf7b8916a66c63dea8241512fce61ac28ea0163c2f4c637a4f0ac140ba2219798dc714c9e6c38d645776f6496e61f3d08f2d9eeaf2b7f4309a999623c5d6588a0b814ca64db58e9396bce8af2dfbc67ea503ac4542e151e84cbe890ded78dacf867ed6eaea0626416198a01d9bf43214122dfe360b481183c7a7674f0b11c9323302966e3271035a2ba9896a7f886381f1b06c0709ffaeddec6a751ebf215b662f6d103a9cc560d340b9f6e575cda8c23a92b68a16014bb0c8bf7bddb3fa8d94f7cb9d3407f9e9ec9b86b539d838827cbbf4cf3ff1f2b1ef83a7cbc769dc516c021b04e6020152e08e21637d0c88d1c63c04246f3c530b111a1e1ac4d5a4f1fac41fd6102480a1396ba17e5f5ee43afd84db02135a71f72c9766f89f9082ee7325a8b250da88294b10c4b3c7416475e8f653a458050f2007873d151bbeefe82a920f60a873243f473ac2ed9b5d918e4d95e643bc65625860233aee17485f61d94dc04b3e4c7b92fb0108f8649664e6cc278b28276640d3260a2d3b21583d0c9b93e22e640ae39b4d668fd342bbd69fb21a1f4853adea714d65c2d7bc476d47ce2e790e0c44d35773d8a6021913f27367b0bc4164a87715306bb9bf5da9ac7f5904e985dd32a20c73381dccf099fcfbbcba13596d4b7d67f99ab3d54450f9b6bf1595a7c61e67d00d35de7f71558f7130e209f0a0376a066220543d74eb0751f5952b3d20788cd189158b6db4d9ecda16c16a3309424645efbcbce615cf939c411c6446441e283feb829beac89d4d4fb49d529c01063fac0efeea941d2d265537d8180b8e732a0da2de4e370a57c04602b1a3d72a0157e2dbc5cf4d13fd23e95dc91efcea28d930f084485deb0d6321f07963fc7a7aafe5d205c249a286bfde64934c550efaf3a53a9d0066a9934c1d8bb932cd212bff1435e6fca3a91914609b4356c586092c8e07fa5e71f5b81ddbfcd1dace50eda6cba43251a3ff91eeb1f9d697972b7acec876c91bd75b51ebb09186f32f81254435d41a9f6cd802532f2ecf50819bde5ec793a3141e44dcb48ba86f71acb1b5cd35bc77aafd2e92a0e5a0ae02448d75a84d472c2739b34293c99c985bb54321b43d9a38916921af6781d1e25eae4b032c32e16671e6ce4e52005845dba44846c017c3934e6344a4fea951df9238ae0259102a20625790960eec813c0c8737d17e4b17b0e9130caf49cb0a1287b3fbaaa2814e8d441e9c0838217e28db32575c2005d8678ce7ee6debd647993bb4d6f2a3faf6a6b9998b170c98d4b847a46a1e2b0b2c77b22c15897b76bf9b29db40555b465ef8c488013a9761f68187132af8618ca142e875ca4529f729bd1d091acc7091ccbd3ac64a6478bae9850ebf0d6c5df4c293f43d3f985e775473a5572a64c0919c53fdd218bea215494e17a42f865fac3d667ad055b21482ba217d7de1951d410e6289c401111618965cef76ed048ad8a900eb84e35fc1ecce761e38e7f52e3775b80581f31eab243be54bbbf9c87b25cd954bc637c7f50115edfda1b2a026dd4da202bfb8d4263f9b5bd042701808cb407e5de74297f80481bc692cffc4b30750932eadecf979608c7455910641f0824dfb7369ee2fa4793dd26f2f407f9c1b88744245753bada0739a353cbb069ea2f9d13ac6b6b16c3470ecc3c627941bcdd97abebc73e5df8e28536243ec9838371c2e35e8853523e52b158e714bf4296210e990c3732d671a608db98783caa252a79ef6dd4d0a32ed4e25ea1dba01118881c30aadc07ba5ea308740d6732988f678990796fb3d1f4d58a0039dbd5c0467a68bd86088638e015484efce6b8850c17360067955efd31fef2df41ae1bbcd01a1b4d836d6cf105373b195af5e3c2af2420514dd94564dd9e38c66d79a48900ec8e1a39092fc53ad70978aaf678fe5e344e89f215269b9c6dd9da06db828554ff767b81129d661849cdd61bc4eb4025d4fe1fc405d547b4b52eb22a0942274d1f8bfe231a8303ffccf1976b76610876faed6d796fa73e50f7005d2d33f0426c8d35c38db6cb59ded707d640b97a5df237ec28dcb6bcdb0e9a0b0176dfe9f2986b4603cc1e0bd56a20df647d5dd6bfa01d99dc18f215f03bea3ac42908a27b5a8f9512881e459a317a595da442bd50c3e0043ef20374bf255755a62812bde7fe7ff3d2108c1829f15cedfc32e862ee8a5aa8ef1a2a5a25ab7ce618e0a8aec2a1d7eae2650edce9abc94fdecf1874fa09f95a5f207df253664d71918c0141eddc7564fe73d9c466b87180b30965de9f4cd6533c20942a77f0dceee057c3474c0e445cebca04278724013cd148d6243010e50d2ec9b60ebc33ffabb0659a17ceb78054573ff6ef878a7309ea72c690f58426744761a09ad3145eaccbb39579cfdd511b196907b10a3706b404852eb47df674731438b7354ba2f99d9aa63c05aad3fc69d607ab4d53e3d5e06411dafff21678237ca2af1853684747d159855697782762be346badf0f8758e8e8fd9728daaf7a2427df33409e1404695bf1d84792e5a8bf00631606da2ab8e79e4f2954158c063525a64df577ca2b5d510f22bf91099f3b4274c01cbccb3587f901c53d4ec1bc758b735b20bbe8d27f0b970298d82262a043c283851f76fc27ff9be99d1556505dd6d27abb83c4372b98fdf252519b594d945a7cd0a8c382beac70f4854644545c4802901588617e17e7f6393f44b2b33919c35a814f36f1906a5485dc7f3d7d2a231855acd26c33a7763175091e11341ad509065d5ab1dd656c12c93d7042cda0e2f8fa24e7811e0bae008b4097c6deff427d51d4e956fcfb95f917c2a7ed21c2edbdcf2020912880a6e54024c12a176469725b3181f59dfb248bb8dcd926594dc2ddca9fee7f9d3bbc2801bde1ae0bb2ff9494d13e0e917864f397b77b11a8367a6c30c6e07adac0459cee42ead9fc43070653949785b073232e7b1cb16aa760ca73d3d3db6077781873298ad63822e5077fdcfe38518ebcc3377c1ec6d87641c07b1e85ea84c15eb91b7a598504938166a86519c152a3fa4a2f1ceb07fc1a5ae04a0cd788672500c9375d2ea2b4f28aad25d12ad22d5f5b196f45d9ceea58b540e8f890e616500a507e736393d57d6467bf5ec133fa67743dc42b69c68354f61417a0855b299fe2d1a0878a21c6117a5125617c74fb5e228910438c4ee899cb9ab3592504d411f3553775f33abd32a5b25cb637d7513fcfad0fe49877386e8d8e731f9c876cb249348c18a6b1ead7ffde3dfe6e1049cfd59ea76fd12538df5f3e72f94ef0c7e83bdc354e34e731bf18a12f417f044e712bedf58c0faa6d01b66df89b8a291bf2d60b7887e2af27869ab77552d35b24595075bf9bf43a406c5ab43ac06b123cbadaae9b8f0ef47f9776b4e681e8a0936c6fadd27f8fe59b39b927a49ddcd3fcaff4f97ceeade497376cdfb066c992cdef2e028e649be06f2a7e0e08468d13b4ac6af21bf81e0c318a9c77c46e0817e23e4fa63a0b88b9f4334446e26ae2856b16006230167cf52fc0f95090f85948edd83c63d635cdde7612598ce14af9ede3133628c25f984f0211b38ef534985bf6747c57eb03e530b7e765be080998941b08a5f11208f2a9ab53339694c07a4e64d22e5bfdc988f97f9bbae8d852d5ff2e457de619e7f7a7f43811cc9047d2a5edc37e34f3f7f62218f49cd6605f62102cdf18012e1a4d29b1c17b28c92a1d8fb7172751b45561190875497872153152e8601578877d8d9246036bef591bfe69a3a52fde3652fa20aca611d2f5ad62638b63a1fc9c155a69d1de30bf8b392552946fd313749990189c0801e0a394323a1a4607a13c193ad4134431eddb068ede92616fa26e2acef672735b17865a488cd930f76b1093908d4d7599ecabfc3c352955503f8f2b1e791f8ab1335d6880b07dee9173b0f4e882c100cf8f5e1c1d174d4e2ca56eac2e7297b7529c77962abebc00c4eacb4ea7caae1c5f151cc93d830b8f466a2c8bdf75fea1775b471a2b93de47b3dee387fb4f0af9ece05a54c7d14d50de9e39a636e041bfc2c515b55cb6b7e128a5aaf722b364beb6e99ca826c34fec8c27f5b69185984f5fee4855b18a42004bb36a6b074be0f8537766d0257b12cdfebce86892b6719531ded8a81cc651ef81551c7b3a2bdfb557411464a1b0e4b741a7789bbfb76b884c395b055241556a7b4bab5738c7af26bf773376ff66836acbb74d30438b406e086cae3618bb997d000b317d2f3e8df93831996efaebf938eec9daa0792bc706ad3e7a78c038e51e5edd1e3d1fb5b08c5a61aa170b4eaf9bf12fd85ce547bd3f0ec7d5eb2fc1b3b830389d7cb8500d342f270a7fae0cfd0ba70ef643f89bfde253318fff5ea8990bf1768099710f46e7f2084", 0x1000, 0x40000, 0x0, 0x0) shutdown(r0, 0x1) 16:06:47 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) fsetxattr$security_smack_entry(r0, &(0x7f0000000040)='security.SMACK64\x00', &(0x7f0000000080)='\x00', 0x1, 0x3) 16:06:47 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 728.519911] binder: 32084:32098 ioctl 40046207 0 returned -16 16:06:47 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, 0x0, 0x0) [ 728.563964] binder_alloc: 32084: binder_alloc_buf, no vma [ 728.569756] binder: send failed reply for transaction 1832 to 32084:32087 [ 728.576715] binder: undelivered TRANSACTION_COMPLETE [ 728.596544] binder: 32084:32092 transaction failed 29189/-3, size 24-8 line 3035 [ 728.608316] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.636393] binder: undelivered TRANSACTION_ERROR: 29189 16:06:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x402000, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000100)={0x0, 0xcc, "d345a08422ccacd1274967c7e6fb9b7698377b43ca3944603749a1dd51336a076af30a286d02883c70291501c0d4ad6f1d49947c66bd265e919579e8b0fc2eb8b55053539a86a15186267cc96c0cee9951b0e2215f65cb6d5b89319848c3b33d54e7352548acba757f10b39e191a12474c859957c0357d46ccc5b05bd427b3fa6994051a17f22adadfb0062b4dfe68747aa769f33f6043bd4c2a98994c7f5e53e1e9139b1a76382e9de21edd0b5745e0fba80dc4f9da9fbb408dd73e3663d481349420106afbf8e9e0f3a276"}, &(0x7f0000000200)=0xd4) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000240)={0x1, 0xc98, 0xf, 0x1ff, 0x6, 0xfffffffffffffffa, 0x100000, 0x6, r2}, &(0x7f0000000300)=0x20) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:48 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) io_setup(0xc0e, &(0x7f0000000040)=0x0) io_getevents(r1, 0x7, 0x7, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000180)) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f00000001c0)={{0x3a, @multicast1, 0x4e23, 0x0, 'lblc\x00', 0x10, 0x6, 0x4a}, {@multicast1, 0x4e21, 0x2000, 0x1, 0x7, 0x3f}}, 0x44) 16:06:48 executing program 5: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r1, &(0x7f0000001200)=[{&(0x7f0000001100)=""/233, 0xffffffffffffff8a}], 0x0) write$P9_RREADLINK(r1, &(0x7f00000000c0)=ANY=[@ANYRES64=0x0], 0x8) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000080)={0x0, 0xfb, 0x1b, 0x2, 0x7, "bf5edae30f8604ce8cbd5e4beb2a4165", "c498cf35486d"}, 0x1b, 0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00000eb000/0x3000)=nil, 0xdff13000, 0x0, 0x0, 0x0) 16:06:48 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:48 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240), 0x0) [ 728.820155] binder_alloc: binder_alloc_mmap_handler: 32136 20001000-20004000 already mapped failed -16 [ 728.866921] binder: BINDER_SET_CONTEXT_MGR already set [ 728.907400] binder: 32136:32140 ioctl 40046207 0 returned -16 [ 728.935202] binder_alloc: 32136: binder_alloc_buf, no vma [ 728.943475] binder: 32136:32147 transaction failed 29189/-3, size 24-8 line 3035 [ 728.951805] binder: release 32136:32138 transaction 1837 out, still active [ 728.961953] binder: undelivered TRANSACTION_COMPLETE [ 728.972241] binder: undelivered TRANSACTION_ERROR: 29189 [ 728.983857] binder: send failed reply for transaction 1837, target dead 16:06:48 executing program 4: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/dlm_plock\x00', 0x80, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000900)={0x0, @in6={{0xa, 0x4e22, 0x0, @mcast2, 0x100000001}}, 0x10001, 0x800}, &(0x7f00000009c0)=0x90) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f0000000a80)={0x1, {}, 0x6, 0x8001}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000a00)={r1, 0x33, "f53722c037afaa154cf9f7ef64f77a7eb0cb327148f61ce1290ce6c3b2f355fb3f31c2f91b952b2771164c3cdabdf6bc4916d2"}, &(0x7f0000000a40)=0x3b) r3 = perf_event_open(&(0x7f0000000140)={0x100000000000002, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) iopl(0x0) r4 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0) unshare(0x8000400) r5 = mq_open(&(0x7f0000000000)=' \x00', 0x6e93ebbbcc0884f2, 0x0, 0x0) vmsplice(r5, &(0x7f00000007c0)=[{&(0x7f0000000040)="284a4b4ed9c37adb53fa8157751a45944fdaaf50a61869ea0b4da84a254098b1589a0be6ef4ef1caf04ebb0da895bdc7a05950d4935bee4d5d0776f7f31caa3bc1366ca0f8f8e982262ccc6c925c73acadae36ddb80a2576daed4d7c22b1ff5ea0c07368f9b93d90657baaad6480165a4a3cfe22fd8ad05da13ba4d7ffb03310a0bae67bfbc0425c6d2c1c89d0c4c474cafabd71611c7a589824c6ad59afaaf0cb4cb80c5d90b807ba9f5be97948a80e3c", 0xb1}, {&(0x7f0000000340)="39b8e82c1f98e75920cc70f86f3e862a8232048bf81026ba66f083b21603ddc938163457f280f0a4d271913eec57a0b884f8259c5e7608df3b12ce20bb91e637dfef6000df82ddb627d27cc98fae5dde7b4dbd0fb2166799379a9aade8aebcbd836454cd2ec73bd09a2e4e12560623a60a76ba4dc13744095befbd92da538621", 0x80}, {&(0x7f00000003c0)="d4710a1e652f98607149f9d5642262723ba3ad43766778401a1b5c5cd294b7ef279e52115fc33fd72bfb0e0986fafae2cec687bd799ab00c10f3b2e4eb3ab87b8d11cfa5992e41ee5f18f12b78ab98bc2a1b4e96facb7e6d082fe4975639a4326240cad692e1bb50782cfb5a213d3d49adfe9f832adf3b8c02bd25e640add870abd1e1f4c1afd68da74ccfea2ef5986a02eb", 0x92}, {&(0x7f0000000480)="422220f5c894d2f4974cdfa14bb274bd1b8bd0ec58b418ec8ebb4fd4c32ed8792225c1a1028e5560976c0cc24bb5cb4cc24966cba143e99c0acbab4f13cfb35ed0539e14245fc7d34eba34cbc4717fbbf51ae826235b41c9d196dcf80325c08271ca451402c285e3b165c62d0ed01dc7c13f99553ca03ec3305cbc6b7ecf17aa67857533b3e705f6dedd1e001926d58904f72a696567ab36960f9242211fa9867908d42705ab5fb09e63e4ee1c6ed1e3ba326264aafe99d3", 0xb8}, {&(0x7f0000000540)="6cdcccdd4e2eeb088fb869c5bed49ae51a329246891676b92f3e9c848f4e2226598e0d3768ee5467fd2662d9132c62b3249a4b1ca5dbdf9a2dc3308edffaea69d5277b8f5841c631d7e44af1e7b9c5f50b3d8f2a87687533c0b0af0fcdb5daa94cce683b4482df009ae616267a090914e7f889dc3229cd158dedba9ab2f14f73c662a6", 0x83}, {&(0x7f0000000600)="6b57a32592c42255f2f7cbe7fb28d32b414b0e53ab8a490552462cdcea2ce5ab79cdfe2a00247ae005edce78f3c993f30308316ca27a0adcd70125a416b058d9906055e623d81db3915c9cee5c853e7de44f04e211c580449bedd01680bf0c239ea4131722242f9beadcc10a5df044b5c81a2a2e28516a2759b1a62660782dd377c43cb830204a06cc00f476fb320ce68f5c5288", 0x94}, {&(0x7f00000006c0)="2146d588c87508ad025791d58c9b6f19473d49c4aca06dfaa7c680630c30e9d30d0f3179ab58c5b655e7ef8ddfa71cc99876787aa5cc15bd9a302549c90fc39d7f76f0115ad489f605d67e63a448054971e83cea17a4fa1dffd2582c96403763b752b612867cb4bc6db5d0d3b2d4fb488b61fa44a856684e1b2112a4720fc0b9bbbff4e21e6fb36bf64b3614a2259f2196e4f491df50a847717c6526b343edb3352fd9b0fd506decb8b5a40abfc1031177e89a4ddb6f6372a2405b0198d0bfe2e95ee0706ca1ba56921bf97464aae5143b7867b142963cb5270cc5c86e58ecf5c577e3dfe6cbdf61", 0xe8}], 0x7, 0x4) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/attr/current\x00', 0x2, 0x0) r6 = fcntl$getown(r3, 0x9) getsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f00000001c0), &(0x7f0000000280)=0xfe9d) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000840)=@assoc_value={r2, 0x5}, &(0x7f0000000880)=0xfffffffffffffe6c) mq_notify(r4, &(0x7f0000000100)={0x0, 0x15, 0x2, @tid=r6}) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r4, 0xc0505405, &(0x7f0000000ac0)={{0xffffffffffffffff, 0x0, 0x1, 0x2, 0x8}, 0xec2, 0x87c, 0xc}) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000b40)=@assoc_id=r2, 0x4) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/user\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f00000002c0), &(0x7f0000000300)=0x2e1) ioctl$EVIOCGABS2F(r4, 0x8018456f, &(0x7f0000000100)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 16:06:48 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:48 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x4d) 16:06:48 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240), 0x0) 16:06:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0063407562c240000000000023101619ab3fb800000000004fb813d5ba1744ec0000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 16:06:48 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='.\x00*\x00\x00\x00\x00\x00\x00\x00\x00\x10V6\x88Q\x06\x00\x00\x00\x00\x00\x00\x00\x03\x14\xabx\f\x00\x00\x04\x00', 0x200002, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x1000000020000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) shutdown(r0, 0x1) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}, &(0x7f00000000c0)=0x10) 16:06:48 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101000, 0x0) write$sndseq(r0, &(0x7f0000000040)=[{0x800, 0x0, 0x0, 0x0, @time, {0x0, 0x81}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 729.298308] binder: 32158:32160 ioctl 127b 20000000 returned -22 [ 729.329778] binder: 32158:32160 unknown command 1967153920 16:06:48 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 729.344700] binder: 32158:32160 ioctl c0306201 200003c0 returned -22 16:06:48 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240), 0x0) [ 729.376631] binder_alloc: binder_alloc_mmap_handler: 32158 20001000-20004000 already mapped failed -16 16:06:48 executing program 5: r0 = creat(&(0x7f0000000400)='./file0\x00', 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000080)={0x2, 0x7}, 0x2) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000800)={&(0x7f0000000340), 0x35ac9fadf8b64e5e, &(0x7f0000000580)={&(0x7f0000000840)=ANY=[], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4000080) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) ioprio_get$uid(0x3, 0x0) ioctl$EXT4_IOC_RESIZE_FS(0xffffffffffffffff, 0x40086610, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000140)={0x0, 0x1c6044c}, &(0x7f0000000700)=0x8) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000740)={r1, 0x0, 0x9, 0x178310fa, 0x4}, 0x14) ioctl$KVM_IRQ_LINE_STATUS(0xffffffffffffffff, 0xc008ae67, &(0x7f0000000180)) clone(0x83fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000100)='127/0.0.1\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000600)='9p\x00', 0x0, &(0x7f0000000280)=ANY=[]) setsockopt$inet_dccp_buf(r0, 0x21, 0x2, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='9p\x00', 0x8000, &(0x7f00000002c0)=ANY=[@ANYBLOB="2c616e616d653d776c63002c6d6d61702c7365636c6162656c2c7375626a5f726f6c653d862c00"]) mount(0x0, 0x0, 0x0, 0x0, 0x0) fcntl$getown(r0, 0x9) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f00000011c0)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001200)={&(0x7f0000000940)=ANY=[]}, 0x1, 0x0, 0x0, 0x4000001}, 0x20044880) bpf$PROG_LOAD(0x5, 0x0, 0x0) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000640), &(0x7f00000007c0)=0x10) r2 = syz_open_dev$media(&(0x7f0000002600)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r2, 0xc0487c04, &(0x7f0000000000)=""/226) [ 729.423505] binder: 32158:32160 ioctl 127b 20000000 returned -22 [ 729.448745] binder: BINDER_SET_CONTEXT_MGR already set 16:06:48 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x501001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @connect={{0xcc46, 0xf7}, {0x8, 0x10000}}}], 0x30) 16:06:48 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 729.481133] binder: 32158:32175 ioctl 40046207 0 returned -16 [ 729.504119] binder: 32158:32168 unknown command 1967153920 [ 729.545902] binder: 32158:32168 ioctl c0306201 200003c0 returned -22 16:06:48 executing program 4: timer_create(0xc2000000, 0x0, &(0x7f0000000040)) r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000080), 0x1) 16:06:48 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x0, 0x7ff}}], 0x30) 16:06:49 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x200}, &(0x7f0000000080)=0xc) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={r1, 0xb6}, 0x8) prctl$PR_GET_FP_MODE(0x2e) 16:06:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x2, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="05638ac2ab9e6571fc73240440"], 0x4, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 729.634896] 9pnet_virtio: no channels available for device 127/0.0.1 16:06:49 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c12c50288b070") r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r3) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x6, 0x4, 0x2ed3, 0x1, 0x0, 0x1}, 0x2c) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'vmac64(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="285474dae6badf3ab85f04000000d2eb", 0x10) r4 = accept(r0, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000004600)=[{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f00000016c0)="6ee47382003553c64ab73497beaea84f", 0x10}], 0x1}], 0x1, 0x0) 16:06:49 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x0, 0x7ff}}], 0x30) [ 729.727692] binder: 32198:32199 unknown command -1031118075 [ 729.752383] binder: 32198:32199 ioctl c0306201 20000000 returned -22 16:06:49 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0xc, 0x7, 0x0, 0x0, r0}, 0x2c) 16:06:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 729.795147] binder: 32198:32206 got transaction with invalid handle, 0 [ 729.822980] binder: 32198:32206 transaction failed 29201/-22, size 24-8 line 3126 16:06:49 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x49d26ec3, @time, {0x2}, {0x1}, @connect={{0x1000}, {0x8, 0xec}}}], 0x335) socket$caif_seqpacket(0x25, 0x5, 0x4) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000140)) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000280)=""/202) [ 729.872052] binder_alloc: binder_alloc_mmap_handler: 32198 20001000-20004000 already mapped failed -16 [ 729.934572] binder: BINDER_SET_CONTEXT_MGR already set 16:06:49 executing program 4: mount(0x0, &(0x7f0000027000)='./file0\x00', 0x0, 0x0, 0x0) mount(&(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000280)='./file0/f.le.