fcntl$getown(r0, 0x9) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000002c0)={0x0, 0x3}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000340)={r5, @in={{0x2, 0x4e22, @loopback}}, 0x3, 0x3f, 0x0, 0x7, 0x4}, &(0x7f0000000400)=0x98) 18:45:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = fcntl$dupfd(r0, 0x406, r0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000080)={0x13, 0x10, 0xfa00, {&(0x7f00000001c0), r2}}, 0x18) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000100)=0x0) ptrace$setsig(0x4203, r3, 0x2, &(0x7f00000003c0)={0x30, 0x2, 0x80000000}) [ 3187.925098] libceph: parse_ips bad ip '.u [ 3187.925098] :d]:.,[' [ 3187.950350] binder: BINDER_SET_CONTEXT_MGR already set 18:45:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000080)=0x30) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) [ 3188.000660] binder: 13781:13796 ioctl 40046207 0 returned -16 [ 3188.000681] binder_alloc: 13781: binder_alloc_buf, no vma 18:45:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x8, 0x0, 0x2dea, 0x10001, 0x1, 0x8, 0xfffffffffffffffc, {0x0, @in6={{0xa, 0x4e21, 0x7, @remote, 0x7}}, 0x7, 0xffffffffffffffff, 0xa1c0, 0x40, 0x4}}, &(0x7f0000000040)=0xb0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000280)={r2, 0x41, "f251d050bea365ca4b6e25a074868838d54aa03fdeca7330f1b40ce123b24583efb04338274ef67e7ccfdaa2e686c854fc4fe2a9f95fb6742eb3046fddceca8edf"}, &(0x7f0000000080)=0x49) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:10 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) dup3(r0, r0, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3188.080174] libceph: resolve '.u [ 3188.080174] ' (ret=-3): failed [ 3188.094767] binder: send failed reply for transaction 610 to 13781:13782 18:45:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3188.128848] binder: undelivered TRANSACTION_COMPLETE [ 3188.138938] libceph: parse_ips bad ip '.u [ 3188.138938] :d]:.,[' 18:45:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x8, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000040)={0x8001009, 0x100, 0x2}) 18:45:10 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000400000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:10 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3188.233887] binder: 13828:13829 got reply transaction with bad transaction stack, transaction 614 has target 13828:0 18:45:11 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x100000001, 0x8200) 18:45:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x24002, 0x0) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000040)=0x8) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) readv(r1, &(0x7f00000002c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000001c0)=""/116, 0x74}, {&(0x7f0000000100)=""/25, 0x19}, {&(0x7f0000000240)=""/106, 0x6a}], 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="daff0000", 0x4) [ 3188.377597] binder: BINDER_SET_CONTEXT_MGR already set 18:45:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x260) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3188.414962] binder: 13828:13846 ioctl 40046207 0 returned -16 [ 3188.421608] libceph: resolve '.u [ 3188.421608] ' (ret=-3): failed [ 3188.470581] binder: release 13828:13829 transaction 614 out, still active [ 3188.488322] binder: undelivered TRANSACTION_COMPLETE 18:45:11 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={{&(0x7f0000ff2000/0xd000)=nil, 