\x00', &(0x7f0000000380)='nfs4\x00', 0x80, &(0x7f00000003c0)='+:,-vboxnet1security{\x00') r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) symlink(&(0x7f0000000040)='./file0/f.le.\x00', &(0x7f0000000140)='.//ile0\x00') ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000004c0)=""/26) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="757070ffffff7f723d2e2f66696c65302c6c6f7765726469723d2e3a66696c65302c776f726b6469723d2e2f66696c6531"]) r1 = open(&(0x7f0000000080)='./file0\x00', 0x101400, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f0000000440)=0xd000) renameat(r1, &(0x7f0000000240)='.//ile0\x00', r1, &(0x7f00000007c0)='./file0/f.le.\x00') linkat(r0, &(0x7f0000000000)='./file0/f.le.\x00', r1, &(0x7f0000000480)='.//ile0\x00', 0x0) 16:06:49 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x40000, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000140)={0x7bf5, 0x8}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair(0x0, 0x4, 0x80000001, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) accept$inet(r3, &(0x7f00000002c0)={0x2, 0x0, @dev}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x6, 0xffffffffffff0000, 0x0, 0x80000001}, &(0x7f0000000080)=0x14) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f00000000c0)={r4, 0x8e, 0x3ff}, 0x8) sendmsg$nl_route(r0, &(0x7f0000000bc0)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b80)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0100001000210600000000000000005e000000", @ANYRES32=0x0, @ANYBLOB="00002000003f3dd2a9f75f4c27d399084e540000001c0012000c00010067726574617000e7a6d8c8e7166845bdb1fd710534f333e9c1b829af1240b99e5148c3ef5b02cae41681ba2a84cbec65987fdf519966cc659bda154c31ce449c5667c12f06cf93d66c98434f15670f8c9b00a2a2f283949c664f55c4"], 0xffffffffffffff30}}, 0x0) 16:06:49 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x0, 0x7ff}}], 0x30) [ 729.961681] binder: 32198:32199 ioctl 40046207 0 returned -16 16:06:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 730.020462] binder: 32198:32225 unknown command -1031118075 16:06:49 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f0000000040)=0x200, 0x4) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 730.061801] binder: 32198:32225 ioctl c0306201 20000000 returned -22 [ 730.090573] binder_alloc: 32198: binder_alloc_buf, no vma [ 730.098598] overlayfs: unrecognized mount option "uppÿÿÿr=./file0" or missing value 16:06:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 730.122097] binder: undelivered TRANSACTION_ERROR: 29201 [ 730.129078] binder: 32198:32199 transaction failed 29189/-3, size 24-8 line 3035 [ 730.153874] binder: undelivered TRANSACTION_ERROR: 29189 16:06:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x282, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x800000000) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, 0x0, 0x220, 0x0, 0x0, 0x10000007a) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000340)={0x20000000007b, 0x0, [0x200000486]}) 16:06:49 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5}}], 0x30) 16:06:49 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$KIOCSOUND(r0, 0x4b2f, 0x7) 16:06:49 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000200)={0x0, 0x8}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000005c0)) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x80000000) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$sock_void(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000), 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000400)='net/tcp\x00\xcdWq\xe9*\a4g\a^\x90\xb6\xe4kH2\x80/\x88\xb6\xbb\xeb`\xb8@#\x83tH\xae\xa4y\x1d\\]\x93\x93\xb5e\xd9\xd4\xb8A# \xc8*s\xd0g>\x16\xabM\x7foK\xec\x17f\xb9x\x11\xbf\xab\x16\xc5\xcb\x94\xff\x1c\xa0\x01\xb3I\x1c\xb9\xcc\xbb\xbe\x9c\xd0!\x13\xe1\xbc.\xfaG3\x85\xe0,') sendfile(r1, r2, 0x0, 0x80000003) [ 730.319913] Unknown ioctl -1073172987 16:06:49 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 730.379550] binder_alloc: binder_alloc_mmap_handler: 32249 20001000-20004000 already mapped failed -16 [ 730.436379] binder: BINDER_SET_CONTEXT_MGR already set 16:06:49 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5}}], 0x30) [ 730.474728] binder: 32249:32256 ioctl 40046207 0 returned -16 [ 730.503385] Unknown ioctl -1073172987 16:06:49 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) r1 = syz_genetlink_get_family_id$fou(0x0) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x4, 0x70bd28, 0x25dfdbfd, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) [ 730.527251] binder: release 32249:32256 transaction 1848 out, still active [ 730.539973] binder: undelivered TRANSACTION_COMPLETE 16:06:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000240)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000011000/0x4000)=nil, 0x4000}, 0x1}) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r2, 0x400445a0, &(0x7f0000013000)) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000013000/0x2000)=nil, 0x2000}) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) rt_sigprocmask(0x0, &(0x7f0000834000)={0x7fffffff}, 0x0, 0x8) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) writev(r6, &(0x7f000000b000)=[{&(0x7f0000066000)=',', 0x1}], 0x1) tee(r5, r4, 0x5, 0x0) 16:06:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 730.596828] binder: send failed reply for transaction 1848, target dead 16:06:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$getregset(0x4204, r2, 0x200, &(0x7f0000000240)={&(0x7f0000000100)=""/115, 0xfffffffffffffffd}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dsp\x00', 0x80, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000200), 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:50 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x1004e20, @multicast1}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x100000001) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendto$inet(r0, 0x0, 0x0, 0x20048047, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000400)='G', 0x1, 0x0, 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = dup2(r1, 0xffffffffffffffff) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe802, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) close(r5) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980)={0x8, "7c70ee3800d5ab5f2036f872e0ac57cbd592bca0d671633f50a3102066d6e765f5a64731e3fb8d90d250eda2cc33b60a7ff98074cdc3f1dd1a2df26a381d95974e0925d521c6b48c3dee0d430d398884316091aff6adb6153dc3c92549957d3488efc02d6f6fb172524b095c30c1bd35aae04236bdd42694d613eb54c0b65a338c48dc4c8bad70754fc81d9928e4a1b81f9c77075258a0805b4494867247966b24a023311fd91ef3754b98d3acde6f2ef0617f123c22fccb81c11389fdfa2e21c2365aabfc8916e02151d8643ae21cab7fcbec6142186d3bb57546c106484bc4c28a48da2b75dd82aabe99464558e60cd101f6b65856fabee614d271741a68dd550c8772f06a93cf8e5c0de549c3b75a72f8a590bd50b2af5f64009c969ed7596f0192b0f98b1afac0e8c5f4c653f611b4a71776400a9ae3f18e75f856788c97195749042510735880b9bb0ccb23210832a4f1c6f134d68f8e299837c426e0c9a45d5d2c959446cc363f370c67cd01a063c91254d692fe35abee92fabda4f66d93228c979ebe036c5c2e0028ec76562d67d0919ca28258fec0ed60603142b5c57c4cfb1ea1e892d0fd2f33970142b179c415d6bea344fbcc82d133052e848a885160737c69eb02ca9f544831c8e3ffcf40cb7b415d24795fc8aaeb8e76bec262aea5e28fe5d6495c4b5895a612b1cc2122286add66356f3ecd309f970634f1b09da1507964d35575167317f13c7fd9f11af27ceea86e9a5b3494a27ba98ba38dd1fb72ef2c6163664fd8f7c946935cd4833121f505ff277c03d959d9a12f3389e9eb6701a8b29f72c20c6abb7bd8349dd2e120bdd59dca9f1a2a877f1677b59d7920ddf29b9d94f7c6879b78e31cf1b65b60fe349ef9d4976f46609ee34e33f647aafbf64f6323d18598905f2e73af75661397595b8f9c1e9a4e993946820da5378ca5b363560e95edce316e99bac6e6250efcf1cb58fdcf94c7557c2d7f763a688543462d54b64e178c2e64c6ebba356894973051907fd8de8ba908e822168b171c1707efcd9ac827e64313721876e2ff26ac34e88557a4a0dfde08eda81cf0c1465a89b68429e48966044c767563e1121db48c9b619fd7362afd15ec6aa19b28759d7977be4fbcad0cf8dd5dc5362259bd5cb5089a9d18db969afe1192571f5fcc0c4d6be281d23b9c1f9f32873c058adfa1bf57a3718686957edfd6e4b58aa959541127696d59fb2810d042ced227961eb19a424e4cf45bc6243217bb7561b7ee11f8c0b8f39480343a26f2da5fe79d5e213c01ea47155ffa91e7d7ba0bc8ccb018bd69cfe71dd8565a645d678b404a295397e83ae69dbf8505f6947a836b44823a92861124330fccd4bc4a2e20d9047bd919d82c89623caa87eb09bd584d58f42b35ef55fddc06dfb3957f3f507e5ca9b8b98947cc5bb68846755527ddf32ffa444e1c7a5654d4d377e04a9f22e1069804fdcdb251acb6bd6b32d100feb44286991d779d2b3e2b7f5cc5f8eb3ae166a3b6fb9df11e1867989a6f9b2028e4c73b4d418b51f6e870713cadafddb47a48c9a97283da214f02db3326d42438d9a7db580693ad1887f99d86bb5fafd6d07c2647fc80c2c5a1ed9ea3b95be65ca422080ddefca5b49ccd538f6bc67390f892d9e416f7e835f76dd90edc56256348d20560caeea05c0922cab60dbf0b57ddaaed6ded5a336e01485fd571dc12050461271cee347c31ac245bfee9128630dfcc43b6d88b5ba9937a6f6ab70b7d256784ff72297cfcfd0ffacd09b55fb832bf60f04d87c48c74972b9f18fa178ce4880b025d1c1097ddb929e8f7e02f1c0e03012bec0fa61a49eb1c2a50a45fc0d98b6649de325184006938e421321e8b366649d9b6ebadf77509c9d48844e80f7752fd7daaa5c938b946feaaac0d871203270a747035c7e2f697c84e792a55cbce76c0a25360f7acbeaab60627aa9c37064af75b67f46732844eb2f6b37226004afe451a9fbfbbcf7e72ade67b017e9209b5627fbe16789abd90326751a1fd1d93efc59f2650f979ba71938d784064922bee2874c4b76d5f26e39ea0a98cf175950137feff9456c88c6a295830183fae3a9c2312c25f3d81708d73488d15a587e7e7cdde3b77917eef29c8b5965c916a65c3c5a53b7313c3115d0a8bb4e16f6b80ff6f78adb756aba94ced86047562a2cd2fb25e9a4656f6359c3f2fde8b5ab38852853cbd7221cb4d59b7f0e79bd37f9ade073f62b75edbe63c13c0d02bf076d88f5b750ea640aad47ce97d6a0783398dd3fbb63734ed969470cf45200235650532224fc28caf1e36ca6b402ec4c978add40fc59f2113485875682139f8aa9aeb48d09178de919370b0cd0ebcab5e60e1b0a2fc153db0dae8e50b48561622a677d0f1afc149676f832e016e14007fb298dcb96f11a92a1ac8bd4cc7b34d659d6cd2c9817b586585e72080255b083bc84512277ffb7f561c6a7a08cd128bfe9b525da531f0bf04f11d3de102b3538835807ac0b2f4325fc6765d02d692ec82f5b338c8257029136fcd3427c09874ecc7492becdd6608eac4adf1abc3f7e08868a72e57ce4dcfc288a25af73d19f1118a9254963c1548cdca5fc7c921a7f218f8e71edd7969dfb35beae1091d7530e32236397fa9fcd232b441ff1b0177829468c198d659d247ccca4fbd58c625501e4368075d0e5e69a6f90952f5bbe48e85a303131dedf7f1a513b291598a545784e1013521877c25d6069d3a855652a4bad5b2df2e4da2de756a20e790b756dd2925ce824561e5892b5e064c7c7b996acc4e29597e0cd00956e9c57ec374714f846be7632d3075e38bead499163498810886c78a2cc73fb64fd48e186083ce911e0751b4dc63476859c2824fa532a4b1711c244619e702eeab19380aeb7b17f67fade3dcad8ddddd893a526cd5d04d8ae982c88029ec71bdd0772fd74adbdb378fc204ca411a2d8a50331516a28552be78f9725f32d1b3a6c7bdf3277c5f7e385c7ebbacc419ec7ca3c5b8f46dbefee59b6422a6b22d60527edc012f852077d925619874f7709f283e01678fed36528003a696ee431a817f34f453c143dc56b70e1f810a5380a555cc8c4fc6522ab544ce5d715caa302ebdd0aa8286b7ef5dd6dd48a8ad9566818f7509daf02db0b98b432f57f1d107ee95a86228728cab4062e27922381e1e2ee351af5e2ea0fd6d1cea70b3b8f4a50f0776fc9aa2a7d2dff6e1ea3769864104f09137b99960b69af13895d842649eacaed8ddf183beba3323640af8deb52b902c0974d685d19fc87c93eb80ad5d28e54363705ad39231d989522e94f000256bc8d93af138a45d67dad3e21fa9fb31d9327c6e71f61956d9daf4f97333112704136d3d1bf6fe0e4c002e10b684d2344300ec70fae0b50532ebace58f0e8318354a172cceacf27d01ff41cc8fef42443f62b0e15b5fcc0728630b96fb2c2b59634f4993bb1ce2eace6fb0f53e5f84bc5f58b1b66d59e3c75a98670496f105a703607211aa9e882e72f13e9fe07f0767ad4e5ac5c732b65301d8ceab36b5ff2f71958fb1b51d2e703ac506e68d4026160fd3f60440b8b8f554f1feeba5d53f71cbe60d143620f8fa779acb94c965b729207a5ab11f4a51b694c31606171da44a28d80cde296dff5724ff718d6377eb8534e616cff39af943ee4ce87b4fadded30c702d370a71072ab3e20f19b8c1b73fdbbb9c675352bb73ee85e22597fc0c439a33f5febe1629bd084af7193f8d1a1415b02ca54706711505cbae11ec6411b012cc3a3eddcfb002901b6e7565b9fbf4d605c147031888ceb590c14697d00970ce9095c6f7fee41ec6a15d7ef52dfedfff2a0d3dbb387b61232aee6ca202787038021e6aabda18e2adf6fd89aa491e65f9813d73412fbfff089752d713d7efa690ec4fc254b56908d3057f65997acf81aea589e272f8fa852849e488f1e0c0cb6cdb5f46ca92e36d39224e704850056d2e9b91909aed0f55d054e274415ecc39b8958335a14cfb0a42d7f26ef8e82592dfd03b3550b5193fba077994c682951968869574fd94976760d9bd9b334353eeda836cc8dab244e72095cc46833f02bb2f6df35601b3085664261abb67fc9ab9f27210e6827cd15ce16c55f0f7f5b8ab401f24032b19a53a9299b62ebf4a8cf7f4753d95126f008a8ce349036666de66bcaf40b27fa875efa98873e1ef9302e2a24bfe07bd1054bdf9ba9ad1b1075402f26d682833b947c762513ba5f07537bb712473184a60e04ace5adb8d982d6153b011ae0b2034adc0ff4a64e2c6561c2e0840cdab2120bc916cde9b7a92c4d332d0f83945fe55e3c8f4d93f22e7759c20241d92cca0ae5a3d06a127e5614df708cea1ad3b2f231c81460ff4c3f349c67a87135a4b67589ffce311832923f71796276e81f0537e265404c0ee06d5ed98a5ec5f8ad62db589eb585fc4627173b51fd4e897a3e8d2acbb82ec2996ac3a6823368a1e12a0536a9d1a7b2d31d80c46c292ff51395481d4f65c53fab867e27bec9156ee189d245d94877a1405dc9e1e996822ad47071a9ab36c9bfd02c41ea5ba21591793053b1b64758bae0addfcd69d169849bc1ee6ce5c08f0d3da5ecc1b6ab31e13af2fa5ce4d921163270901264a88ac6350e8fb6371663dd04146932238597258b123a8036250c190fbb3cfc6ebbf9e06c4a9053e8332c95c91a890a3d35ddd35f47e7ab606f3e345e12560e6d52243883da7b8910834042ad12e7fb3f08a0b14ef6aee22251999e6079be2ef5666d7d5ae00d161720262761da3f378c63cb151f4e94d034e9de949dfe796b905804ca555691023c30ea7cf0cb276e1e3ba65793291f8287d1064606bf5787421b9b9bfc05e9c5eac750de92519fe9e2592cd34a2ef6ec18efed5e7c13bfcfce47327cbecac358bbe6d44164849308cf91cd5ea87fa4b02ba4939e28141c7dad42714b019470d91808a8f46150677b6c90f267ecb39ef42afc95de0cbd016775c89d8213ec9d4e061e6493f237296f91abfc64176c0e885ef54af4136a724fadfe89a25d7599998acebc4a27f8fb5b26936bda5c3d5fec3373dcd9a0e99fc939641c50669adc54119582e8835575d1c57fa955cd29d870360620f91c3ff90d264013816352317ae226f7d7bad5db711f8973382f6cebd63cd519ddd08e1772649be75f64f4acc15f828dc0b305584b6dd2213194603c44e2964358d305aa97fb08568a0a955ad7a6f8d042754b4bbf2fb3414052719fd9841bef8360d1d3195c69414be882115c2c64fecdcbdaed3a2e943fdfef9a13520e41d32a787bcfe4f61e2b378d35aa70784a772cf8ebcaaeb105e4627516db2ababfcb8c11f224c3a48c86160d34d0ee59f02c31648ae4b0309b378f0bf63266967dcfb4f1cc1902f613c6d0d48915a9cf28a52b106544cde1b38ff2e2a1275fd0d3899ce7f7c6653c9017f7ac4aaa35bcb2811a8f9dbb56746b45475350e7c13d42abb5692377da7a4045ee644ce00f8699e3251d75621c82cd659ea3add277affe3ff792f7d24a3d0979ef82cfc0d409697ae2e8598854a8327f46974c901d309dc6dbe31913c59d821aa50c0fe95cc822e8f07bbb00e9a09bc9a570b9778d29308740bc336a41258d209c206f87a709aa43415da0096f7d177e509a7d625645fb098ccc45367d82235e952670ac5f82f8ced3f59fd9ee20ac75be609cc832417e807ddc40630cba4c91e0785edcb5f20b9e6dedb1ec172cd16fc034f410e9ce375ea855144aa3076317f649cf4efe4d7abf244984c4e", 0xfffffffffffffd14}, 0x10a9) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x4e21, 0x9, @mcast1, 0x800000000000000}}, 0x5, 0x1, 0xd1b, 0xffffffffffffe762, 0x9}, &(0x7f0000000200)=0x98) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000240)={0x0, 0xdd, 0x8, 0x3, 0xcf3, 0x143740, 0x3, 0x100, r6}, &(0x7f00000003c0)=0x20) ioctl$VIDIOC_G_STD(r3, 0x80085617, &(0x7f0000000140)) syz_genetlink_get_family_id$fou(0x0) truncate(&(0x7f0000000280)='./bus\x00', 0x7) fanotify_init(0x50, 0x80000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r8, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") ioctl$SIOCX25SFACILITIES(r7, 0x89e7, 0x0) 16:06:50 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5}}], 0x30) 16:06:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 730.760242] binder: BINDER_SET_CONTEXT_MGR already set [ 730.826635] binder: 32286:32287 ioctl 40046207 0 returned -16 [ 730.835929] binder_alloc: 32286: binder_alloc_buf, no vma 16:06:50 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet(0x10, 0x3, 0x0) open(0x0, 0x0, 0x1c0) pipe2(&(0x7f0000000300)={0xffffffffffffffff}, 0x0) accept4(0xffffffffffffffff, &(0x7f0000000380)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000440)=0x80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x182) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) ioctl$LOOP_CLR_FD(r1, 0x4c01) add_key$keyring(0x0, &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) creat(&(0x7f0000000240)='./file0\x00', 0x8) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, 0x0, &(0x7f0000000140)) memfd_create(&(0x7f00000002c0)='/dev/loop#\x00', 0x4) fcntl$setlease(r2, 0x400, 0x0) fsetxattr$security_smack_entry(r2, 0x0, &(0x7f0000000200)='syz', 0x3, 0x1) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) io_destroy(0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) ioctl$LOOP_CLR_FD(r1, 0x4c01) syz_genetlink_get_family_id$tipc2(&(0x7f0000000500)='TIPCv2\x00') syz_genetlink_get_family_id$tipc(&(0x7f00000008c0)='TIPC\x00') ioctl$LOOP_SET_FD(r1, 0x4c00, r2) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00') r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x2a, &(0x7f0000000000), 0x4) write$UHID_CREATE2(r0, &(0x7f00000005c0)={0xb, 'syz1\x00', 'syz0\x00', 'syz0\x00', 0x0, 0x2, 0x5, 0x7, 0x7fff, 0x8}, 0x118) 16:06:50 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x1000, @time, {}, {0x3, 0x3}, @addr={0x5, 0x7ff}}], 0x30) 16:06:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:50 executing program 1 (fault-call:1 fault-nth:0): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 730.920181] binder: 32286:32290 transaction failed 29189/-3, size 24-8 line 3035 [ 730.930892] binder: send failed reply for transaction 1852 to 32286:32287 [ 730.957524] binder: undelivered TRANSACTION_COMPLETE [ 731.002464] binder: undelivered TRANSACTION_ERROR: 29189 [ 731.041627] binder: undelivered TRANSACTION_ERROR: 29189 16:06:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x8000, 0x200001) fallocate(r1, 0x2, 0xe22, 0x7fff) write$P9_RWSTAT(r2, &(0x7f0000000140)={0x7, 0x7f, 0x2}, 0x7) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a6877885d0000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 731.127709] FAULT_INJECTION: forcing a failure. [ 731.127709] name failslab, interval 1, probability 0, space 0, times 0 [ 731.201232] CPU: 1 PID: 32317 Comm: syz-executor1 Not tainted 5.0.0-rc4+ #50 [ 731.208447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 731.217802] Call Trace: [ 731.220408] dump_stack+0x1db/0x2d0 [ 731.224080] ? dump_stack_print_info.cold+0x20/0x20 [ 731.229116] ? mark_held_locks+0x100/0x100 [ 731.233367] should_fail.cold+0xa/0x15 [ 731.237268] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 731.242389] ? ___might_sleep+0x1e7/0x310 [ 731.246575] ? arch_local_save_flags+0x50/0x50 [ 731.251161] ? __lock_acquire+0x572/0x4a30 [ 731.255413] ? print_usage_bug+0xd0/0xd0 [ 731.259489] __should_failslab+0x121/0x190 [ 731.263733] should_failslab+0x9/0x14 [ 731.267544] kmem_cache_alloc_trace+0x2d1/0x760 [ 731.272226] ? snd_seq_port_use_ptr+0x17c/0x1b0 [ 731.276902] ? lock_acquire+0x1db/0x570 [ 731.280886] snd_seq_port_connect+0xcf/0x740 [ 731.285809] ? snd_seq_get_port_info+0x500/0x500 [ 731.290590] ? kasan_check_write+0x14/0x20 [ 731.294846] ? do_raw_read_unlock+0x3f/0x70 [ 731.299212] ? _raw_read_unlock+0x2d/0x50 [ 731.303391] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 731.308942] snd_seq_ioctl_subscribe_port+0x1e5/0x310 [ 731.314145] snd_seq_kernel_client_ctl+0x101/0x150 [ 731.319145] snd_seq_oss_midi_open+0x695/0x860 [ 731.323753] ? snd_seq_oss_midi_setup+0x50/0x50 [ 731.328431] ? lock_acquire+0x1db/0x570 [ 731.332434] ? lock_release+0xc40/0xc40 [ 731.336426] snd_seq_oss_process_event+0x96d/0x2710 [ 731.341454] ? set_echo_event+0x3b0/0x3b0 [ 731.345614] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 731.351191] snd_seq_oss_write+0x43c/0xb50 [ 731.355463] ? snd_seq_oss_read+0x490/0x490 [ 731.359803] ? ___might_sleep+0x1e7/0x310 [ 731.363965] odev_write+0x5a/0x90 [ 731.367432] __vfs_write+0x116/0xb40 [ 731.371154] ? odev_poll+0x90/0x90 [ 731.374756] ? kernel_read+0x120/0x120 [ 731.378660] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 731.384223] ? __inode_security_revalidate+0xda/0x120 [ 731.389421] ? avc_policy_seqno+0xd/0x70 [ 731.393490] ? __sanitizer_cov_trace_cmp4+0x16/0x20 16:06:50 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$TIOCMBIS(r0, 0x5416, &(0x7f00000000c0)=0x8) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:50 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 731.398513] ? selinux_file_permission+0x92/0x550 [ 731.403398] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 731.408946] ? security_file_permission+0x94/0x320 [ 731.413892] ? rw_verify_area+0x118/0x360 [ 731.418052] vfs_write+0x20c/0x580 [ 731.421622] ksys_write+0x105/0x260 [ 731.425278] ? __ia32_sys_read+0xb0/0xb0 [ 731.429353] ? trace_hardirqs_off_caller+0x300/0x300 [ 731.434464] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 731.439240] __x64_sys_write+0x73/0xb0 [ 731.439568] binder_alloc: binder_alloc_mmap_handler: 32322 20001000-20004000 already mapped failed -16 16:06:50 executing program 4: r0 = memfd_create(&(0x7f0000000000)='\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\f\xac\"\xf2\xb6', 0x0) fcntl$setpipe(r0, 0x407, 0x2) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x400, 0x0) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f0000000180)={0x0, @reserved}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000f6bfe8)) mprotect(&(0x7f00001d1000/0x2000)=nil, 0x2000, 0x0) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000000)) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x400, 0x0) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r3, 0x80845663, &(0x7f0000000080)={0x0, @reserved}) [ 731.443134] do_syscall_64+0x1a3/0x800 [ 731.443154] ? syscall_return_slowpath+0x5f0/0x5f0 [ 731.443181] ? prepare_exit_to_usermode+0x232/0x3b0 [ 731.453042] binder: BINDER_SET_CONTEXT_MGR already set [ 731.456516] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 731.456543] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 731.456556] RIP: 0033:0x458089 16:06:50 executing program 1 (fault-call:1 fault-nth:1): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 731.456571] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 731.456595] RSP: 002b:00007f22fb020c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 731.456610] RAX: ffffffffffffffda RBX: 00007f22fb020c90 RCX: 0000000000458089 [ 731.456619] RDX: 0000000000000030 RSI: 0000000020000240 RDI: 0000000000000003 [ 731.456632] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 731.464481] binder: 32322:32323 ioctl 40046207 0 returned -16 [ 731.466551] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22fb0216d4 16:06:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x2400, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r2, 0x80605414, &(0x7f0000000100)=""/109) syncfs(r1) setsockopt$inet6_MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000180)={{0xa, 0x4e22, 0x0, @loopback}, {0xa, 0x4e23, 0x8000, @mcast1, 0x738}, 0x2, [0x9, 0x65, 0x1000, 0x0, 0x999, 0x5, 0xfffffffffffffffe, 0x8000]}, 0x5c) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000008d025866d69573599d5b9c208a14b96b1176fce088b9aa41f34fd160ceb67dbec2"]], 0x0, 0x0, 0x0}) [ 731.466560] R13: 00000000004c7560 R14: 00000000004dcfd0 R15: 0000000000000004 [ 731.484502] binder: send failed reply for transaction 1857 to 32322:32323 [ 731.563382] binder: undelivered TRANSACTION_COMPLETE [ 731.568885] binder: undelivered TRANSACTION_ERROR: 29189 [ 731.578019] print_req_error: I/O error, dev loop0, sector 768 flags 80700 16:06:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:51 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) write$sndseq(r0, &(0x7f0000000080)=[{0x2, 0x6, 0x2, 0xffffffff, @tick=0x8001, {0x0, 0x1f}, {0x40, 0x80000001}, @connect={{0x2, 0x3e}, {0x2, 0xfffffffffffffffe}}}, {0x1f, 0x0, 0xb87, 0x3, @time={r1, r2+10000000}, {0x3, 0x4}, {0xc1, 0x9}, @connect={{0x4, 0x91}, {0xfffffffffffffffb, 0xe2}}}], 0x60) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 731.787616] print_req_error: I/O error, dev loop0, sector 640 flags 80700 [ 731.810836] binder: BINDER_SET_CONTEXT_MGR already set [ 731.849449] binder_alloc: 32345: binder_alloc_buf, no vma [ 731.855043] binder: 32345:32347 transaction failed 29189/-3, size 24-8 line 3035 [ 731.920271] binder: release 32345:32346 transaction 1861 out, still active [ 731.929167] binder: 32345:32346 ioctl 40046207 0 returned -16 [ 731.935313] binder: undelivered TRANSACTION_COMPLETE [ 731.969593] binder: send failed reply for transaction 1861, target dead 16:06:51 executing program 5: syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r0 = accept4$inet(0xffffffffffffff9c, &(0x7f00000002c0)={0x2, 0x0, @empty}, &(0x7f0000000300)=0x10, 0x800) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000340)={0x0, @in6={{0xa, 0x4e22, 0x9, @remote, 0x2}}, 0x3f, 0x3, 0x9, 0x800, 0x10}, &(0x7f0000000400)=0x98) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000440)=@assoc_value={r1, 0x9}, &(0x7f0000000500)=0x8) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000080)={0x0, 0x520, 0x8, 0xfff, 0x80000001, 0x80000001, 0x8f92, 0x800, {0x0, @in6={{0xa, 0x4e21, 0x2c, @remote, 0x2}}, 0x1, 0xb7, 0x100, 0x9, 0xffffffff00000000}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000180)={r3, @in={{0x2, 0x4e20, @remote}}, [0x2, 0x9, 0x5, 0x1, 0x1f, 0x3, 0x5, 0x80, 0x6, 0x8, 0x6, 0x100000001, 0x1, 0x6, 0x3dba]}, &(0x7f0000000280)=0x100) r4 = syz_open_dev$ndb(0x0, 0x0, 0x8010) ioctl$NBD_CLEAR_SOCK(r4, 0x1261) 16:06:51 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x80000006}]}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) write(r1, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x3ff, 0x141000) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000100)={0x74, 0x0, [0x5, 0x101, 0x80000001, 0x53b]}) ioctl$PPPIOCDISCONN(r2, 0x7439) 16:06:51 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x40, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000001c0)={r3, 0x1fb6, 0x5, [0x400, 0x8, 0x3, 0x64, 0xfffffffffffffff7]}, 0x12) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="000000800000009a85afb46c5f98a2ebe97c389b1d820000"]], 0x0, 0x0, 0x0}) r4 = openat$md(0xffffffffffffff9c, &(0x7f0000000100)='/dev/md0\x00', 0x0, 0x0) r5 = add_key(&(0x7f0000000440)='ceph\x00', &(0x7f0000000480)={'syz', 0x2}, &(0x7f00000004c0)="61ba99ed2d47b0c1efebe02c94addc29f2fb9bc3279410f12ec1f1ec971fe3495d6ffd3d3e6b8f34bdcb57166c87ee8682b43f6b1a62851306f11a358a69df682dbefde41a8a3f0725d1e37a872c9f02dc0cb8ec4b707853bb0a2b210748ecd6ef98ad1c7ed7ac8544004a93a5e27d3f2167aa5aa895c9571b0acb3e1358c1b4404c3c73844764997e42b4b17e1ce7b7a5794ecee6afbcf8e7ca41040f1a34fe4a8f8476a9f699a21fb8ca65497342c544064cc6a026e1c6e6cbcb56d4b6355eb808607e25e8dd0f4f0d298bd91afa5266c56ae88f783455a033a722", 0xdc, 0xfffffffffffffffd) add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000300)="d657cb888c3d7f9b1686186a3d0db52a30513c611821fe0aa2b723c826f4bddecf5ed6b365b9c3fdeabbbb19dd2d8744705648054015479b14208a21abe512f06899", 0x42, r5) ioctl$NBD_SET_TIMEOUT(r4, 0xab09, 0x0) 16:06:51 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @tick=0x6, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 732.134776] binder: 32368:32373 got transaction with invalid offset (-7349874589721165824, min 0 max 24) or object. 16:06:51 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x300fff, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:51 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x2, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 732.198051] binder: 32368:32373 transaction failed 29201/-22, size 24-8 line 3097 16:06:51 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x214001, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000040)=0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000100)="460f300f07c483614804ee08440f20c03506000000440f22c0c402f93473230f09f20f013cb9b805000000b9c00000000f01d90fc728c4c1f9e79f2e000000", 0x3f}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 732.250831] binder_alloc: binder_alloc_mmap_handler: 32368 20001000-20004000 already mapped failed -16 [ 732.303908] binder: BINDER_SET_CONTEXT_MGR already set 16:06:51 executing program 4: syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) lremovexattr(&(0x7f0000000040)='./file0\x00', 0x0) write$FUSE_NOTIFY_INVAL_INODE(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') read$FUSE(0xffffffffffffffff, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) pipe(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x10000014c) setrlimit(0x7, &(0x7f0000000340)={0x3f, 0x7}) syz_open_pts(r2, 0xa0000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$key(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1a8bb597feb51f0c6da1e17148e5bf13590a55818a40402fff2555907816f2924a864786a26d8be0a0c58f4c0cfdfbccca636f6015a2f641a8d996bd4495825380dd17b9e0b02d0e3d3fd072831fc775df1f367d33fa27c48af8d94195858a66cb7ce5295fadc8ea9be3c7d24815e0f8df84bb3d5c2b42"], 0xffffffffffffff31}}, 0x20000000) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) 16:06:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:51 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x0, 0x29}, @addr={0x5, 0x7ff}}], 0x30) [ 732.374440] binder_alloc: 32368: binder_alloc_buf, no vma [ 732.405952] binder: 32368:32379 transaction failed 29189/-3, size 24-8 line 3035 [ 732.445739] binder: 32368:32388 ioctl 40046207 0 returned -16 [ 732.459867] binder_release_work: 1 callbacks suppressed [ 732.459873] binder: undelivered TRANSACTION_ERROR: 29201 16:06:51 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x3, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 732.492751] binder: undelivered TRANSACTION_ERROR: 29189 16:06:51 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7, 0x200802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x2001d, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:52 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x4, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @local, @remote}, &(0x7f00000000c0)=0x393) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'veth1_to_bridge\x00', r1}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r0, 0x40bc5311, &(0x7f0000000280)={0x29d, 0x0, 'client0\x00', 0xffffffff80000002, "f7f2f2dcafa84a6a", "57a13c48ae573f45dd9fd076c9ce36d4f1ee94da6c6e99482b5f483cd4cfad95", 0x4, 0xb87dca4}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x7, r1, 0x1, 0x5, 0x6, @broadcast}, 0x14) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result={0xe61d, 0x1}}], 0x30) prctl$PR_GET_SECCOMP(0x15) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000180)) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000340)={0x0, @bt={0x9, 0x1, 0x0, 0x2, 0x400, 0x3, 0x6, 0x100000001, 0x71cde8b3, 0x80000000, 0xf5b, 0x1, 0x5, 0x2, 0xa, 0x30}}) [ 732.704906] binder_alloc: 32413: binder_alloc_buf, no vma 16:06:52 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0xfc, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0x2000000000003) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f000000d000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r4, 0x2288, &(0x7f0000000080)) 16:06:52 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 732.745428] binder: 32413:32414 transaction failed 29189/-3, size 24-8 line 3035 [ 732.849355] binder: BINDER_SET_CONTEXT_MGR already set [ 732.854694] binder: 32413:32430 ioctl 40046207 0 returned -16 16:06:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x200000, 0x0) setsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000080)=0x80000000063, 0x2) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) getsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x4, 0x0, @tick=0x3f, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:52 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x5, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 732.948732] binder_alloc: 32413: binder_alloc_buf, no vma [ 732.974128] binder: 32413:32430 transaction failed 29189/-3, size 24-8 line 3035 [ 732.994951] binder: undelivered TRANSACTION_ERROR: 29189 [ 733.051637] binder: undelivered TRANSACTION_ERROR: 29189 16:06:52 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0adc1f023c123f3188a070") r1 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r1, 0x107, 0xb, &(0x7f0000651000)=""/240, &(0x7f0000ca5ffc)=0x4) sync_file_range(r1, 0x1, 0x20, 0x1) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x401, 0x0) ioctl$KDSKBLED(r2, 0x4b65, 0xd9) r3 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x1, 0x2) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000040)={0xff, 0x80000000, 0x7, 0xfff}, 0x10) alarm(0x10000) 16:06:52 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:52 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0x2080000044000, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000540)=""/183) r1 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$SIOCX25SSUBSCRIP(r0, 0x89e1, &(0x7f0000000440)={'bond_slave_1\x00', 0x2c, 0x1000}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB='\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00bc47ebe3000000"]], 0x0, 0x0, 0x0}) 16:06:52 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x8, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:52 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x8000, 0x0) ioctl$int_in(r0, 0x800000c0045005, &(0x7f0000000000)) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xfffffffffffffffd, 0x2015, r0, 0x0) 16:06:52 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x101001, 0x0) mknod(&(0x7f0000000180)='.\x00', 0x0, 0x1) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x7, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 733.468416] binder: 32453:32461 got transaction to context manager from process owning it [ 733.493428] audit: type=1400 audit(1548778012.839:162): avc: denied { map } for pid=32452 comm="syz-executor5" path="/dev/dsp1" dev="devtmpfs" ino=17968 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file permissive=1 16:06:52 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:52 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x7fffffff, 0x8080) prctl$PR_GET_KEEPCAPS(0x7) ioctl$EVIOCGBITSND(r0, 0x80404532, &(0x7f0000000080)=""/223) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x101001, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x1188c73f98823445) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f00000002c0)={{0x7000, 0x4, 0x9, 0x401, 0x9, 0xf40, 0x1, 0x0, 0x5, 0x40, 0x2, 0x4}, {0x5000, 0x3000, 0xd, 0xfffffffffffff525, 0x1, 0x3ff, 0x6, 0x1, 0x0, 0x4, 0xea, 0x8}, {0x14000, 0x5001, 0xd, 0x4, 0x7, 0x1, 0x10000, 0x80, 0x400000000000, 0x9, 0x1790, 0x9}, {0x100001, 0x0, 0x8, 0x2, 0x9cd, 0x8001, 0x60000, 0x5, 0x3f, 0x675e, 0x35fa, 0x200}, {0x1000, 0x0, 0xc, 0x89, 0x5, 0x3783, 0x0, 0x3, 0xffffffff80000000, 0x8001, 0x3a, 0x4}, {0x1, 0x3002, 0xb, 0x3, 0x400, 0xf03, 0x1, 0x0, 0x10001, 0x1000, 0xb9e7, 0x5}, {0xf000, 0xd000, 0xe, 0x8, 0x70, 0x7e2b, 0x5, 0x1, 0x1, 0x6, 0x0, 0x1de}, {0x4001, 0x12000, 0x1f, 0x7, 0x3, 0x9, 0x1800000000, 0x8000, 0x1, 0xfff, 0x4, 0x4}, {0x0, 0xf000}, {0x0, 0x1}, 0x5, 0x0, 0xd000, 0x200, 0x3, 0x4000, 0x1002, [0x5, 0x2, 0x2, 0x800]}) syncfs(r1) write$sndseq(r1, &(0x7f0000000240), 0x0) 16:06:52 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x42, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 733.509015] binder: 32453:32461 transaction failed 29201/-22, size 24-8 line 2887 16:06:53 executing program 5: r0 = socket(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x58, &(0x7f0000000240)=[@in6={0xa, 0x4e24, 0x101, @dev={0xfe, 0x80, [], 0x12}}, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x7, @ipv4={[], [], @multicast2}, 0x4}, @in={0x2, 0x4e24, @rand_addr=0x28ff}]}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x3, 0x20, 0x10000, 0x8, 0x7, 0x7ff, 0x7, {r1, @in={{0x2, 0x4e23, @rand_addr=0xfff}}, 0xb32, 0x1, 0xfffffffffffff81a, 0x1000, 0x350f}}, &(0x7f00000001c0)=0xb0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000200)={r2, 0x7, 0x2, [0x9, 0x1]}, 0xc) setsockopt$inet6_int(r0, 0x29, 0x11, &(0x7f0000000080)=0x3, 0x4) [ 733.619312] binder_alloc: binder_alloc_mmap_handler: 32453 20001000-20004000 already mapped failed -16 [ 733.638859] binder: BINDER_SET_CONTEXT_MGR already set 16:06:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) openat$cgroup(r0, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {0xfffffffffffffffe}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 733.665253] binder: 32453:32473 ioctl 40046207 0 returned -16 [ 733.675976] binder: undelivered TRANSACTION_ERROR: 29201 16:06:53 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xbf, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:53 executing program 4: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0xc0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x15, @empty, 0x3}, @in6={0xa, 0x4e22, 0x8000, @mcast2, 0x22}], 0x38) setsockopt$RDS_RECVERR(r0, 0x114, 0xa, &(0x7f0000000080), 0x4) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000140)=[0x3, 0x48]) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000040)=0x101) 16:06:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x300, 0x0) sendmsg$alg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="acdbc7239234e6086309348cd2ca7319c064ae5d2aff8e07ab08ec659d1e1e0a4311992e9f828e389afa729ba6c52313c82911ccd041e37967c34e4f15fd13ae217df2c33f2eabeb5e624925911867ef2420ebd4b0913bfd0c5cc7a6e9000b4ff070c67aa4d70d561586d01b2a480d66bdfda123d933a9bd9af6a27128802aa3065cc8da3f176d5f04253723a500ff01edf026c8da1f3b98a46f6dfd6eeac9bbffc7d95d6f923ca3aa53d477e644e180ae7016b02a8a7480e56635feb2daa451ca025fb90ad577cbcb931fffc7dddd7eee7978ca341e92cc9225933f3cb3c548d5f176d97532", 0xe6}], 0x1, &(0x7f0000000440)=[@iv={0xf8, 0x117, 0x2, 0xe4, "032bded23037a31012b69a49e2e26964aaaa747f73fe414d4eeb32ef2ce940f5faf68fbf802a1e7cd41051cec00882825bb97a2f11a82ff0623a19c206f69770dc4715b7ad62c96493e8f6d1fedf00be6147ec04d9aff4dd22a4f719d71fccafce3be6f0bd708a1c4e1848a63ec528b40d20909c45c45392f6f7243ce18f3af90a9ba30c05f5d2251d97be55a6e6cacc7074084d237051a030fbcfe480ac8d056e4f883d58bbe5cc55d9396f8f07b845e8de0157c5cde2da347955e4fa9194701e021f20a44ce36cfa6f5fbc33b13681702c77bd76eb3759f24e2cddf9af02d178a78209"}, @assoc={0x18, 0x117, 0x4, 0x6}, @assoc={0x18, 0x117, 0x4, 0x4279794a}, @iv={0xd0, 0x117, 0x2, 0xb9, "d6270358f0990e3df5d05675e7c15d60417571f5359318f84b9c4f5af4a5911d8a4bc1fca4167dcba02a29a7766070ee12d38b5b3a4e994f2ecc034839dee46667e4b6e201a199554758ebd72a3baf9bbffc5aca09351d733ddd447702f3075a73e1da1c608bb7d3b72f029d1763cf3b5abfcdb74f1ca00c91a63ef62a2192cc85941d503421abaf7251fb7e80395101f4227e9185ffd045cdf5d81828a6e61e9f2372a7abd0594f198271929387d176353c21e1137536a7cf"}], 0x1f8, 0x1}, 0x10) ioctl$BLKDISCARD(r2, 0x1277, &(0x7f0000000300)=0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:53 executing program 5: recvmsg$kcm(0xffffffffffffff9c, &(0x7f00000000c0)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/237, 0xed}, {&(0x7f0000000300)=""/203, 0xcb}, {&(0x7f0000000400)=""/179, 0xb3}, {&(0x7f0000000080)=""/2, 0x2}, {&(0x7f00000004c0)=""/213, 0xd5}], 0x5, &(0x7f0000000640)=""/156, 0x9c}, 0x40010100) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000700), &(0x7f0000000740)=0x8) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r2 = semget(0x2, 0x2, 0x100) semctl$SEM_STAT(r2, 0x4, 0x12, &(0x7f0000000880)=""/4096) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x3, 0x2) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000001880)={0x2, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1, 0x6, [{{0x2, 0x4e23, @rand_addr=0x80000001}}, {{0x2, 0x4e24, @multicast1}}, {{0x2, 0x4e20, @remote}}, {{0x2, 0x4e20, @remote}}, {{0x2, 0x4e24, @empty}}, {{0x2, 0x4e23, @empty}}]}, 0x390) write$P9_RLINK(r3, &(0x7f0000000100)={0x7, 0x47, 0x1}, 0x7) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f00000004c0)={0x0, 0x7ffffd}, &(0x7f00000002c0)) r4 = socket$inet(0x2, 0x1, 0x0) dup(r4) connect$inet(r4, &(0x7f0000000780)={0x2, 0x4e23}, 0x10) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f0000002600)='./file0\x00', 0x0, 0x2001001, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f00000024c0), 0x100032, &(0x7f0000000080)={[{@data_err_ignore='data_err=ignore'}]}) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c9, &(0x7f0000000100)) 16:06:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xffffffffffffffff, 0x0, 0x0, 0x0, @tick=0x4, {}, {}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e21, @empty}}, [0xfff, 0xffffffff, 0x1ff, 0xd7cb, 0x3, 0x1, 0x79f410d3, 0x100000001, 0x1f, 0x9, 0x2cd, 0x8, 0x10000, 0x7, 0x7]}, &(0x7f0000000140)=0x100) syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x80, 0x401) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000180)={0x9, 0x8, 0x8, 0x7e, r1}, 0x10) [ 733.901831] binder_alloc: binder_alloc_mmap_handler: 32496 20001000-20004000 already mapped failed -16 16:06:53 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x1a0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 733.959611] binder: BINDER_SET_CONTEXT_MGR already set 16:06:53 executing program 4: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000040)={0x1, 0x0, 0x6, 0x0, 0x8001}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000240)={0x79}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0x6002) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000100)="460f300f07c483614804ee08440f20c03506000000440f22c0c402f93473230f09f20f013cb9b805000000b9c00000000f01d90fc728c4c1f9e79f2e000000", 0x3f}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mremap(&(0x7f0000fed000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) [ 733.982085] binder: 32496:32497 ioctl 40046207 0 returned -16 [ 734.008766] binder: release 32496:32497 transaction 1880 out, still active [ 734.017867] binder_alloc: 32496: binder_alloc_buf, no vma [ 734.024625] binder: undelivered TRANSACTION_COMPLETE 16:06:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 734.047861] binder: send failed reply for transaction 1880, target dead [ 734.054990] binder: 32496:32500 transaction failed 29189/-3, size 24-8 line 3035 [ 734.087773] binder: undelivered TRANSACTION_ERROR: 29189 16:06:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = accept(0xffffffffffffff9c, &(0x7f0000000100)=@ll, &(0x7f0000000000)=0x80) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000440)={'filter\x00', 0x0, 0x0, 0x0, [], 0xa, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x118) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0xaf, 0x9, 0x5, 0xeb, "1bcbd3392dbe16182541c27aa1f277b8467001686d57229de6006423254d405c"}) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0x80045500, &(0x7f0000000080)) 16:06:53 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x300, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 734.260231] EXT4-fs error (device sda1): ext4_remount:5236: Abort forced by user [ 734.285247] EXT4-fs (sda1): Remounting filesystem read-only 16:06:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x101005, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 734.437507] binder_alloc: binder_alloc_mmap_handler: 32531 20001000-20004000 already mapped failed -16 16:06:53 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x500, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:53 executing program 5: recvmsg$kcm(0xffffffffffffff9c, &(0x7f00000000c0)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000200)=""/237, 0xed}, {&(0x7f0000000300)=""/203, 0xcb}, {&(0x7f0000000400)=""/179, 0xb3}, {&(0x7f0000000080)=""/2, 0x2}, {&(0x7f00000004c0)=""/213, 0xd5}], 0x5, &(0x7f0000000640)=""/156, 0x9c}, 0x40010100) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000700), &(0x7f0000000740)=0x8) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r2 = semget(0x2, 0x2, 0x100) semctl$SEM_STAT(r2, 0x4, 0x12, &(0x7f0000000880)=""/4096) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x3, 0x2) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000001880)={0x2, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1, 0x6, [{{0x2, 0x4e23, @rand_addr=0x80000001}}, {{0x2, 0x4e24, @multicast1}}, {{0x2, 0x4e20, @remote}}, {{0x2, 0x4e20, @remote}}, {{0x2, 0x4e24, @empty}}, {{0x2, 0x4e23, @empty}}]}, 0x390) write$P9_RLINK(r3, &(0x7f0000000100)={0x7, 0x47, 0x1}, 0x7) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f00000004c0)={0x0, 0x7ffffd}, &(0x7f00000002c0)) r4 = socket$inet(0x2, 0x1, 0x0) dup(r4) connect$inet(r4, &(0x7f0000000780)={0x2, 0x4e23}, 0x10) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f0000002600)='./file0\x00', 0x0, 0x2001001, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f00000024c0), 0x100032, &(0x7f0000000080)={[{@data_err_ignore='data_err=ignore'}]}) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c9, &(0x7f0000000100)) 16:06:53 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) 16:06:53 executing program 4: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x1f, 0x200040) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000001c0)=""/185) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r1, 0x40a85321, &(0x7f0000000100)={{0xda8, 0x3}, 'port0\x00', 0xa6, 0x0, 0x6, 0x5, 0x96c9, 0xffffffffffffff74, 0x1, 0x0, 0x3, 0x81}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f00000000c0)='/dev/mixer\x02', 0xa) [ 734.506319] binder: BINDER_SET_CONTEXT_MGR already set [ 734.564851] binder: 32531:32539 ioctl 40046207 0 returned -16 16:06:53 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 734.614869] binder: release 32531:32539 transaction 1885 out, still active [ 734.622466] binder: undelivered TRANSACTION_COMPLETE [ 734.668595] binder: send failed reply for transaction 1885, target dead 16:06:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000000)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:54 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x3f00, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:54 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x40012, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000002040)={{{@in=@loopback, @in6=@initdev}}, {{@in=@multicast2}, 0x0, @in=@loopback}}, &(0x7f0000002140)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000024c0)={{{@in6=@dev, @in6=@loopback}}, {{@in=@multicast1}, 0x0, @in=@loopback}}, &(0x7f00000025c0)=0xe8) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000005100)={@broadcast, @broadcast}, &(0x7f0000005140)=0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000005180)={'gretap0\x00'}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000051c0)={@loopback, @dev}, &(0x7f0000000100)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000005240)={{{@in=@dev, @in6=@loopback}}, {{@in=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000005340)=0xe8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x7fffffff, 0x20, 0x4, 0x7fffffff}, &(0x7f0000000240)=0x18) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000280)={r2, 0x5, 0x6}, &(0x7f00000002c0)=0x8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000005380)={@dev, @dev}, &(0x7f00000053c0)=0xc) getsockname$packet(0xffffffffffffff9c, &(0x7f0000006b80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000006bc0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000006e40)={{{@in=@local, @in=@empty}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000006f40)=0xd0) r3 = accept$packet(r0, &(0x7f0000006f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000006fc0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000008580)={{{@in6=@dev}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000008680)=0xe8) ioctl$sock_proto_private(r3, 0x89eb, &(0x7f0000000580)="b8e6d6d8b18bf5f6627214f9b7abaa5df7c41849bf077a2a6cc667f771df551e30edf30bc2b07f44310736e0b9584a3b16d608d595295b7199e716426ad7998ff58935be7c534d68545a056f17070f376a87c03772ad7df021307fad64874c480e466c6b923a7cd27ac53ab195e23beb59edc2085d886b021553bc6be084587c2d52e3") accept4$packet(0xffffffffffffffff, &(0x7f00000086c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000008700)=0x14, 0x80800) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000008880)={0x0, @multicast2, @empty}, &(0x7f00000088c0)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000008900)={'team0\x00'}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000008940)={0x0, @initdev, @empty}, &(0x7f0000008980)=0x5) getpeername$packet(0xffffffffffffffff, &(0x7f00000089c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000008a00)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000009100)={'team0\x00'}) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000640)) accept$packet(0xffffffffffffff9c, &(0x7f0000009380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000093c0)=0x14) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f00000094c0)={@empty}, &(0x7f0000009500)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000009580)={{{@in=@local, @in6}}, {{@in=@broadcast}, 0x0, @in=@remote}}, &(0x7f0000009680)=0xe8) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00\x00\x00', 0x2761, 0x0) write$cgroup_int(r4, &(0x7f0000000080)=0x200000, 0x297ef) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x0, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000380)=[{0x18, 0x0, [0x4, 0x4, 0xebf, 0x9503, 0x6, 0x3, 0x6, 0x4, 0x1, 0xcd, 0x70, 0x3, 0x9a0, 0x2, 0x200, 0x1]}, {0x2, 0x0, [0x2, 0x7, 0x6, 0x2, 0x5, 0xf1, 0x2, 0x8, 0x9, 0x3fc0000000, 0x8, 0x4a, 0x9, 0x10001, 0xffffffff, 0x9]}, {0x8, 0x0, [0x0, 0x1, 0x0, 0x3f, 0x4, 0x80000000, 0x4, 0x158, 0x0, 0x7, 0x10001, 0x6, 0x60ee, 0x81, 0x4, 0x2]}, {0x18, 0x0, [0x20, 0x6, 0x2, 0x3, 0xff, 0x0, 0x7, 0x2, 0x4, 0x7f, 0x7ff, 0x5, 0x7, 0x80, 0x9, 0x1]}, {0x14, 0x0, [0x8, 0x3, 0x7f, 0x0, 0x8001, 0x80000000, 0x10000, 0x3f, 0x5, 0x456a, 0x7, 0x3f, 0x8, 0x6092dc2e, 0x0, 0x5]}, {0x1a, 0x0, [0xffffffffffff8000, 0x3, 0x1, 0x1000, 0x82, 0x2, 0x6, 0x1, 0x6, 0x5, 0x40, 0x0, 0x3, 0x6, 0x214, 0x67e]}, {0x10, 0x0, [0x20, 0x2, 0x5, 0x3, 0x1, 0x8, 0x3, 0xd70f, 0x2, 0x100000001, 0x3, 0x6, 0x8001, 0x1ff, 0x10000, 0x1]}], r5, 0x1, 0x1, 0x1f8}}, 0x20) 16:06:54 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x49, 0x240) ioctl$KVM_SET_FPU(r0, 0x41a0ae8d, &(0x7f0000000280)={[], 0x1ff, 0x10000, 0x1, 0x0, 0x3f, 0x105000, 0xd000, [], 0xffffffff}) connect$vsock_dgram(r0, &(0x7f0000000080)={0x28, 0x0, 0xffffffff, @my=0x0}, 0x10) write$sndseq(0xffffffffffffffff, &(0x7f0000000240)=[{0x401, 0x0, 0x1, 0x0, @tick=0x7ff, {}, {0x5}, @addr={0x5, 0x7ff}}], 0x30) 16:06:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:54 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x4200, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 734.927602] binder_alloc: binder_alloc_mmap_handler: 32568 20001000-20004000 already mapped failed -16 [ 735.004888] binder: BINDER_SET_CONTEXT_MGR already set 16:06:54 executing program 0: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) accept$unix(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x6e) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000100)={{0x6, 0x2}, 0x20}, 0x10) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {0x8}, @addr={0x5, 0x7ff}}], 0xa) [ 735.038498] binder: 32568:32575 ioctl 40046207 0 returned -16 [ 735.078593] binder: release 32568:32575 transaction 1889 out, still active 16:06:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 735.092186] binder: undelivered TRANSACTION_COMPLETE 16:06:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff86, 0x0, 0x0, 0xffffffffffffffc1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000180)="2e26660f71e0a9640fae553e0f017001650f01cabaf80c66b8f38e558466efbafc0cec0f20e06635400000000f22e066b98e0900000f32f80f08f618", 0x3c}], 0x1, 0x0, 0x0, 0xfffffce9) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000100)={0xc0003}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:06:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = getpgrp(0xffffffffffffffff) capget(&(0x7f0000000000)={0x20080522, r2}, &(0x7f0000000100)={0xfffffffffffffff8, 0x6, 0x9, 0x2, 0x8001, 0x80000001}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r3, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x814}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x68, r4, 0x20, 0x5, 0x25dfdbfb, {{}, 0x0, 0x4109, 0x0, {0x4c, 0x18, {0xc960, @link='syz1\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000}, 0x4000001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup3(r1, r1, 0x80000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x1d, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x3e4, 0x0, 0x0}) openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x202081, 0x0) [ 735.142354] binder: send failed reply for transaction 1889, target dead 16:06:54 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xbf00, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:54 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) flistxattr(r0, &(0x7f0000000100)=""/217, 0xd9) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x408000, 0x0) r2 = gettid() sendmsg$nl_generic(r1, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000280)={0x414, 0x2f, 0x600, 0x70bd28, 0x25dfdbfd, {0x20}, [@generic="25f5b78cae7622199fac29f86bd6f0fb5ce2943dbfc4ce7da39bab55027a6d8a5e9af32c1e19897c4bfde22b091f48a62a74f43fa9fc678d0c855b289e62c90781fc8fc704a954712f3aa5fcbab465d71079a63c568c9c53df8b314a947cbf47782b689d2a8279e14f4d1fe41ca5574e8f1c3eac67550787ce2fc6cec27b81e210eb2dd7d05fa75ccaef28231b43e804b93f0bd338cfc46bb16c134b0a834bd3e6062312747c70b361f0102cb0ff4ec7730caf824442a56a50ac129e55e2b06d0b4dfccbf0295989a1e5bbc5be4726b3a0e28a929e1d1f78c2d31d22f43d1a5e762be26d1c2a40c4e9f10496d512", @nested={0xb0, 0x6e, [@generic="4c4427b8f923370ef90c3509822806e1f7070f13bdcf1b87a3b9b07e3ca8cc7458181a8642974f64b50869fbc9600ffce1d06f1ee4ef67a6c3f791589a4d081efc6a547e25a883d653d40ab5d4d1c6cbfbac93a73f830a10f1dfc1d0cd54ac84365e5e781b44a9879adc196528f7989353361398e7e74a4accaab0ed9e7c93b92cb81b29b8840e2216b0e80c281b275d25ff35eeb6", @typed={0x14, 0x1c, @ipv6=@local}]}, @nested={0x234, 0x8e, [@generic="dddc448fcff3e263789f76a8b7d627600b6662ab796add9fc63d8810800b484ef9ed365a3dddd067fc17e4396545658e430a181d4b6ce4b244d719984ea5c15570c03aa473afb10bfb40c726bdeb58d4e9641439958e79e80e4c37d417a32c62f523b1ba0d12c8b971fe8fd23785770d016ddb5487f06b6f12e061139bcea8ec8b7ff85f26dc6532fee1f0fb63cabbd3df8c94c39e819077354b0f42ca7f75784df412edb5671acd721a8e7b60a8371606523ef78567072ea800c77d8d38f3e6f459ae", @typed={0x14, 0x67, @ipv6=@remote}, @generic="9a343fa8398e057246e53df8c8c9771bc8919b57c23a715eaf8216555ae573b627acb94d9e97b8bd445743287742bafc25c2fbaeda4f2e5de2fa145682a0f299a2680e8e234bb22adca30713d23a4f08b0598647c81ec12b2fe27c3578d612d01c28b4051cb95fb278e844bb09c5edc25933333b388f54e96b84e3ecd11d6a2c07dcd385aef7fa84f20163da9a3a5b0c35da7440e995dc415c1bfcb919594996b2a236500f", @typed={0x14, 