0xd000}, 0x1}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000040)="0300c7aa", 0x235) 18:45:11 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x8000, 0x109a00) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6tnl0\x00', 0x1002}) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000080)={0x2, 0x4, 0x0, 0x98, 0x401, 0x6}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) getsockopt$sock_buf(r1, 0x1, 0x1e, &(0x7f0000000280), 0xfffffffffffffffd) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x101000, 0x0) mmap$perf(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000001, 0x8010, r0, 0x0) r2 = syz_open_pts(0xffffffffffffff9c, 0x10000) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000200)={'TPROXY\x00'}, &(0x7f0000000240)=0x1e) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000000)=0x2) setsockopt$inet6_opts(r0, 0x29, 0x0, &(0x7f00000001c0)=@fragment={0x2f, 0x0, 0x10001, 0x2, 0x0, 0x3, 0x67}, 0x8) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001280)={0x0, @remote, @empty}, &(0x7f00000012c0)=0xc) bind$xdp(r0, &(0x7f0000001300)={0x2c, 0x2, r3, 0xd, r0}, 0x10) 18:45:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x200000, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000003c0)={'nat\x00'}, &(0x7f0000000440)=0x54) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000240)={{{@in=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@local}}, &(0x7f0000000000)=0xe8) bind(r0, &(0x7f0000000080)=@can={0x1d, r3}, 0x80) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r4, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) [ 3188.528367] binder: send failed reply for transaction 614, target dead 18:45:11 executing program 3: r0 = request_key(&(0x7f0000000080)='pkcs7_test\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000280)='aead\x00', 0xfffffffffffffffe) add_key(&(0x7f0000000000)='.request_key_auth\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000001c0)="2b8983666470d379b85b6a35f086db28523b732bc2e5ced26c33abd7f98c9437ece778f2ddd86ee241e72d5809e1a750496759ad84ca4a9488f396835a7e80c3aaa782629a75f6d18e6816900681022aa232e879e77ab8bd42a04502e4453b7d84c4cec560ebc1ee5003145caf58215b098149f0e9fc67be58b3cf13b30d092eb619e9bc439f2624a7f4681b0d0c", 0x8e, r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3188.626060] libceph: parse_ips bad ip '.u [ 3188.626060] :d]:.,[' [ 3188.647609] binder: 13873:13879 got reply transaction with bad transaction stack, transaction 617 has target 13873:0 18:45:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) [ 3188.696005] binder: BINDER_SET_CONTEXT_MGR already set 18:45:11 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500a0500000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:11 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x2, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3188.732826] binder: 13873:13884 ioctl 40046207 0 returned -16 [ 3188.769396] binder_alloc: 13873: binder_alloc_buf, no vma 18:45:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000140)=0x0) ustat(0x7, &(0x7f0000000080)) ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f0000000000)={0x2, 0xfffffffffffffff8}) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) setxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='system.posix_acl_default\x00', &(0x7f00000001c0)='#,-\x00', 0x4, 0x1) [ 3188.814543] binder: send failed reply for transaction 617 to 13873:13879 [ 3188.825248] binder: undelivered TRANSACTION_COMPLETE 18:45:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x9, 0x40000) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000001c0)="80c46265d5716f89fca46f0a06bfba9dbae40e040d12b2007fb3446c25e356acfea07416ea8696acd56ff974053afccc22dd3e330c171a51dc04c314a1063d24070b32764235accdb29e2ff876ff9ce04296af1df456bc8c24186277bc126404766436d357bb27090a54acd12b99086f827a763acb2116f3951c2c7cdb4b378ef78251a194d82f35f8ae5c0b63f0c7f6ab71984932803f0326ee514b3736667e4a889189ca466549e52e13f8b664ac2d8910ae3d87fb55933adbd90c4ef976a6fb5d21f270e1e43d8ad57723c9bca68dd126226e46457b28636ad51cb5e685ce422d01c1b451", 0xe6) 18:45:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x2a, &(0x7f00000001c0)="15a72855a5c7f5acfbb5b96a400344c995b6d53e8d", 0x15) ioctl$RTC_AIE_ON(0xffffffffffffffff, 0x7001) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:11 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x3, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0xf6, "a9b59fc6035183072e8f58a1b80dea509f711b67bc51fcf08fec6b6f08ca286ddcc8a5b3a5e75a62fbd5d1383e1c2ed3aea7cc699eb6d704103555a6eabd6c74ed8244a2ad5817f5257e2f2028980da2d22f2f3cb762d74bdca6155779d9776f37027db3c147ff862c307303b0c54eb5e6ff8663086c3ce515777f6c0b86c52929c26424e7a258a1b1a062bfb38e42255f2e6d1d5c0e3ba24063380bab6fffc4113cbc65aee2abf42dfa0f3bb3d0b0a1228fa6faad7aa041db05f1c3abe334fcfbf392b2cbea6bcdaff01be61e1196cbffcefe4ce1796946face764b208193680edd742ae4a815f1fcde7a336fbb23f164763e96ba76"}, &(0x7f0000000000)=0xfe) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r5, 0x2}, 0x8) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f00000000c0)=0xffffffffffffff9c) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) 18:45:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0xfffffffffffffffe) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x20002, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {r2, 0x1c, 0x0, @ib={0x1b, 0x1, 0x0, {"481d5efa81163ef6f199b03169267daf"}, 0x7, 0x8001, 0x3e}}}, 0x90) r3 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0xfffffffffffffff8, 0x121a02) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000100)={0x8, 0x0, 0x10000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_AGP_BIND(r3, 0x40106436, &(0x7f0000000140)={r4, 0x2f9}) ioctl$VIDIOC_G_SELECTION(r3, 0xc040565e, &(0x7f0000000080)={0x1, 0x2, 0x3, {0x100, 0x8001, 0x1c, 0x4}}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) ioctl$BLKSECDISCARD(r3, 0x127d, &(0x7f0000000340)=0x4) [ 3189.027989] binder: 13918:13921 got reply transaction with bad transaction stack, transaction 621 has target 13918:0 18:45:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="0f68c7aa", 0x4) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x3, 0x1fd) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000040)={0x10}) [ 3189.125280] sctp: [Deprecated]: syz-executor5 (pid 13927) Use of struct sctp_assoc_value in delayed_ack socket option. [ 3189.125280] Use struct sctp_sack_info instead 18:45:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001f80)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000140)={'bridge_slave_0\x00', {0x2, 0x4e23, @loopback}}) open_by_handle_at(r0, &(0x7f0000000180)={0x1a, 0x5, "68e8ac96f89fa2e7ece4d0a8b51c80e59a0b"}, 0x800) sendmmsg(r0, &(0x7f0000001dc0)=[{{&(0x7f0000000000)=@pppoe={0x18, 0x0, {0x2, @local, 'ip6_vti0\x00'}}, 0x80, &(0x7f0000000100)=[{&(0x7f00000001c0)="f2174893dbe92b86fa802ca5a93626bb68882160f9e5129fcf7a82bb1bd5f36c3a6d7b30d4d920792e0e5a9b695042adc843687c4233d70b55964194f9704f97ae560293fc6dc4593073683d42d5a12457700bf100a729d0290e81c3423dd60806844818d2995b4671e44e746dadd57899b50264f7a02356b1cf431835ec7d37d08660ab35629a326b1441bd59f9fb672526a1bc5bfad281d69af309a6a121ab9b49abc7b1a5082cd490ac83527b0811e40f0c8e3767afc0f9ef70b389257f84dd450aa8c7c038fef91798397566a261ea668ea35437cd6468da41a431b4c7e554b48bea8173129089", 0xe9}, {&(0x7f0000000080)="6fd21b9737ec38ec1cfff3f42ff5a0afc6185347682a16b106a8e026261587ae35edeb861e7a4b4f648a3351c276291d8bc0", 0x32}], 0x2, &(0x7f00000002c0)=[{0x80, 0x84, 0xe96c, "762b1aad928f49b01f3a25f1f175803b4208b44ffa4f3358dc3dbf002bc99f2cf0963f8acab93470bf78bf55583dfe28ccbbbcbbc480f978b7e9b52a4549b3a0659283b7a4ddcc25e413f50dad2ba1538b924a6822c6428df07f9b79a7d72999d5999f576bb31eb38e4a8607"}, {0x100, 0x10f, 0x9, "9c197986e60a23dd94ff6c11f5d6bfc58896d3fe8a028cebf65555b08740f14b84a783c4d232e68f45808d1af88aa292787f8d08032812c126372f0b57122d4c4faab31ad23b4505077aa6c1190ecbc49b1a7d12ab8faf32084ab9c080312ed96c1b9df5bc7691338ef7e4774dc97e680da2a05812904c9337eceaabc7041490fb21735fd3b78d9c90ebfa6ec3a9d273bd0d5647e06829d0c3c24617913ce55c4b3cc1b8b070009b54e143d52af16495eddee73cf1a7bbffb7dc9d16e3ae881da6a260f6b9f8ecfa017324e33543de1cbd650b17876437e5611ea70da0fffee779b6ed9f12224fa8167ce40053d5b2e5"}, {0xf0, 0x1ff, 0x31, "9b9da907c6f1444249aff58be720d2d67518791fd89722f21a6f6f510158a42acd493c43564224cbd975a276fec431fdc5eb7eeb4dc8da1abf74186acf1b203396317eb3eaa8497c34f06d2e4eaba89c525c62ba93764122a9e73c3b33858452caa58f3ebc10d3cb5eeeabe645bcb377685592d4262fceda9f52292886089e8f4c962e93b7e433eed8c7aef931cd44b2e0c37834bcf5311fe7d0cc585c4095dedd4f7d75d2784a30b6e7a611af616d348a3d5408159b95bf0e63072f6934a5c723345df9d78231d5b2b930210986c27e9fed19febac6b9e459850c"}, {0xd8, 0x11f, 0xa2ef, "0413c42951beecb5a3cf0218bdd657584642a6adcd380f6f0dbb5a1fd7e15bcc14162c43bbd99658596e87bf69fc2cfeda3ad49bc13768f8cf1efca4bd0706107d1c7ca2ac2fbd18b15f0a99d0154b75ef4a4d285d07966442ea9f6b7b6864457c69a10992656b92056f500321d0633f144ac24e18b992291c2743294a40adac74273288da34d90b97dac26494989e91d43a2cc549ce6ff3f7254ca6bcd6dec765eb4fbe37a9e75ec37ae262984ec1130db300ac7406cbee8e3dd0d67244cb7680ff61a6"}], 0x348}, 0x3}, {{&(0x7f0000000640)=@ethernet={0x307, @remote}, 0x80, &(0x7f00000019c0)=[{&(0x7f00000006c0)="54bcbc15b83ceed29fb09a67561f508f2849edf5f8f690a96a47ccb1f481304248bf8dbbc71d00c5c1afdce15d81e5260f0da9ddcaf2e18698c49f68a66c27e8dd1938bde100fac8ff1445fa834ae31bbef82b61fd7fce9b53b90e18a0679f0eda36752bedcb80839035bf9bf342ced767f7b797b2925c1a285f2633f886ac8393cb", 0x82}, {&(0x7f0000000780)="b3695a61", 0x4}, {&(0x7f00000007c0)="95a18e8a87052d52c04e88272334c1fcade52d021599cc6095456b8058cbfc6a94248dd20c49f4bf661c65b01cfe7580d6b3a87d164fee1de72f6e0d4107d3fe5dc20eb9eede44ed26c07c4bf73134066ff1cddb6512ad232cdfcd3f2e415c5ea848c6622ea921b312f91c2b07b2b384e5f9c4fbee4d3968b5b9752e9712be96541eae3a1528e3ece392db41fbc836a205e56ce6bebc00d229e7ce585863789af6a761f3bb7d7c82ede704d0911a0c1c773c5e34a384df2228faa8c92ca97401d6dbf7643ce52fd453a00e5dcf2e7d7a9f4a6e1878b7cfae93d33288cb75c294da1e078c28d8f03ce5d22406", 