0x87, @str='/dev/sequencer\x00'}, @generic="13cf171f10f56bf3b1b9ed21af5f9c1a5464f7c3a92ac35d188e0a7fbcd1902b98b0692f90e7465a4538b8d00e99383aa5ae8b52dc6c27c484e2d13df8fd5a4e0a433623b64bba78fccae1c05a4c71c8b50ccbb97b579385d3653e43a17c04aec71d7d6d1909dccf5163167f39c5fbefd5e8e3f5340256210a2eb73a8123594cf4de1ac3ce363605f9449767805b215927f593d7e57dd72dbbaa988b2df59f22"]}, @typed={0x8, 0x56, @fd=r0}, @generic="a17080a3d04d45936442a0f1392e4128e9f4", @typed={0xc, 0x5c, @u64=0x1}, @typed={0x8, 0x61, @pid=r2}]}, 0x414}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = shmget$private(0x0, 0x2000, 0xc02, &(0x7f0000002000/0x2000)=nil) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000000)=""/200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 735.308136] binder: 32598:32603 got transaction to context manager from process owning it [ 735.394408] binder: 32598:32603 transaction failed 29201/-22, size 24-8 line 2887 16:06:54 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xff03, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 735.440804] binder: 32598:32603 ioctl c0306201 20000180 returned -14 [ 735.469694] binder: BINDER_SET_CONTEXT_MGR already set 16:06:54 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 735.494449] binder: 32609:32615 ioctl 40046207 0 returned -16 [ 735.503710] binder: 32609:32615 got transaction with invalid offset (0, min 0 max 24) or object. [ 735.513412] binder_alloc: binder_alloc_mmap_handler: 32598 20001000-20004000 already mapped failed -16 16:06:54 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0xfffffffffffffff8, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 735.565402] binder: BINDER_SET_CONTEXT_MGR already set [ 735.571708] binder: 32609:32615 transaction failed 29201/-22, size 24-8 line 3097 [ 735.596910] binder: 32598:32603 ioctl 40046207 0 returned -16 [ 735.619306] binder_alloc: binder_alloc_mmap_handler: 32609 20001000-20004000 already mapped failed -16 [ 735.629440] binder_alloc: 32598: binder_alloc_buf, no vma [ 735.640575] binder: undelivered TRANSACTION_ERROR: 29201 [ 735.647101] binder: 32598:32610 transaction failed 29189/-3, size 24-8 line 3035 16:06:55 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x1000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 735.676003] binder_alloc: 32609: binder_alloc_buf, no vma [ 735.686745] binder: 32609:32628 transaction failed 29189/-3, size 24-8 line 3035 [ 735.694530] binder: 32598:32610 ioctl c0306201 20000180 returned -14 [ 735.710865] binder: undelivered TRANSACTION_ERROR: 29189 [ 735.724529] binder: undelivered TRANSACTION_ERROR: 29201 16:06:55 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) 16:06:55 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x200000, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f00000001c0)=""/192) setsockopt$RXRPC_MIN_SECURITY_LEVEL(0xffffffffffffffff, 0x110, 0x4, 0x0, 0x0) syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x901) syz_open_dev$dspn(0x0, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000340)) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x80000, 0x0, 0x3}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ac9b}], 0x1, 0x0) 16:06:55 executing program 5: r0 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x7, 0x400000) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, r0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000280)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000300)={0x7, 0x8, 0xfa00, {r2, 0x3}}, 0x10) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, &(0x7f0000000b00)={'filter\x00', 0x0, 0x0, 0xfb, [], 0x0, &(0x7f00000009c0), &(0x7f0000000a00)=""/251}, &(0x7f0000000b80)=0x78) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f00000001c0)={0x34}) ioctl$DRM_IOCTL_MODESET_CTL(r0, 0x40086408, &(0x7f0000000240)={0xd4, 0xffffffffffffff56}) r3 = socket(0xa, 0x2, 0x0) getsockname$inet(r0, &(0x7f0000000200), &(0x7f00000000c0)=0x10) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000140)=@nat={'nat\x00?\x00', 0x19, 0x2, 0x270, [0x20000600, 0x0, 0x0, 0x20000630, 0x20000660], 0x0, &(0x7f0000000080), &(0x7f0000000600)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000500000000000000000076657468305f746f5f7465616d00000064756d6d79300000000000000000000064756d6d79300000000000000000000073797a6b616c6c657231000000000000ffffffffffff000000000000ffffffffffeb00000000000000007000000070000000a000000072656469726563740000000000000000000000000000000000000000000000000800000000000000ffffffff000000000b00000000000000000073797a6b616c6c65723100000000000067726574617030000000000000000000766c616e30000000000000000000000064756d6d7930000000000000000000000180c2000000000000000000aaaaaaaaaabb0000ff0000000000e0000000e000000010010000726174656573740000000000000000000000000000000000000000000000000048000000000000000000000000000070616e300000000000000000002a00030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000fbffffff00000000"]}, 0x2dc) syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x0, 0x0) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) [ 735.750262] binder: undelivered TRANSACTION_ERROR: 29189 16:06:55 executing program 2: r0 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, r0) r1 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x10000000000000) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, r3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYRESOCT=r1], 0x3bc, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="9d9f78f8cab7fc093660b5f465940c0a19dbbe576796f9377ba45bd73478fb662fabd9cb24815f955e6bb0a639329aadb7fb2faa9a1ff24821d3ccf11a8c873887d86dff", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x13a, 0x0, 0x0}) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000180)={0x3, 0x0, @ioapic={0x1d000, 0x1, 0x10000, 0x1f, 0x0, [{0x8, 0x8000, 0x9, [], 0x80000000}, {0x4800000000000000, 0x3, 0x4, [], 0x835}, {0x6, 0x7fff, 0x9bd3, [], 0x7}, {0x81, 0x3ff, 0x8}, {0x6bec4fa6, 0x7fff, 0x78aa7255, [], 0xffffffff}, {0xfffffffffffffffe, 0x4, 0x200, [], 0x71e}, {0x4, 0x0, 0x180, [], 0xffffffff80000001}, {0x1, 0xdf, 0x7fffffff, [], 0xfff}, {0x10001, 0x4, 0x1, [], 0x6}, {0x200, 0x3f, 0x3, [], 0xffffffffffff8001}, {0x0, 0x4000, 0xfffffffffffffc00, [], 0x90}, {0x8, 0x6, 0x71, [], 0x400}, {0x2, 0x1, 0x0, [], 0x3}, {0xb0, 0x7fff, 0x8, [], 0xffffffffffffffc1}, {0xc33, 0x80000000, 0x8000, [], 0xfeb3}, {0x488, 0x7fffffff, 0x7, [], 0x100}, {0x0, 0x7, 0x8, [], 0x4}, {0x1ff, 0x0, 0x77521410, [], 0x7f}, {0x1ff, 0xffffffff, 0xffff, [], 0x8000}, {0x0, 0x120, 0xfff, [], 0x785f}, {0x3, 0x6f0, 0x9, [], 0x401}, {0xb516, 0x0, 0x1, [], 0x100000001}, {0x8c9, 0x1, 0x200, [], 0x4}, {0x1, 0xffffffff, 0x6, [], 0x1}]}}) r5 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xf6e5, 0x76040) getsockopt$XDP_STATISTICS(r5, 0x11b, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x18) 16:06:55 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400000000101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) write$binfmt_aout(r0, &(0x7f0000000280)={{0x10b, 0xf34, 0xe, 0x390, 0x19a, 0x8001, 0x260, 0xffff}, "e4d00a26b91299777cc7bc5efe719badf4bf53464c6e68fd506c3e5f49fcf0d2abd352e23f76b24903175f5546a4b76d3f52ac98a51b3eca9a6c53f64f8e381dd0363fa3305895b2b8284ca74ec7db64734cb3b157f0b5560fc37db6ca4245bd8cc01adfb4fc0cc3c395b4c43eec2b8bc02e8bea8e910c35630255740bf04f33bf6c9ed9b02c7d78e2b2a11681788d7f755d34d4dbe1df5252649aed4ab65719e6e78ec780ac91c112aa01d220db90e13914b92e1c341d44d06adc329835b083b017d98eed2bbb37162b7c7c5500ca4cc0f9df4d0c6df16385fa1ba353d731c46b38ef192e8d92cea8916401268eea49553e03", [[], []]}, 0x313) 16:06:55 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x2000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:55 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$inet6_buf(r0, 0x29, 0xcc, 0xffffffffffffffff, &(0x7f0000000040)) [ 735.945050] kernel msg: ebtables bug: please report to author: Wrong len argument 16:06:55 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1, 0x0, 0x0, 0x0}, 0x0) [ 736.035863] kernel msg: ebtables bug: please report to author: Wrong len argument 16:06:55 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ubi_ctrl\x00', 0x400000, 0x0) clock_getres(0x8, &(0x7f0000000000)) r2 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pread64(r0, &(0x7f0000000180)=""/53, 0x35, 0x0) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KVM_DEASSIGN_PCI_DEVICE(r4, 0x4040ae72, &(0x7f0000000200)={0x3, 0x497828cf, 0x1000, 0x3, 0xd7b7}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r5 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCLINUX7(r5, 0x541c, &(0x7f0000000100)={0x7, 0x100}) 16:06:55 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x3000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:55 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:55 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = socket(0x10, 0x802, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) iopl(0x3ff) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1c00486}, 0xc, 0x0}, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000440)) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0xffff}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000000c0)={0x8, 0x2, 0x80000001, 0x2, r5}, 0x10) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x10000, 0x1) socket$pptp(0x18, 0x1, 0x2) setsockopt$inet6_tcp_int(r6, 0x6, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 16:06:55 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x2) 16:06:56 executing program 4: r0 = socket$kcm(0xa, 0x922000008003, 0x11) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, 0x0}, 0x0) 16:06:56 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x4000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="05630440784a4508290bdc2e5de794417cba618f9f1c5163a27d9bf7159f98c2384ae9229a3a51832636beadc0228c54f0b7671debe73f4f5b4f444a8dde9100966588aab1d87cdb02f2412883"], 0x0, 0x0, 0x0}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101003, 0x0) ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f00000001c0)) 16:06:56 executing program 0: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/btrfs-control\x00', 0x101000, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000340)=0x0) fstat(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getpgrp(0xffffffffffffffff) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000004c0)={0x0, 0x0}, &(0x7f0000000500)=0xc) getgroups(0x6, &(0x7f0000000540)=[0xffffffffffffffff, 0xee00, 0xee00, 0xffffffffffffffff, 0x0, 0x0]) sendmsg$unix(r1, &(0x7f00000005c0)={&(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000300)=[{&(0x7f0000000280)="0abcbfd71355a986a51b01f0d83c3f3483a59b705ff749b0fa17b842103d5a6ee123b00b03c2a79898dd30c1de79503900991f2830e064e37dee0ce38c29d29a4fceaf3d3fa8185f5d444411", 0x4c}], 0x1, &(0x7f0000000580)=[@cred={0x20, 0x1, 0x2, r2, r3, r4}, @cred={0x20, 0x1, 0x2, r5, r6, r7}], 0x40, 0x10}, 0x40) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e21, @rand_addr=0x38}}, 0x6, 0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000140)={r8}, 0x8) 16:06:56 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x3) 16:06:56 executing program 5: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x22, 0x3, 0x1, &(0x7f0000000080)) open_by_handle_at(0xffffffffffffffff, 0x0, 0x1) pkey_alloc(0x0, 0x2) r0 = openat$selinux_mls(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[], 0x0) 16:06:56 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x4) [ 737.096325] binder: 32694:32696 Acquire 1 refcount change on invalid ref 138758776 ret -22 [ 737.133009] binder: 32694:32696 transaction failed 29189/-22, size 24-8 line 2896 16:06:56 executing program 0: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x84000, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000100)) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @multicast1}, @in6={0xa, 0x4e21, 0xe, @loopback, 0x4}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e24, @remote}], 0x4c) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:56 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x5000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 737.198031] binder: 32694:32696 Acquire 1 refcount change on invalid ref 138758776 ret -22 16:06:56 executing program 5: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) ftruncate(r0, 0x8200) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) lstat(&(0x7f0000000080)='./bus\x00', &(0x7f0000002bc0)) symlinkat(&(0x7f0000008ff8)='./file1\x00', 0xffffffffffffffff, 0x0) fallocate(r0, 0x0, 0x7, 0x8000) r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioperm(0x4, 0x7, 0x9) write$P9_RRENAME(r1, &(0x7f0000000040)={0x7}, 0x7) write$P9_RATTACH(r0, &(0x7f0000000100)={0x14, 0x69, 0x1, {0x67, 0x0, 0x3}}, 0x14) sendfile(r0, r3, 0x0, 0x8000ffffffff) r4 = getpgrp(0x0) sched_getscheduler(r4) 16:06:56 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) r2 = dup(r0) getsockopt$XDP_MMAP_OFFSETS(r2, 0x11b, 0x1, &(0x7f0000000080), &(0x7f0000000100)=0x1e) sendmmsg(r1, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x340, &(0x7f0000005b00)}}, {{&(0x7f0000000000)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x5000}}], 0x38c, 0x0) 16:06:56 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x6) [ 737.282491] binder: 32694:32712 transaction failed 29189/-22, size 24-8 line 2896 16:06:56 executing program 0: r0 = semget$private(0x0, 0x0, 0x489) r1 = getpid() ptrace$setregset(0x4205, r1, 0x206, &(0x7f0000000140)={&(0x7f00000000c0)="1729ea2d17980ae3817a64f67b8b59e95ea77631ad0290a34306aa139b5ef847945aa2907e6b5aa4a9d6916125c33e170ed7273c1aaa07a34ec36a8e283cfbc13a35431200994dda461bd6", 0x4b}) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000040)=[0x100000000, 0x7, 0x3, 0x0, 0x1000, 0x1]) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r2, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000080)) 16:06:56 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x8000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 737.400070] audit: type=1804 audit(1548778016.751:163): pid=32718 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir785229837/syzkaller.fdBXuu/133/bus" dev="sda1" ino=17339 res=1 16:06:56 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB="f52136f3b06ce508e1c860a7f20000000000000080"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 16:06:56 executing program 5: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x0, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x2000, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f00000007c0)=[{&(0x7f0000002300)=""/4096, 0x1000}], 0x30e) 16:06:56 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x8) [ 737.514662] audit: type=1804 audit(1548778016.751:164): pid=32718 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor5" name="/root/syzkaller-testdir785229837/syzkaller.fdBXuu/133/bus" dev="sda1" ino=17339 res=1 16:06:56 executing program 4: r0 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x3) r1 = socket$inet6_sctp(0xa, 0xfffffffffffffffe, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback, 0x20000000}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0xc, 0x0) write$binfmt_elf64(r6, &(0x7f0000000d00)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff7f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002e630000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079cb0e12e71f0b86fc8210e9f58640ed000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x7c5) setsockopt$inet6_opts(r6, 0x29, 0x0, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000a40)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r7 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x9, 0x31, 0xffffffffffffffff, 0x20000000) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r7, 0xc058534f, &(0x7f0000000880)={{0x4, 0x8001}, 0x1, 0x409, 0x6, {0x70d}, 0x1}) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x80000000, 0x200000) 16:06:57 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101000, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000040)="ccd55b77833bb6d2f714f99f4769fb4ee2401f9366012d01a62432cc5bbf83f4fa92cd8348a4309bb75b7f1c4bd7ee44b23ee2a37c6e2b15ca0cca04b7b9b528e36cf69cdec60356fafc27270185747aa32f977292e47fe2881bac5ac84586c6383a1e1944bf4b7231c40756658ac8bbe546b27b52435f46d6513ffb179a5082863d04d81d5fd5f9ec699e7a64a77b41d39e746eb2035c9c0e94c81c3536093c57bdb971658c40f5edbb1f1445667d2118c7ad1bc96574f4fcee42cfca3669643608c1573929e922ab04749a387b") 16:06:57 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x3f000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 737.654111] audit: type=1804 audit(1548778016.761:165): pid=32718 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor5" name="/root/syzkaller-testdir785229837/syzkaller.fdBXuu/133/bus" dev="sda1" ino=17339 res=1 16:06:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 737.804720] audit: type=1804 audit(1548778016.781:166): pid=32723 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir785229837/syzkaller.fdBXuu/133/bus" dev="sda1" ino=17339 res=1 16:06:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000983000/0x3000)=nil, 0x3000, 0x4000000000000008) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x3, 0x0) 16:06:57 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x42000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 737.867167] binder: 32755:32757 got transaction to context manager from process owning it [ 737.888127] binder: 32755:32757 transaction failed 29201/-22, size 24-8 line 2887 16:06:57 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xa) [ 737.924060] binder_alloc: binder_alloc_mmap_handler: 32755 20001000-20004000 already mapped failed -16 16:06:57 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) r1 = msgget$private(0x0, 0x100) msgrcv(r1, &(0x7f0000000040)={0x0, ""/251}, 0x103, 0x1, 0x2f4dbde6add79eb2) [ 738.004098] binder: BINDER_SET_CONTEXT_MGR already set [ 738.039489] binder: 32755:32757 ioctl 40046207 0 returned -16 16:06:57 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x80ffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 738.092554] binder_release_work: 2 callbacks suppressed [ 738.092561] binder: undelivered TRANSACTION_ERROR: 29201 16:06:57 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xc) 16:06:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="d04efddd91c9dd5eba66882df3f5207a06f1b2761cd327f384c74427f272e7f676996e1b6b552aad3727a47a638ae4fbbcc8fbcaff9a5062ddd9977b6b0ff2cd7668e385a26ca8decead549f1ee52dd2a994d34fd9b70579e4c184fc53f11ff6d27f4fd9bbec4bf65838832480a90fd6d4db23230f607c6fad592658ff8d1921ca6f80059bed59f6d0a9fbdb0a34a8201dac291bd4a2acb8ed4351f9edc8d2df4cd35c66682009e44647d2b457a64d1847fc31b13e3019b8d7e532fdf8bb43a4df6a2bae4e61b8553d"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:57 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000040)=0x7) [ 738.291743] binder: 316:317 unknown command -570601776 [ 738.305449] binder: 316:317 ioctl c0306201 200000c0 returned -22 [ 738.340127] binder: 316:321 got transaction with invalid handle, 0 [ 738.392696] binder: 316:321 transaction failed 29201/-22, size 24-8 line 3126 [ 738.418602] binder_alloc: binder_alloc_mmap_handler: 316 20001000-20004000 already mapped failed -16 [ 738.441506] binder: BINDER_SET_CONTEXT_MGR already set [ 738.464018] binder: 316:317 ioctl 40046207 0 returned -16 [ 738.469704] binder: 316:321 unknown command -570601776 [ 738.477937] binder: 316:321 ioctl c0306201 200000c0 returned -22 [ 738.484562] binder_alloc: 316: binder_alloc_buf, no vma [ 738.490168] binder: undelivered TRANSACTION_ERROR: 29201 [ 738.496823] binder: 316:317 transaction failed 29189/-3, size 24-8 line 3035 [ 738.511468] binder: undelivered TRANSACTION_ERROR: 29189 16:06:58 executing program 4: r0 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x3) r1 = socket$inet6_sctp(0xa, 0xfffffffffffffffe, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev}}, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x98) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_IRQP_SET(r3, 0x4004700c, 0x349) r4 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000003) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback, 0x20000000}, 0x1c) r6 = accept4(r4, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0xc, 0x0) write$binfmt_elf64(r6, &(0x7f0000000d00)=ANY=[@ANYBLOB="7f454c460904050907000000000000000300070007000000f8010000000000004000000000000000a303000000000000880000000500380001007f00010401000000000001000080030000000200000000000000ff7f0000000000000100000000000000e1ffffffffffffff0000000004000000aa0900000000000000000000000000000000000000000000090000000000000004000000000000000000000000050800b2b8e7c0207f8c15435c5f65b824f94833ce5a469e19cefe3db700dc0aba3b189fc1cba86b252746cf2a9f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff7f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002e630000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000079cb0e12e71f0b86fc8210e9f58640ed000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x7c5) setsockopt$inet6_opts(r6, 0x29, 0x0, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r6, 0x800448d2, &(0x7f0000000a40)={0x2, &(0x7f0000000900)=[{}, {}]}) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r7 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/qat_adf_ctl\x00', 0x44000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x9, 0x31, 0xffffffffffffffff, 0x20000000) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x0, 0x0) mbind(&(0x7f0000126000/0x3000)=nil, 0x3321a8df32ee8487, 0x0, &(0x7f000016e000), 0x5, 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r7, 0xc058534f, &(0x7f0000000880)={{0x4, 0x8001}, 0x1, 0x409, 0x6, {0x70d}, 0x1}) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x80000000, 0x200000) 16:06:58 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xe) 16:06:58 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x81ffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:58 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000983000/0x3000)=nil, 0x3000, 0x4000000000000008) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4000, 0x0) preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x3, 0x0) 16:06:58 executing program 0: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x8, 0x98a787a631780bc3) 16:06:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = open(&(0x7f0000000000)='./file0\x00', 0x20800, 0x40) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000200)={r3, 0x77, 0x2}, 0x8) epoll_wait(r2, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0xa4af) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:58 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xf) 16:06:58 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x92ffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:58 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f0000000900)='./file0\x00', 0x101000, 0x60) writev(r0, &(0x7f00000007c0)=[{&(0x7f0000000080)="8de54b06d2", 0x5}, {&(0x7f00000000c0)="833fbb8703ff1ac2fc2ab57c8e32c71d775e24d2295a7fb7cd50eea6b3a8f64a9fd1b0c563c28bdde94d096e184b66d003dab331d4825a95af882df4151606c14edd8558b1e19c80a0a1ffd265727ba3ae515264f70854c04704adb23baef81a6de930352e4af95956c7ecda64d64bef992a997ad2836b810df1576498b29d34d30fb1438b318ca675c9de82622bbdb72284cade6eceffd051cd76e568e6fc4514fb2c22ba856e38ed2b45fc911e05f89041ded66741eb280fbee489", 0xbc}, {&(0x7f0000000280)="6f73ac52842271783b2f5b207aae115e201be0e8a2e8ccf6ec8ecca8f4b9c7f07f1add3da19a55968f37c011e5bf568aabddb3c3b9d2ca984c5f29b726c3ce102be108075c264201e44df6e099e812cbe923846dbd2d2731e71dbbaea97720004b651b8fbf8a84da9c02a53e3358f18a99c60efdc5906f8c8f95a3033151844102aec9dd0a2cd1aa829634fda79845ad7954335c68e0cd8ef649e627c60ba09094e76d9cc596bc10aa26d1cc68988161736db049770c8089f471f0186f60a1db240df8ff92673b21e5e6b46c983736270be6d76b4d521ff9a8dbacd31ad920e52f1dafc4c0", 0xe5}, {&(0x7f0000000380)="1415b84a97fd2f94170f7970211ea8c83e022394aa3299df5c31ba2a00826bb685608bd7e3c79caf4813c75040cec6a779d4b54b1b52f72ecbcf56c7893e37d3ab3889087658f4f86a31d8a146847a59632ebd2081e8274287830a0669460292c2d64634099fd89d13a6d5ca5211235b4f2e9f68d74d028b5d0d5bde11771ef4c35ace617500a960976d30ba6db34ed18a0b9539e768450248fa38c25f3ae6088ee0ed9bfce604e20e5339f80b1270d73867e23acf54ee0230b90fba5f67fb8f8a21fe62b5f9d2bd07f30b3fc5201673ddfa14777f118ecc01451d76ad39975e73427b5e30bac672dffec12ad4", 0xed}, {&(0x7f0000000480)="d16e13a982af3ef876e86c2f1d2feea09a49db7f398c55c493806f13bbc820eb3518c26b8646f64a01013faf9e6b18021e05effdf9817e897986ca34fc83ededc377b7ef6f9665d08257c50bdb715a6c1d43b238ae4710af514f9a3535583d072478af6e705d54390c665efa5bccf2b2478f74bab29fee1fd2c861e06daa312ba281bad0d0da844810c0f95aedc4895f8aaa4e1a17e9ac23a73df5fec6de6d0b839003c31b3cf0287b75aad255c349dd094b1c7bf83df3f1e0fbbdf29529d33367b897145fcaf72fc4175a961e4e135524", 0xd1}, {&(0x7f0000000180)="23e21fd825b526cde78798e3ac45cfa8dad6f91d232382cbca4afab276833947d0719b27930f42e3071cc627f31646adb0b5fbc821a8dccc56a5bf4468056cbb41c85db74ca945d410ebbde5ea8071a28ada1deaab001c35a977d8cb1106e42a0307a76ab7b24bb6bb1ef50d730f1e5e5e9b5ca29671855c9c38a5", 0x7b}, {&(0x7f0000000580)="e45026a6bd70b75ac3125dfb6b0348ca16cd12cf2d3fcc00135a016046521cddc3466ca0f16b4985d68019049431b56a231eec4c7f4a518cf36263d960b78b2d599e976c89cd5bd8103928b36b023340f66a6d0f1877f3fe047f3cfeb119430c98791b0f355b5a5316f156d01dad0bc76c9e6420807a74eb", 0x78}, {&(0x7f0000000200)="98bc9609aeeda1b337680ad699e1ada742a96283c4971fc8256d7de681933844067b5b3e7ba744a88336918b54deef7e181c85be0bbc20b0", 0x38}, {&(0x7f0000000600)="22cbd2a11eee245508e1b14293b597091c5aa0e8dec77df7ac4a403b0f30ca8d715c63a43b0c7a4706e8e3279b5c9824ddb640e255bfeab6c6267d633b92d4a8afd428f8f0537c684fef6e4f18250d3ba0579c5a715e097642e72167ff649e3359238ae1424c9c054d234950596793c0bf3c13cf23214b7b6adf48498c62eaf26c883574eb3106b336a5681d9f6ad5f8d01bc1f0e551c6242e431cc834fd3d0c2421e3ecab831f8945e678a5b27dbe69c78e333ad77a05d692f37b09d66f4941c1b94d72be4983643c7f811e3e523f5343d6cb6fd16ac35f17c37ebd7c387f78cacff4cf", 0xe4}, {&(0x7f0000000700)="340dd2dfaf09754914bbdc805a16b211ffec413ec28199acb206352634b2c7f526d0da86b55ea30655dfe0bd68cbf1218c0da0f5100d8be45b2076f0bf36f21ca126f3c5641e2f08f04397294b2cd3f0278dd691bdfd957abc4860820a2d4f726039ff6d4ed5d7ba67b8f2b83014b77b707f969c1f0413ed2ee47c23f20030a3727caea2622f5c1ceadc9ef89acc00318686bfc6d32a76523ec0dc71bd46fbed5d", 0xa1}], 0xa) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x101002, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0xfffffffffffffffd, 0x0, @tick=0x9, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 738.783836] binder_alloc: binder_alloc_mmap_handler: 333 20001000-20004000 already mapped failed -16 [ 738.807088] binder: BINDER_SET_CONTEXT_MGR already set [ 738.870018] binder: release 333:339 transaction 1910 out, still active [ 738.887680] binder_alloc: 333: binder_alloc_buf, no vma [ 738.900149] binder: undelivered TRANSACTION_COMPLETE [ 738.934797] binder: 333:339 ioctl 40046207 0 returned -16 [ 738.941637] binder: send failed reply for transaction 1910, target dead [ 738.962723] binder: 333:343 transaction failed 29189/-3, size 24-8 line 3035 [ 738.985268] binder: undelivered TRANSACTION_ERROR: 29189 16:06:58 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x10) 16:06:58 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r2 = socket$rxrpc(0x21, 0x2, 0x400000000000002) bind$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @initdev}}, 0x24) io_setup(0x8, &(0x7f0000000100)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='cgroup.controllers\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ACQUIRE(r4, 0x6430) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000002c0)={0x0, 0x8}, 0x8) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) write$P9_RLERRORu(r5, &(0x7f0000000140)=ANY=[@ANYBLOB="c85e6084bcc2e3ceb12b80af8d3d26ae41560cc480f85d50aacb993d18aa38ea75f6f60b1ef61f3d3770676cfcd21e632470e013e6da9e66e9411b9f6e583eb058ee8d06a09ab73e32d948c74ab56131f12d2c29530439f794ffa0535d1f0be18495d1dd22a5e4ee937235c22eeb643262233e18456e6b3bbae1af29eff05716960db4c9a00482919d69e0215510dc36d433cb5a5e44c27fc4e0393517546d40c69599217812ead21b7bcc13bd35842b3f742d4a"], 0x1) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x1c1, 0x10, 0x8, 0x4}, &(0x7f00000000c0)=0x18) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000240)={r6, 0x6}, &(0x7f0000000280)=0x8) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0x8, 0x0, r1, 0x0}]) 16:06:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x400000) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x8000000000000000}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000200)=@assoc_id=r2, &(0x7f00000001c0)=0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r4}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast1}, r5}}, 0x48) r6 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r6, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 739.251307] binder: 362:363 Acquire 1 refcount change on invalid ref 0 ret -22 [ 739.275971] binder: 362:363 transaction failed 29189/-22, size 24-8 line 2896 [ 739.324399] binder: 362:368 Acquire 1 refcount change on invalid ref 0 ret -22 [ 739.343045] binder: 362:363 transaction failed 29189/-22, size 24-8 line 2896 [ 739.355610] binder: undelivered TRANSACTION_ERROR: 29189 [ 739.361273] binder: undelivered TRANSACTION_ERROR: 29189 [ 739.413342] dccp_close: ABORT with 1989 bytes unread 16:06:58 executing program 4: socket(0x0, 0xa, 0x0) r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_CLEAR_SOCK(r0, 0xab08) 16:06:58 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400000, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:58 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x93ffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:58 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x60) 16:06:58 executing program 5: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) clone(0x2000002102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='ecsyptfs\x00', 0x1, &(0x7f00000001c0)='\x7f') 16:06:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffd) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018006e00000000000801000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 739.564816] binder_alloc: binder_alloc_mmap_handler: 372 20001000-20004000 already mapped failed -16 16:06:58 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x94ffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:59 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000040)={0x3, 0x3, 0x3}) 16:06:59 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xf0) [ 739.646455] binder: BINDER_SET_CONTEXT_MGR already set [ 739.662355] binder: 372:378 ioctl 40046207 0 returned -16 [ 739.702442] block nbd0: NBD_DISCONNECT 16:06:59 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000140)={@multicast1, @remote, 0x0}, &(0x7f0000000340)=0xc) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000003c0)={@local, @dev={0xfe, 0x80, [], 0x2a}, @rand_addr="0905ecc8a85902b7781c8d3542e3d20a", 0x8, 0x8, 0x8, 0x100, 0x0, 0x80000000, r1}) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f00000001c0), 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@multicast2, 0x0, 0xff}, 0x0, @in=@local, 0x0, 0x3}}, 0xe8) sendmsg$key(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020b0001020000000000400000000000"], 0x10}}, 0x0) recvfrom$unix(r0, &(0x7f0000000040)=""/1, 0x1, 0x40000000, 0x0, 0x0) sendmsg$key(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="02120000020000000a000097d3d34473"], 0x10}}, 0x0) recvmmsg(r3, &(0x7f0000000f00), 0x274, 0x10000, &(0x7f0000001000)={0x77359400}) 16:06:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB="09000000007b923f"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'rose0\x00', 0x4201}) [ 739.788431] block nbd0: NBD_DISCONNECT 16:06:59 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f00000003c0)}}, {{&(0x7f00000004c0)=@in6={0xa, 0x2, 0x0, @mcast2}, 0x80, &(0x7f0000000680), 0x0, &(0x7f00000001c0)=[{0x18, 0x29, 0x4000000000000005, "960202"}], 0x18}}], 0x2, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x10000000, 0x0, 0x3, 0x0, @tick, {}, {}, @addr={0x5, 0x7ff}}], 0xffffffffffffffb3) 16:06:59 executing program 4: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000001cc0)={0xffffffffffffff9c}) sendmsg$kcm(r0, &(0x7f0000001e40)={&(0x7f0000001d00)=@ipx={0x4, 0x80000001, 0x2, "861edb1b796d", 0x100000001}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x48000}, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000a80)='cpuacct.usage_percpu_user\x00', 0x7a05, 0x1700) r3 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000200)=@in, 0x80, &(0x7f0000000540)}, 0x0) sendmsg(r4, &(0x7f0000000400)={&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @local, 0x4}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000280)='m', 0x1}], 0x1}, 0x4040040) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0xf, &(0x7f00000005c0)=ANY=[@ANYBLOB="45964a5c4f0f00fe2a6cf6aa2676cdb4b40edaa04797eb96de8e70e69843121a053a50623745e0be803d3fa8486aca42036863a427c65ddc2680f83a3c700352aa7ec8425ec334dccd971a3fa82d802788e36b9c7333f5d97a96d176394107b89fac6c3f451539c659fbf390cea3da54439d0774461975aea79ac7581fe4"], 0x0}, 0x48) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc4b, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000480), 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, r3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x32, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b702000003000000bfa300000000000007ff7a0af0fff8ffffff79a4f0ff00000000b7060097d322ed102b22a0cbfb00dfffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000000992856eb30101de1c9c8b2e2f258262eb2ce5670000008000000000f32829400618da282b85522f31d2a7af6fc3af42e3aaf9bad0849f1465c7296fd7ca860b7d570b14459acb1c7eb4231c595b80f9292d6c6e2058e012d531d602a66a1a7bea5d5de98e8bba4756d518b81bf697658d311b4887d8d4b87601411d013a9e3bc9a6c193e7b61e70985e92ef9a4f3ce8f787359a510fe1ba9d8a10dd9f5ed3b9fd6fef0a7654ac0e837cbf0231c0dc3c57721cca8bcbaf706febc7d680757a9a1bb692e7cf7f2668f1b4e1f2e8f2e18b8a548b0a9117f640ee3861c0ba4354beea9aacf60f1592916987671999c32cd996332c39af2e98983e74e3c98add3ee749f3655cab923bb5aa2f2b031d093539b3120749815ffd139a5d6c562dae59b2051329"], 0x0, 0x0, 0x36}, 0x48) bpf$OBJ_GET_PROG(0x7, &(0x7f00000002c0)={&(0x7f0000000140)='./file0\x00'}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001f00)={&(0x7f0000001ec0)='/*cgroup\x00', r2}, 0x10) recvmsg$kcm(r2, &(0x7f0000001c80)={&(0x7f0000000540)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x80, &(0x7f0000001b80)=[{&(0x7f0000000440)=""/49, 0x31}, {&(0x7f0000000780)=""/123, 0x7b}, {&(0x7f0000001880)=""/198, 0xc6}, {&(0x7f0000000800)=""/59, 0x3b}, {&(0x7f0000001980)=""/76, 0x4c}, {&(0x7f0000000840)=""/57, 0x39}, {&(0x7f0000001a00)=""/222, 0xde}, {&(0x7f0000001b00)=""/23, 0x17}, {&(0x7f0000001b40)=""/27, 0x1b}], 0x9, &(0x7f0000001c40)=""/38, 0x26, 0x3f}, 0x40012022) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r5, 0x18000000000002a0, 0x34, 0x0, &(0x7f0000000280)="b90703e6680d698cb89e40f02cead5dc57ee41dea43e63a377fb8a977c3f1d1788e8ad30d84648a27f11c72be0000e01e1977d48", 0x0, 0x100}, 0x28) socketpair(0x6, 0x2, 0x9, &(0x7f0000001e80)) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000380)) socketpair(0x4, 0x4, 0x7f, &(0x7f0000000340)) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001000)=ANY=[], &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair(0x1, 0x2000000001, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000100)={0x0, 0x21, 0x1ed1, 0x4, 0xffff, 0x8, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x2}, 0x0, 0x0, 0x6, 0x7}, 0x0, 0x0, r1, 0x10000002) openat$cgroup_ro(r2, &(0x7f00000006c0)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x40082404, &(0x7f00000004c0)=0x800) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000000)='ip6gre0\x00') perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0xa, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, @perf_config_ext={0xff, 0x1}, 0x0, 0x0, 0x0, 0x10000000000000}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0xa, 0x7, 0x0) sendmsg$kcm(r7, &(0x7f0000000700)={&(0x7f0000000200)=@in6={0xa, 0x0, 0x0, @dev, 0x6}, 0x80, &(0x7f0000000d40), 0x0, &(0x7f0000000000)}, 0x20004040) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x10}, 0x10) close(r7) 16:06:59 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xa0010000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:59 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x1a0) 16:06:59 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x82000) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x8931, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f00000000c0)) [ 739.959579] IPv6: ADDRCONF(NETDEV_CHANGE): rose0: link becomes ready 16:06:59 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xbf000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 