0xec}, {&(0x7f00000008c0)="fa698814f625f985e7c188b9211e3c234f85b772622763cdaf82db0bc2a1a4f9a9bacdb1fe9742604c29a2a9543b396005b7877b865b83218bc991716a5a92a0972bcc8c86a22a46997c6d22752d397a182c0570c12f755988edfc7be3fc8b54fb5c645973fcd87db0688e25c1c760d33e99d55d60e1d463b044fd420c537904aa7762daef7e55ed4bfe52a6c99f2ee43b5f19d3d093c9109efc4d570702d23e84e0238ea1313a7489a9ba71a2a6e718f4daafcccba9389f636a77a9e2650b63240efd725081f84d53f531b27a50907cb316cd9b6eb1fb65cd3867e7d442064a1c47bb5e4b21f9fbe7114172ae0d6a96d399f0da976165adc8a4237d9ccf9827b7150b614f4cb694b859e597e6b66c902d7c4eae2303cfd74fd9a30e51e6bda5cabbac9f507b6021aeaf7ca30ad7e69e7cf49de86ff6c3a45dccf83dfd0d4952006d569556bcd1af0f564a15029f1a2e93d9faa4f47d59c2f82bd8874bd4536d739ed989048cc63a5d3c5757dc36f978e99deaefe178292a3dfef0b648f5895c8023c7d872f9ad34f8f6b07d9ad750e498ce0434e639731453676302c3c715aebaee0797e91f81e6f8ce6a5b980ed6d19c47efdc7c7f75279b4a250568d4daee88e6a88a31dd575ccc4237b6d724c16a0c6dd55fa0f9a3ac5f4c115dba2c041561acdac989bbeb631a86ae967fe6019c9e3bf6f5737404e5de79ec836e77440d9cb905d798536237d6af737cd5ff47321e5e76fe1dcdc838829f5eb62901c2890769db8252a8e3f2ff4a826c3bfb5abf7ba5b211dc36aa34744fbdda733954603ec762b66027c5713730fe800873d0de2c1f74e3be2fad0e94e17b50a5b07014981ceef0c9ed02418381e5f9a687f8a2f22a113bb0685a75bc38471af8802fa332b74fe88623d87654e0a845f182558e13089e4d34f61a38fd8a681ad72d77e710655a8ad6117f0c91c18ad830fd422ddbc05ec9c65f7809d4f5494e572463d12d01a062d954fc26902a6fe6cdc8a718875d43086b064107a0c984430a50286be16e47c5def6e7eeaab2f2dbfce9113f747b7faa5d53cc896067ddb5995125857dc1c99827ade98e8f99eb8f29558f39e74b86d081d1f3c5a14d5855e1e0636c411bd1c780161a1c2eb352d807b97d759fd50449344d0db02b663156af414577073603fe32d5319145b6c26ce8ddcf28fa2ea1fa18c5d48d155bad9b4fa09b87f43780c43074c466687978610612419d91e6cb11f499c5521b268f36e0632cc25e9eca61b61089092438dc51f1df1fac97d09fbfde4ac836424c1da5533bd455fb6a9ef50a05a52a8f47a06abaf15c0bc10a094e082fd378386949d6ad836ab6cbb44a63558c99d6452c4c2584519c4d6f17f082db037f3a2480e0b7dc5624283b4e35b602193a3afe51461f1b5a35c13ae6a22efe510b3b560eb4b6a21198cb2d7c1269cade39c457cbc275c46f22c1cc6c9e45189dd584d8b49f53630443171f90d6b8aed82dbf08d904307aa34b6fd9167b72c023c27a6840110c050bcfde217a9f8e051fb12837d9fdb03db0dee3b2fd2c767237bb100b323930e32cea6ce200063a4d7bfdaa3d89d7829b97d3bae66a369d91f8ad4605c630a162c99b48076c691db9d88bc49d9d93ca323b23a76711afa6986145fd58e2124f8b46405d73fa87ffe6a4bbff6641cc261924190174704e5c24b714390b0a98461b2a06f428affbd33c0b7157f91d63ef5da5265ce0ddeffacbaf01550f8c4644a6b4f4ce04be0077a5b379d31acdc6d13931e53830da9b6aac1d5138c4666b1e4c934245269471793f7d5e9cfce1e6e5b3e43f738c8c45d8c942e80eb9a0191a99274150c36dcf779a14c365ae479b6c1b0b1dcb75629842bef0e0ce888d1c0e81a20f2cdd21dc5a68a8126d2c5b1b0df6164a445aa125fce1d1a81190148e960263365ba57c9553245bc54aa9f6c163867265d2b868d1870b41419ff896deb963fe0314d6b831b6b4ac14dbfa589f375bdf3e3a1e0cb59e6bc788b72bcff3420c77b22ade6a0fe27bc9f28bb31a4efa2d5b6f3a8c15f49fc5ba31d15b14dc1cc7b4ac0d39f5347ed0e81d7cb2846c9f585cc898dbf3c1f06c015d8c7e89544453896785fbab3ea50b54b8258eebde3824c5608c9fa37ddfc16ee9bb1f38731a0c0e87e1a3ced0a66f5147e18065d1250fa99f03502fe379a813f5960645b793691d9b0a27d6ef9b6562192d3a05c69e6c3675b068b3efaa7a194fe8e68eff77c340345919ab189b5bf92ade1fcfac3869b6644913804fdaac74e3697be111bd1f8ee278c16c0befdb1b9500dc538a5305242403c743c1adf0f9df9eff49492567ca8a84638e20805f38004978fcc7585cae6ddd2b522af2da76267d1b0b65a4422bbe60b5be9ababd1df0c090288031f2ea5b65270be1811936dafebded4b322718c7513b924f421ac2656f5a329777b39a6e92786f93c6777d2f2342e326cf68f4a5cf0445117bc8f8c5fb291254867f7631cf96aa51d70750521108a13b6a7e6423d48626a363837c6e50fdec5e8c3e260ffb51f12bf45e