740.022380] binder_alloc: binder_alloc_mmap_handler: 407 20001000-20004000 already mapped failed -16 [ 740.066742] binder: BINDER_SET_CONTEXT_MGR already set 16:06:59 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000780)=""/28, 0xffffff38) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000200)={0xbf, @time={0x0, 0x1c9c380}}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000340)={0x0, 0x0, 0x0, 'queue1\x00'}) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{}, {0x0, 0x1c9c380}}, 0x0) sched_rr_get_interval(r1, &(0x7f0000000000)) tkill(r1, 0x1000000000013) r2 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x6, 0x100) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f0000000180)={0x6, &(0x7f0000000400)=[{}, {}, {}, {}, {}, {}]}) recvmmsg(r2, &(0x7f0000000e80)=[{{&(0x7f00000002c0)=@x25={0x9, @remote}, 0x80, &(0x7f0000000dc0)=[{&(0x7f00000007c0)=""/234, 0xea}, {&(0x7f00000001c0)=""/23, 0x17}, {&(0x7f00000008c0)=""/248, 0xf8}, {&(0x7f00000009c0)=""/237, 0xed}, {&(0x7f0000000ac0)=""/251, 0xfb}, {&(0x7f0000000bc0)=""/67, 0x43}, {&(0x7f0000000c40)=""/216, 0xd8}, {&(0x7f0000000d40)=""/70, 0x46}], 0x8, &(0x7f0000000e40)=""/61, 0x3d}, 0x4}], 0x1, 0x2, &(0x7f0000000ec0)={0x0, 0x1c9c380}) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) [ 740.091334] binder: 407:410 ioctl 40046207 0 returned -16 [ 740.119404] binder_alloc: 407: binder_alloc_buf, no vma 16:06:59 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x300) [ 740.148328] binder: release 407:410 transaction 1918 out, still active [ 740.165737] binder: 407:425 transaction failed 29189/-3, size 24-8 line 3035 [ 740.174281] binder: undelivered TRANSACTION_COMPLETE 16:06:59 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xfdffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 740.210939] binder: send failed reply for transaction 1918, target dead [ 740.249904] binder: undelivered TRANSACTION_ERROR: 29189 16:06:59 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) write$binfmt_aout(r0, &(0x7f0000000280)={{0x0, 0xdb, 0x101, 0x123, 0x26c, 0x40, 0x1cc, 0x8000}, "328a93d61e390c835130d830d49b1d0a88856402b97d284fbcbceab293faea8d463f4333a74647386f6ae66230c39b2ff500bfc77d31b2b383ffb245dd25dc7c75cdb030440f498e6932a41cecc537adc306b0eabc33016780bd7a93a70c25c718f1c9768d841dd58b9cac0df2079f7dc67da90c57e7993702fb9fc64a93ba481bfc0b24987c06b1de377d3cd840b66daca1271e800f575192aa39951367132afc33c8b5a0a16779bbeda9efca7d8bb3ca46fa33385f9d5e48878e92ca1bf8b5c0538ee5c78734b1816f5bb73c153262520c51d961c5e79feeb8b8be", [[], [], [], [], [], []]}, 0x6fc) 16:06:59 executing program 2: rt_sigsuspend(&(0x7f0000000000), 0x8) r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vfio/vfio\x00', 0x600, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f00000001c0)={'veth1_to_bridge\x00', {0x2, 0x4e22, @multicast2}}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r3, 0x400445a0, &(0x7f0000000140)=0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:06:59 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x499) 16:06:59 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xfeffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:06:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a687700000000", @ANYRES64=0x0, @ANYBLOB="09000000007b923f"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={'rose0\x00', 0x4201}) 16:06:59 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$SIOCAX25GETINFO(r0, 0x89ed, &(0x7f0000000040)) r1 = shmget(0x3, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) shmctl$SHM_UNLOCK(r1, 0xc) mq_unlink(&(0x7f0000000100)='/dev/sequencer\x00') setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000180)={0x3, 0x5, 0x0, 0x15}, 0x10) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000140)='/dev/sequencer\x00') ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f00000000c0)={0x3, 0xa1, 0x5090dc2200000, 0x9, 0x40, 0x7fff}) 16:07:00 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x600) [ 740.621354] binder: BINDER_SET_CONTEXT_MGR already set [ 740.631219] binder: 475:476 ioctl 40046207 0 returned -16 16:07:00 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xff030000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:07:00 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) ioctl$SIOCAX25ADDFWD(r0, 0x89ea, &(0x7f00000001c0)={@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) fstatfs(r0, &(0x7f0000005280)=""/4096) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000100)={r1, 0x4f, "cee2c5e7a33e3c93075473fc778966af912c3ff010b32727ae8badebb7b3a12b3cca53c7f5ec4963b55fd23d195de284dd825de0e6de7dc4e7f4e7506a001466f1895c5174ed41a411457c4976840c"}, &(0x7f0000000180)=0x57) [ 740.668502] binder: release 475:476 transaction 1925 out, still active [ 740.678972] binder: undelivered TRANSACTION_COMPLETE [ 741.299362] binder: BINDER_SET_CONTEXT_MGR already set [ 741.304809] binder: 457:496 ioctl 40046207 0 returned -16 [ 741.304837] binder_alloc: binder_alloc_mmap_handler: 457 20001000-20004000 already mapped failed -16 [ 741.320205] binder_alloc: 457: binder_alloc_buf, no vma [ 741.326881] binder: 457:497 transaction failed 29189/-3, size 24-8 line 3035 [ 741.335553] binder: release 457:469 transaction 1923 out, still active [ 741.345908] binder: undelivered TRANSACTION_COMPLETE [ 741.356269] binder: undelivered TRANSACTION_ERROR: 29189 [ 741.368096] binder: send failed reply for transaction 1923, target dead [ 741.375043] binder: send failed reply for transaction 1925, target dead 16:07:02 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x2, 0x1d8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200005c0], 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010700001100000000000000000076657468315f746f5f7465616d080000736974302000000000000400000000006272696467653000000000000000000076657468305f746f5f627269646765000180c2000000000000000000aaaaaaaaaa0000000000000000007000000070000000a80000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff01000000110000000000000000007465716c30000000000000000000000000e9ffff687036677265300000000000090000007663616e30000000d53fa73b00000000ffffffffffff000000000000aaaaaaaa98aa00000000000000007000000070000000a000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000"]}, 0x244) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x1, 0x1c0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000180], 0x2, 0x0, &(0x7f0000000180)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'bc\x00', 's\x01\x000\x00\x00\x02\x00\x00\x00\xff\xff\x00', 'vcan0\x00', 'vlan0\x00', @broadcast, [], @empty, [], 0xb8, 0xb8, 0x130, [@limit={'limit\x00', 0x20, {{0xfffffffffffffffa, 0x9}}}]}}, @common=@nflog={'nflog\x00', 0x50, {{0x0, 0x0, 0x0, 0x0, 0x0, "2ce719c99cffcbf4d7e80e410bb5007c6981466b6431c7e6b129fcead3f149b589996102627779dc3b23bf8250fc3acd9e8be08a4bbab9be219f504cae3a7e4d"}}}}]}, {0x0, '\x00', 0x1, 0xfffffdfffffffffe}, {0x0, '\x00', 0x1, 0xffffffffffffffff}]}, 0x238) 16:07:02 executing program 4: r0 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x4c, 0x1) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000440)=0x7) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000100)={0x28, 0x4}, 0x28) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000040)='./file0\x00', 0x4, 0x2, &(0x7f0000000080)=[{&(0x7f0000000200)="4cadfe7055043a039ea3ae0a9995a4db3edb99027022c3d1fba71051d99f52d6521ff9a041c7f9a7b7a2d59b10a8133f589e1f15d842c11d6d5747d6ca620c967e004ead651bfaf206741c61074fae5561cf75fddb07005cf46e3e682f489d529582e2ebda9f98711f468237b6a837ae67e7a19e3b624a4f5eb7fa49b04576cfdb42b49d3ecc4fdcec12be52ac376deb7673eb7980d30ecb0b053f091115be19ae", 0xa1, 0x7ff}, {&(0x7f00000002c0)="b583fc220e052d6d85c5d0a0c14a692877d85eb679b3c20b1edad357553ce69d0fa89948116d0aa68ee1f093bc1b48e52e190cbe242e17bef44c3d6aefe1a93d1368f4b4ca6eda689b84174ec93c058d0ff098e94f65f685b38a804478117789e2a2615457c87086fda2f955785a1129a0feaa01856523d1fb8b6f77315057b33ce7c992bb328d05c89dbb102e7233ad2b298a05bf1744fc57713272a5a83738a751f91cacb6ad1cde771471814d68ae5551822aa6b316b2b5a1c94a9194738e9d335d", 0xc3, 0x3ff}], 0x200000, &(0x7f00000003c0)={[{@uni_xlate='uni_xlate=1'}], [{@smackfsdef={'smackfsdef', 0x3d, '/dev/cuse\x00'}}, {@measure='measure'}, {@measure='measure'}, {@fsuuid={'fsuuid', 0x3d, {[0x61, 0x7d, 0x77, 0x31, 0x0, 0x31, 0x36, 0x65], 0x2d, [0x65, 0x31, 0x37, 0x35], 0x2d, [0x63, 0x77, 0x75, 0x36], 0x2d, [0x61, 0x77, 0x7f, 0x63], 0x2d, [0x66, 0x35, 0x62, 0x37, 0x77, 0x76, 0x35, 0x38]}}}]}) 16:07:02 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xa00) 16:07:02 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) 16:07:02 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xffffff80, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:07:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x6, 0x400, 0x6, 0x9, 0x0, 0xf000000000000000, 0x9, {0x0, @in6={{0xa, 0x4e23, 0x100000001, @empty, 0x7}}, 0xabe6ed8, 0x6, 0xffff, 0xfffffffffffffff8, 0x3}}, &(0x7f00000001c0)=0xb0) setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000200)={r2, 0x1}, 0x8) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000240)={r3, 0x4}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 743.289578] binder_alloc: binder_alloc_mmap_handler: 499 20001000-20004000 already mapped failed -16 [ 743.317082] FAT-fs (loop4): Unrecognized mount option "smackfsdef=/dev/cuse" or missing value [ 743.328560] binder: BINDER_SET_CONTEXT_MGR already set 16:07:02 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xffffff81, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 743.334945] kernel msg: ebtables bug: please report to author: Wrong len argument [ 743.353292] kernel msg: ebtables bug: please report to author: Wrong nr. of counters requested [ 743.365812] binder: 499:509 ioctl 40046207 0 returned -16 [ 743.374484] kernel msg: ebtables bug: please report to author: Wrong len argument 16:07:02 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0xb3e1, @time, {}, {0x4}, @raw32={[0x101, 0x20, 0x5]}}], 0x3ba) 16:07:02 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xc00) [ 743.383617] kernel msg: ebtables bug: please report to author: Wrong nr. of counters requested [ 743.403087] binder: release 499:500 transaction 1930 out, still active [ 743.425803] binder_alloc: 499: binder_alloc_buf, no vma 16:07:02 executing program 5: r0 = socket$kcm(0x10, 0x4000000002, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e0000002b00812de45ae087185082cf0124b0eba06ec40005000000000000110f0000000000000051894dd65b2f", 0x2e}], 0x244}, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) getsockopt$inet6_int(r1, 0x29, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 743.445771] binder: undelivered TRANSACTION_COMPLETE [ 743.452159] FAT-fs (loop4): Unrecognized mount option "smackfsdef=/dev/cuse" or missing value [ 743.476657] binder: 499:500 transaction failed 29189/-3, size 24-8 line 3035 [ 743.518657] binder: send failed reply for transaction 1930, target dead [ 743.532417] binder: undelivered TRANSACTION_ERROR: 29189 16:07:02 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xe00) 16:07:02 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xffffff92, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:07:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$setflags(r1, 0x2, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000000)='./file0\x00', 0x800, 0x2000000000c0) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000500)=""/217) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e22, @empty}}, [0x80000000, 0x2148000000, 0x9, 0x2, 0xe0, 0x913, 0xc6c, 0x8, 0xb4b2, 0x7ff, 0x5, 0x116, 0xff, 0xb2e3, 0x10000]}, &(0x7f0000000200)=0x100) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000440)={r3, 0x95, "9cafc8df9d17fc267c261c7e7381c3495a07e94b6088e45370cf856b5c4189e3cb9f7fb0c4f16758ed9bc065146af4f52acdd3040e117ff1ca5e8e50d631f44e96ddda84f44bb6db6462c6bfb016c980087eb3bec45a36959005e2b96758595d3bfd11dae35cbff52ee83d4a0b999020fa7ccae11467669be2a9dcbf3c9f775919c18506f9f167f6fb21df95f3b0b97df222ce2597"}, &(0x7f0000000240)=0x9d) [ 743.727938] binder_alloc: binder_alloc_mmap_handler: 541 20001000-20004000 already mapped failed -16 16:07:03 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xec0) 16:07:03 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x80000, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x4e21, @broadcast}], 0x10) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) bind$bt_sco(r0, &(0x7f0000000040)={0x1f, {0x4498, 0x400000006, 0x8, 0x2, 0x101, 0x80000001}}, 0xfffffffffffffeec) setsockopt$inet_mreq(r0, 0x0, 0x0, &(0x7f0000000080)={@loopback, @broadcast}, 0x8) 16:07:03 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xffffff93, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:07:03 executing program 5: r0 = socket$packet(0x11, 0x200000000003, 0x300) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x80, 0x0) accept$ax25(r1, &(0x7f0000000180)={{0x3, @rose}, [@netrom, @null, @bcast, @netrom, @rose, @rose, @bcast]}, &(0x7f0000000000)=0x48) getsockopt$packet_buf(r0, 0x107, 0x6, 0x0, &(0x7f0000ca5ffc)) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x20000, 0x0) r3 = gettid() ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f00000000c0)={[], 0x2, 0x9, 0x7, 0x4, 0x22d, r3}) r4 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2) ioctl$VT_DISALLOCATE(r4, 0x5608) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000240)) 16:07:03 executing program 4: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000600)={{{@in=@loopback, @in=@local}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f00000002c0)=0xe8) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x20000, &(0x7f00000009c0)=ANY=[@ANYBLOB]) accept(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f00000001c0)=0x80) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff4c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r0, 0x800443d2, &(0x7f0000000340)={0x3, &(0x7f0000000300)=[{}, {}, {}]}) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000380)='./file0\x00', 0x6c400, 0x0) write(r1, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r1, r2, 0x0, 0x10000) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000040)) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') bind$nfc_llcp(r0, &(0x7f0000000700)={0x27, 0x1, 0x2, 0x0, 0x49, 0x5, "fe51f47627c56c7097a1e490208af122d34549c41f6171d716f3d7ae12e562e6d8c55ec00b4cb904a613e26b8a3ae50c91e3a8baaa4aab70dcd7aacc88f598", 0x3d}, 0x60) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)=""/1, &(0x7f0000000100)=0x1) [ 743.790114] binder: BINDER_SET_CONTEXT_MGR already set [ 743.805573] binder: 541:544 ioctl 40046207 0 returned -16 [ 743.816345] binder_alloc: 541: binder_alloc_buf, no vma [ 743.821954] binder: 541:545 transaction failed 29189/-3, size 24-8 line 3035 [ 743.829697] binder: release 541:544 transaction 1935 out, still active [ 743.871985] binder: undelivered TRANSACTION_COMPLETE [ 743.893437] binder: undelivered TRANSACTION_ERROR: 29189 [ 743.917854] binder: send failed reply for transaction 1935, target dead 16:07:03 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xffffff94, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:07:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$int_in(r1, 0x5473, &(0x7f0000000a40)=0x3ff) syz_open_dev$binder(&(0x7f0000000a00)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) read(r0, &(0x7f0000000600)=""/146, 0x92) r2 = syz_open_dev$sndpcmc(&(0x7f00000005c0)='/dev/snd/pcmC#D#c\x00', 0x5dd, 0x104) sendmsg$unix(r2, &(0x7f0000000580)={&(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000240)=[{&(0x7f0000000180)="f4b66c1ecbb22bcc3b9d82ffa43892efc3d58b8fadab8d69e0e35dfa97093690a04aa89294d1493fa9c57ed5ca1fc07069723a05748a5618f8f21aca53f1763591db512b032d9c416c20373b5f3fb57279c0904c347a", 0x56}, {&(0x7f0000000440)="35106855522382327c8c7be854ced4797ff1bed6ec605b251927353a90623230da293530970b4bbaf8ebcf91ce08da26a92b9e0009dbbe0f292e07c2a51eed873d3826c257242389d682495f9ee9fd7d729d42d1b5e505083d4ddc752fcb690485bb580ae752552700867d91b3b480da16c54499ddb164d3a10b6645f3e491fe723eeee4186cf4901b6543828ac2d8867a2faeae83fcb3e08237481c434932a3d71be7696cafc0e68025a115f9dab4773d2082dda36f2ff7165d26c1d03ab24fef9ddbd09e4be407730feba4", 0xcc}, {&(0x7f0000000200)}, {&(0x7f0000000300)="5f5db1b419ac3dba256a7d794b8457686468d71d9f9bc96aaeb4cc4b39f3f9e16ff909529f09d711fbd5e8a294606b7458574187f8bd110e14c36f148a8a51f4c0b5b71ed18c3afc11294c71fa510284", 0x50}], 0x4, &(0x7f0000000540)=[@rights={0x30, 0x1, 0x1, [r0, r1, r1, r1, r1, r0, r1, r0]}], 0x30, 0x10}, 0x4000) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) r4 = getegid() ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r2, 0x800443d3, &(0x7f00000009c0)={{0x847, 0x2, 0x3f, 0x8f, 0x6719, 0x5}, 0x4, 0x6, 0x4}) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000007c0)={{{@in=@multicast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@initdev}}, &(0x7f00000008c0)=0xe8) write$P9_RSTATu(r2, &(0x7f0000000900)={0x8f, 0x7d, 0x2, {{0x0, 0x66, 0x7, 0x0, {0x4, 0x4, 0x5}, 0x81000000, 0x7fffffff, 0x7, 0x8, 0x2, '+]', 0x12, '/dev/snd/pcmC#D#c\x00', 0xd, '/dev/binder#\x00', 0x12, '/dev/snd/pcmC#D#c\x00'}, 0x14, 'vboxnet1ppp0vboxnet1', r3, r4, r5}}, 0x8f) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f0000000200)=0x5, 0x4) [ 744.024944] audit: type=1800 audit(1548778023.374:167): pid=563 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor4" name="file0" dev="sda1" ino=17375 res=0 [ 744.049837] protocol 88fb is buggy, dev hsr_slave_0 [ 744.054935] protocol 88fb is buggy, dev hsr_slave_1 16:07:03 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x101001, 0x0) getresuid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) r2 = fcntl$getown(r0, 0x9) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000180)=0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x44000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x5a0, 0x6, 0x8, 0x20, 0x70bd2d, 0x25dfdbfe, {0xb, 0x0, 0xa}, [@typed={0x4, 0x76, @binary}, @generic="e4f2df3c8b65f6e529de894d91f1e35b09b7508e0976adcc194bca4a94057a365fab4c190404b36c0516a7b3a6a9b868bf6fbda26c02d82b7573", @typed={0x8, 0x17, @uid=r1}, @typed={0x8, 0x71, @pid=r2}, @nested={0x134, 0x92, [@typed={0x14, 0x4c, @str='/dev/sequencer\x00'}, @generic="d10074ee25aaf724297809fb803ac3949ab24d0a79b1125261525639cd0cf16d63a65224d0e7b415d0ff944ba3ef2e6de4b1c0328e75b8aceb6c9cfd81aa6818ac95", @generic="f9dc81bfa80a00b9a903b1f33ea1dcc3266aa9cccd4401a888afeabaf588ee92de67aed75f1b13975ba6b3048fe91e7dfbc289e8f772f5602ecd19d44eeb94507dc5b67e5f0374afce10aeb1034ef3f69606491ec5c521ce0ac440435329cd0a072ba528ffd29e48f4069e45dbe90f6c8aa93182905b9e2eb4a078c9fda90fe42c993c02c7b1887bc719904932618b04dd47746636ff11899d75997aa96b2e4a42d3546ec98b612322852c86aae9f0", @generic="4ddbb9b99c0e9a68f42224a8307806664a830d8820fae2ba581965aaa19fb1dda6748fd906a67e25be052c"]}, @nested={0xc8, 0x31, [@typed={0xc4, 0x29, @binary="ff77eae9ffce94eccd205a54dcea80336b4f48359727f0e950ca64332d9b5fc824cd4c5ec0b347468e155f09dd3992549e6de1140da174644b8e6af9c2cc95faf3db865d884c93922336b8507ea86ae340d8e2acd532f7ac251e35b46552032b6c99faacbd6dfad0b2ebe8a83ef33b39c394dec0190f1e7eeef3dd168af55200e044e21337d4e89c18bc0885d43b3236464887e8f0d5c54ea2f4c1f97714ea7175c86ddfe294f2a217cc983600bf64109e66aba339749e184c6d9054d506"}]}, @nested={0x28c, 0x37, [@generic="d5ba902196bc7214f5986fbe34d26e46b40e27285c9c7e1d0efd29b74188ba5277fb856883cd1524cfd38c1b4055fbabeaad92e87a95a4b487c02490c8d9a132fb52c85aa0b67094ac288c617bb327230ac1ab4988e294175ff69dea807e930c3633a18a85731cf176d7caaec78052aaf9bb2a430b06b1bf426763da42703dfccda015f066e1a7f1575d1d98368252a49d023edbf859f984cd18723078578d36e24a711db325491ab955c76db47ab69cdbe7e0d0ff5f2e3eaa8d5e10c7079ddd970b12e4e5de48f3b97352e780f8be700d14bd59b03209d170", @typed={0x8, 0x2f, @pid=r3}, @generic="49394fb25aa7a5afca69fe956d2210add3a8ffd418693f19495c749e0463c3cb1eb1a49f8d2166a39685f30eede973e610b1b8370d8936ba20d5afb23208a24b9ca95c116d6114898b06d39ea4deca94269319c132bc69f922504b85b3ea5ecdb8a53cb8b369e1be7066e2296f161b1c452e6adcc18f48de9a6d7f", @generic="38ec269bde43293750c26506b1d15546a511b026de9fc2947247bbb0e36bf3ca12e31679bbd4efddcb91f025f2096657dda6808783724748a22e1cf5095c8043bbc0647da93a418071a7db6d9c0dfccad9c07a1579356e6c41434b4c02c25b557197a0", @typed={0xc, 0x13, @u64=0xb74}, @generic="8814b6a7a3d70fef45b22474e94b8f15d4e8e83b5a3ab6bb8c59d0ba3d758876ee8665c8d9877d8460ff2638c9fbffb45d4b53511d4411b6c06c489f5ae3dbe5d5a94f946b4b41b0e1aa6c5e249c29add5f6169cb4c752c9ffa1d84b5b0d6db0d30db7c3ffa5ebeb116e1f6a2da17ad5a6ddc69b220bb942e0c3348848c7d375257dd756e02516fbde5cd02a6d57c6783fac56dbc424c1479eb5", @typed={0xc, 0x9, @u64=0x9}, @typed={0x8, 0x74, @u32=0xfff}, @generic="36dfd45c8b607278ba7d876dbd8d"]}, @generic="2cd00b54db5f0125bae089da144ff1f405082fad5d72e87fa61c638e4f74d37ca458853b1f2c84aaaf26443399513f37b55307ee7fb2bc03999d3d675d5a4d112d9277fa940de2cf1ad350667d7c956ee506feb45eeea23d03c8ef30712934b89b0d74e7a42d31f3", @generic="84213e97324aade0defc5004c6a304c4097531795c5cb4930eefa7192ff63672bf21f041b3c2cdd717e953e35682bd68c2f17bea129b0e68145583d720c195120dfbbf42c76901b9e315c0262210"]}, 0x5a0}, 0x1, 0x0, 0x0, 0x4040840}, 0x4000000) getitimer(0x3, &(0x7f0000000000)) fsetxattr$security_capability(r0, &(0x7f0000000840)='security.capability\x00', &(0x7f0000000880)=@v1={0x1000000, [{0x7, 0x3}]}, 0xc, 0x1) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:07:03 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0xf00) [ 744.059650] audit: type=1804 audit(1548778023.414:168): pid=563 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor4" name="/root/syzkaller-testdir756555719/syzkaller.53H6uT/64/file0" dev="sda1" ino=17375 res=1 16:07:03 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xfffffffd, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 744.205247] audit: type=1800 audit(1548778023.414:169): pid=563 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor4" name="file0" dev="sda1" ino=17375 res=0 16:07:03 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x5865) [ 744.366668] binder: 567:575 Acquire 1 refcount change on invalid ref 0 ret -22 [ 744.415024] binder_alloc: 567: binder_alloc_buf, no vma 16:07:03 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0x4) 16:07:03 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xfffffffe, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 744.473515] binder: 567:571 transaction failed 29189/-3, size 24-8 line 3035 [ 744.606516] binder: undelivered TRANSACTION_ERROR: 29189 16:07:04 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") write(r0, &(0x7f0000000080)="417aa1629df8ddb8754a02514634c55019e0b650a82d550420d7509e7962515f928306f748255eec5e7d97229f022b39dddfc68585cb21b43050699e4cb872adf6835fa077fa99c36a4a498587eceb57d1683411d8ab95af37104277f1a7b98bca32b7413f50452d53de07fd02fb19e7edfb36c430ab3f94609b061146f096520daef01b4d76e757e199385ba6c7145a50f0254d7d354af16bf61a4f27aa2c2fefccff7848e01723b66536b49936d9f7f640640a1a4b851b25228578f93dd5b2e8a03f78e3c4dee450c0f5f9e453fe93663e3d0181be51de47d0f7201fc90690d33fb41d7065ec197f4e563e6d4efdfc3f23dcea5bf3577a65e76a35b1aede", 0xff) shmget$private(0x0, 0x13000, 0x54001880, &(0x7f0000feb000/0x13000)=nil) 16:07:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/status\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x7, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f0000000240)={0x800100f, 0x8001, 0x2}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000000140)={0x5, 0xc, 0x4, 0x8, {r3, r4/1000+30000}, {0x7, 0xc, 0x0, 0x101, 0x400, 0x0, "93ebec6c"}, 0x5, 0x4, @userptr=0xfffffffffffffffc, 0x4}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = gettid() ptrace(0x4208, r5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000200)={0xfffffffffffffffc, 0x9}) [ 744.763550] audit: type=1804 audit(1548778024.114:170): pid=566 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor4" name="/root/syzkaller-testdir756555719/syzkaller.53H6uT/64/file0" dev="sda1" ino=17375 res=1 16:07:04 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x6000) [ 745.317480] audit: type=1800 audit(1548778024.114:171): pid=566 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor4" name="file0" dev="sda1" ino=17375 res=0 [ 745.405141] binder: 598:601 ioctl 4b4c 20000200 returned -22 [ 745.467647] binder_alloc: binder_alloc_mmap_handler: 598 20001000-20004000 already mapped failed -16 [ 745.555517] binder: BINDER_SET_CONTEXT_MGR already set [ 745.580221] binder: 598:606 ioctl 40046207 0 returned -16 [ 745.616282] binder_alloc: 598: binder_alloc_buf, no vma [ 745.626604] binder: 598:610 transaction failed 29189/-3, size 24-8 line 3035 [ 745.638020] binder: 598:601 ioctl 4b4c 20000200 returned -22 [ 745.652208] binder: release 598:601 transaction 1942 out, still active [ 745.664545] binder: undelivered TRANSACTION_COMPLETE [ 745.681718] binder: undelivered TRANSACTION_ERROR: 29189 [ 745.701575] binder: send failed reply for transaction 1942, target dead 16:07:05 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa02000077ddbd4eab73260642e215000600000060b409000030320035000000000000000000ffffe0000002ff020000000000000000000000000001830090780009040060b680fa0000000000000000000000000000ffff77ffffffff00000000"], 0x0) 16:07:05 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0xaa7f1485a5, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) 16:07:05 executing program 5: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r0, &(0x7f0000000040)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "ac41d1c45d71d3ed2a4182b9a6fdfebbf3550b2209895f348f8fc6716e08d1364ad5526c6e898cbb38c310d32b6a3217fa0cb9e4cafe0569942f46cde7188b"}, 0x60) r1 = dup2(r0, r0) bind$tipc(r1, &(0x7f0000000000)=@name={0x1e, 0x2, 0x3, {{0x42, 0x4}, 0x2}}, 0x10) 16:07:05 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x0, 0x2, 0x0, 0x0, @time, {0x3}, {0x0, 0x8}, @addr={0x5, 0x7ff}}], 0x30) getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000040)=""/109, &(0x7f00000000c0)=0x6d) ioctl$VIDIOC_ENUMAUDIO(r0, 0xc0345641, &(0x7f0000000100)={0xdf25, "ec1301768dd2493167fd1fd7ee307772aa336025fa5a431b1aae67e8348e1a19", 0x0, 0x1}) 16:07:05 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x6558) 16:07:05 executing program 2: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x2) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000100)={'dummy0\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2b}}}) r1 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000140)='/dev/snd/pcmC#D#p\x00', 0x80000000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563178cdf300440"], 0x0, 0x0, 0x0}) fallocate(r2, 0x8, 0x9, 0x9) fsetxattr$trusted_overlay_nlink(r2, &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'U-', 0x80000000}, 0x28, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) [ 746.212795] binder: 619:621 unknown command -1944624379 [ 746.248750] binder: 619:621 ioctl c0306201 200000c0 returned -22 16:07:05 executing program 0: r0 = request_key(&(0x7f0000000040)='pkcs7_test\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='/dev/sequencer\x00', 0xfffffffffffffff9) keyctl$get_keyring_id(0x0, r0, 0xffffffffffff8001) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x5, 0x4, @time, {0x0, 0x2}, {}, @addr={0x5, 0x7ff}}], 0xc5b1f52ad535bbcb) 16:07:05 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x8100) 16:07:05 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x1a0ffffffff, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 746.272510] binder_alloc: 619: binder_alloc_buf, no vma [ 746.277937] binder: 619:621 transaction failed 29189/-3, size 24-8 line 3035 16:07:05 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xfff) syz_mount_image$msdos(&(0x7f00000005c0)='msdos\x00', &(0x7f0000000600)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)={[{@fat=@dos1xfloppy='dos1xfloppy'}]}) getsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f00000000c0)={@loopback, @multicast1}, &(0x7f0000000100)=0xc) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x2) ioctl$VIDIOC_G_SELECTION(r1, 0xc040565e, &(0x7f0000000040)={0x4, 0x103, 0x3, {0x8000000000000, 0x2, 0x10001}}) [ 746.325835] binder: BINDER_SET_CONTEXT_MGR already set [ 746.358986] binder: 619:621 ioctl 40046207 0 returned -16 [ 746.377556] binder: 619:628 unknown command -1944624379 16:07:05 executing program 4: socket$inet6(0xa, 0x80000, 0xfffffffd) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000500)=0xffffffffffffffff, 0x4) r1 = fcntl$getown(r0, 0x9) r2 = getpgid(r1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x81, 0x101}, 0x0, 0x0, 0x4}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e002, 0x1, &(0x7f0000000040)=[{&(0x7f0000000080)="eb64c86d4f66732e66617400020441000500077008f80000d8c32d8cbe59628cf9d9ed7b2c", 0x25}], 0x0, 0x0) r3 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r3, 0x0, 0xc8, &(0x7f0000000000), 0x10) r4 = socket$inet6(0xa, 0x80005, 0x3e7aaafc) ioctl(r4, 0x5a, &(0x7f0000000280)="025cc80700145f8f764070") syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe005, 0x1, &(0x7f0000000380)=[{&(0x7f0000000140)="eb3c906d6b66732e64617400020401000200027000f801", 0x17}], 0x10808410, 0x0) r5 = open(&(0x7f00000000c0)='./file0\x00', 0x4, 0x0) mkdirat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0) removexattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000640)=ANY=[]) r6 = perf_event_open(&(0x7f0000940000)={0x2, 0xfffffffffffffdcd, 0xfffffffffffffffe, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10003, 0x110, r6, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000580)='/dev/fuse\x00', 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r5, 0x8004e500, &(0x7f0000001140)) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x9) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x6}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_get$pid(0x1, r2) capset(&(0x7f00000002c0)={0x19980330}, &(0x7f0000000300)={0x8, 0x2, 0x89, 0x3, 0xca, 0xca30}) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, @perf_bp, 0x1e}, 0x0, 0x0, r7, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r4, 0x29, 0xca, &(0x7f0000000240)={0x0, 0x1, 0x80000000, 0x80, 0x1}, 0xc) openat$null(0xffffffffffffff9c, &(0x7f0000000480)='/dev/null\x00', 0x4000002, 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000540)='threaded\x00', 0x9) mkdirat(r5, &(0x7f00000004c0)='./file1\x00', 0x100000000) 16:07:05 executing program 0: r0 = semget$private(0x0, 0x7, 0x4) semctl$GETZCNT(r0, 0x4, 0xf, &(0x7f0000000040)=""/67) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101001, 0x0) write$sndseq(r1, &(0x7f0000000240)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 746.408975] binder: 619:628 ioctl c0306201 200000c0 returned -22 [ 746.430915] binder: undelivered TRANSACTION_ERROR: 29189 16:07:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000040)=[@flat={0x77682a85}], &(0x7f0000000080)=[0x0]}}], 0x0, 0x0, 0x0}) 16:07:05 executing program 3: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000800)="240000002e0007031dfffd946fa2830020200a00ffffffffa61d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x9904) [ 746.538370] FAT-fs (loop5): bogus number of reserved sectors [ 746.560952] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 16:07:06 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) write$sndseq(r0, &(0x7f0000000240)=[{0x100000000000000, 0x0, 0x0, 0x0, @time, {}, {}, @addr={0x5, 0x7ff}}], 0x30) [ 746.594439] FAT-fs (loop5): This doesn't look like a DOS 1.x volume; no bootstrapping code [ 746.678652] FAT-fs (loop5): Can't find a valid FAT filesystem [ 746.691664] kasan: CONFIG_KASAN_INLINE enabled [ 746.696570] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 746.704013] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 746.710366] CPU: 0 PID: 2699 Comm: aoe_tx0 Not tainted 5.0.0-rc4+ #50 [ 746.716949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 746.726387] RIP: 0010:ax25cmp+0x3e/0x180 [ 746.730465] Code: f6 41 55 49 89 fd 41 54 53 48 89 f3 48 83 ec 10 48 89 7d d0 48 89 75 c8 e8 ef c2 7f fa 4c 89 e8 4c 89 ea 48 c1 e8 03 83 e2 07 <42> 0f b6 04 38 38 d0 7f 08 84 c0 0f 85 23 01 00 00 48 89 d8 48 89 [ 746.734321] binder_alloc: binder_alloc_mmap_handler: 659 20001000-20004000 already mapped failed -16 [ 746.749369] RSP: 0018:ffff8880a06ef728 EFLAGS: 00010202 [ 746.749380] RAX: 0000000000000002 RBX: ffff8882161855c8 RCX: 0000000000000001 [ 746.749388] RDX: 0000000000000007 RSI: ffffffff87024171 RDI: 0000000000000017 [ 746.749397] RBP: ffff8880a06ef760 R08: 1ffff110140ddedb R09: ffffed10140ddedc [ 746.749406] R10: ffffed10140ddedb R11: 0000000000000003 R12: ffff8882161855c0 [ 746.749414] R13: 0000000000000017 R14: 0000000000000000 R15: dffffc0000000000 [ 746.749425] FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 746.749435] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 746.749443] CR2: 0000001b33221000 CR3: 0000000090cb4000 CR4: 00000000001406f0 [ 746.749455] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 746.749464] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 746.749472] Call Trace: [ 746.765040] binder: BINDER_SET_CONTEXT_MGR already set [ 746.771382] rose_route_frame+0x2be/0x19d0 [ 746.771402] ? rose_link_device_down+0xa0/0xa0 [ 746.771430] ? mark_held_locks+0x100/0x100 [ 746.771446] ? add_lock_to_list.isra.0+0x450/0x450 [ 746.771464] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 746.867744] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 746.873303] ? check_preemption_disabled+0x48/0x290 [ 746.878332] ? __lock_is_held+0xb6/0x140 [ 746.882404] rose_xmit+0x8a/0x170 [ 746.885888] dev_hard_start_xmit+0x261/0xc70 [ 746.890309] ? dev_direct_xmit+0x670/0x670 [ 746.894555] ? kasan_check_read+0x11/0x20 [ 746.898710] ? do_raw_spin_lock+0x156/0x360 [ 746.903038] ? lock_release+0xc40/0xc40 [ 746.907018] ? rwlock_bug.part.0+0x90/0x90 [ 746.911258] ? netif_skb_features+0xb90/0xb90 [ 746.915761] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 746.921311] ? check_preemption_disabled+0x48/0x290 [ 746.926338] __dev_queue_xmit+0x2f8a/0x3a60 [ 746.930673] ? netdev_pick_tx+0x300/0x300 [ 746.934863] ? __switch_to_asm+0x40/0x70 [ 746.938941] ? __switch_to_asm+0x40/0x70 [ 746.943007] ? remove_wait_queue+0x198/0x300 [ 746.947419] ? add_lock_to_list.isra.0+0x450/0x450 [ 746.952352] ? find_held_lock+0x35/0x120 [ 746.956424] ? skb_dequeue+0x12e/0x180 [ 746.960319] ? find_held_lock+0x35/0x120 [ 746.964446] ? tx+0x50/0xc0 [ 746.967387] ? find_held_lock+0x35/0x120 [ 746.971455] ? tx+0x50/0xc0 [ 746.974397] ? _raw_spin_unlock_irq+0x28/0x90 [ 746.978896] ? _raw_spin_unlock_irq+0x28/0x90 [ 746.983394] ? discover_timer+0x60/0x60 [ 746.987374] ? lockdep_hardirqs_on+0x415/0x5d0 [ 746.991961] ? trace_hardirqs_on+0xbd/0x310 [ 746.996287] ? kasan_check_read+0x11/0x20 [ 747.000439] ? tx+0x50/0xc0 [ 747.003374] ? trace_hardirqs_off_caller+0x300/0x300 [ 747.008492] ? do_raw_spin_trylock+0x270/0x270 [ 747.013084] ? discover_timer+0x60/0x60 [ 747.017065] dev_queue_xmit+0x18/0x20 [ 747.020872] ? dev_queue_xmit+0x18/0x20 [ 747.024851] tx+0x6f/0xc0 [ 747.027641] kthread+0x2a7/0x4b0 [ 747.031013] ? kasan_check_read+0x11/0x20 [ 747.035169] ? aoehdr_atainit+0x330/0x330 [ 747.039381] ? wake_up_q+0x100/0x100 [ 747.043103] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 747.048236] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 747.053779] ? __kthread_parkme+0xfb/0x1b0 [ 747.058022] kthread+0x357/0x430 [ 747.061394] ? aoehdr_atainit+0x330/0x330 [ 747.065542] ? kthread_stop+0x920/0x920 [ 747.069522] ret_from_fork+0x3a/0x50 [ 747.073243] Modules linked in: [ 747.076490] ---[ end trace c67cf6085d5955a7 ]--- [ 747.081281] RIP: 0010:ax25cmp+0x3e/0x180 [ 747.085353] Code: f6 41 55 49 89 fd 41 54 53 48 89 f3 48 83 ec 10 48 89 7d d0 48 89 75 c8 e8 ef c2 7f fa 4c 89 e8 4c 89 ea 48 c1 e8 03 83 e2 07 <42> 0f b6 04 38 38 d0 7f 08 84 c0 0f 85 23 01 00 00 48 89 d8 48 89 [ 747.094482] kobject: 'loop0' (00000000abeb0879): kobject_uevent_env [ 747.104292] RSP: 0018:ffff8880a06ef728 EFLAGS: 00010202 [ 747.104305] RAX: 0000000000000002 RBX: ffff8882161855c8 RCX: 0000000000000001 [ 747.104313] RDX: 0000000000000007 RSI: ffffffff87024171 RDI: 0000000000000017 [ 747.104321] RBP: ffff8880a06ef760 R08: 1ffff110140ddedb R09: ffffed10140ddedc [ 747.104328] R10: ffffed10140ddedb R11: 0000000000000003 R12: ffff8882161855c0 [ 747.104335] R13: 0000000000000017 R14: 0000000000000000 R15: dffffc0000000000 [ 747.104348] FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 [ 747.140233] binder: release 659:663 transaction 1949 out, still active [ 747.145293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 747.145302] CR2: 0000001b33221000 CR3: 0000000090cb4000 CR4: 00000000001406f0 [ 747.145314] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 747.156819] binder: 659:663 ioctl 40046207 0 returned -16 [ 747.160860] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 747.160869] Kernel panic - not syncing: Fatal exception in interrupt [ 747.161983] Kernel Offset: disabled [ 747.211850] Rebooting in 86400 seconds..