848a52ec18acec4f169dc7b24b031f841a6befb46a3415398f7a7ce816d1bb4a67b828ba814a6d5261047a6e682b955ef4ed6ab5ac6039a9a8786434b515c5b8ad31ef458aedf9cbabfc8bde84f98f580b10df4a62c6c4a25e026f040645d432c32a4fa1f66e247b4675e87097bb5cc2b45f8ee59bb565308495ffe7fbd1df703f0689d6950b48fb6cdb4bfe07ac939bece453d836195bbb8d6f1902dabb7c8c662e81d51fbe8294284500e1bd5f06dddf8184f47e50d1a58ceb7fba0c195a835b625e0539ebfa76b7af444aaa2647728c59297be21a82afa72fc3dcbae37d4251aff0ca1c5460fe31a01039a58dcda0fadb052b579c68c5ed9eafe97bc5681eb54dc965da082541ea3448f18670fbdd7b003dd758b7044917ae78bb733c6f21e2a6e97808ae879fa015752726bcdc0f038d471399b96f33b2eea31eeb47ec0348b00da228c66d4730891b33045b8516ff8eb15417affda26bae4cbbc1fea2a24da2172502f62fe23d692945f4a2ab374bf164556794db5af0f6dd9c60413676129c451ce51278a564deafaa00972dd89a1e265882cd74ff5fb6eecb4ee259077e565f35eaf439ea9d0530850dc9969822670bd45f72c3a7b92c0d44a36b5000bd7d80cd3ea4b89b2f114e0edb8c799384a5da5acc9148a9e494db96759d00be980a7435e1865dad6d07e4827775a09a331140194a4e474b5a97c81c1b27a7037bf899f37789c3818c3fd94139bde02b8424a8fbfc52bbc0b07dadb7844ce8790d9f4220fd2720f9eee7b3bdccee0468e7ddcffccc8f2dfed06fab2078fec42d611495e94e0337d3568674cac14fcb697199adf901b50593562bdb0d5ef9b909a1527bca0004ff133f326198bee183bc0e3d568159172fbf5cb9514017afed12f073ace5a0d5e73c5f6a6545c7f69f2a637c51f27c1ebb211ec91264bfc54fda098a64b0457c9920fbeb9473c5dd3a64185ea1c2fbaf9798ec0d0a37cbe1fb5ac27108024384ed0a1ca19da4ff002e045f4b631c82a4d43d302ff94adfbafdb99a0d7b6f66158db4842f93e2430938eda2ece2ab4e3c42eb1c8609be3df30107c9b4e660d7cce270905b79867b21058685ffed1743482e506c0cfae65b94413c8de22ae1e7f6c8736ff5c858decbbf74d2371b243b7fd6c728b2c36da149315517d8a7ec502d8e5f9fe1a951ad459ebe086740ec85b7c925710670f0902a6e80b73bfe870227f6f0c89f1c627e5ad73509df29d382054d16c2b8edd5d42d026562f8b55f2fe1b6d0d5d1e078fdf3bff09f3786469f0f08992a0388508db3fae8da701f7ab8ea66ebaa3afd16c045dc4f69bbdf7b5f421e04cf47a65571678088062f83a3b82b91d4011652ffd97618474b27c770971edfde00f93dfde6357640a0a468482efb49391be0d9f9e10c9398d7c065fe3dda14ed6a72fbe2c59c10b6430221cd9f8726e0f14c0c1788d38b236ed48946d29b749b9c9e9f1cf1cb21c20306cc2cbcfbe45d62ba1ad572d427c5e2683df7732fa0ac074a8c3df5de89577e476cfcab992c44cf0c343be241e3656758f1f23a9878e9f667fdc579544919b6a15ab875493855654b48a9ad7055f3a55f36fad9bee7a66d7556a1af66d4e4d54c0027fba2fe3bfe7576bac4d896e94331f482ef5cdf874080f15976c12020053420d549d6e25f209fcd4aa0581d6c81886a212fbe7dbc1786485c0f7a4e7da1e485e07f5f565e3731e06437f4238ec55db0ddbbe7ebee8e535669aec68808baf80c67457e5a3e49653f05f4865fd9bdf296e567ea1c67032d4599be30e79d223b70ab7bd6fb10d8ffe6c0c000012915e4c41c7c361f13edfc84d8f8842d4d9576d7cccac0a5903d39439e1c1fcf810e67224fd09138158d5b04fa90708dc2d25ed7a30d00e424dc9b2dcf462ecc2c4361f2bb39ee8449cbd9cb722ee349ac194db8c8be1d0809446fee78e77fdbce19a4b99e00a49aa4625f31a33eeeade3d5cf401ef1a231579b35ce346c6edba71bf0713ca6d26a27eec2e31703f62eaec1ea1d44b07dbb7e68e9d29f9f157f29884620a68d13fc5465918f5d740fd9d4a77f0f6c4825ae465c34e9c6b7e6b0575dcbb808e5cc7618172506b492395a85867bbce0be72b8c0bf6fcc535d6eb72740413eab764e188542d2b6cdb8ef6e3a4add6d4fcfcdd6c7a2014405de9b7f515801b6d0ed9adbca587e5558274088075898887c480e0b212940fb5d4e11cb79745ce76eeaaa9fa68a7b3729d39260702576af514a19ca54f56655e50724086582375c147e21ee4f97d87df36c57e50f2e642e924360ce7596d8f05346ba07b781a2938b6332b9a4a7e38ce0440941ded5e5d0759ae402fd5e7c35a47865b38f4b12c7b34d914f39a12773c313f6c659ee88ed1dd5d316393423fdc559e75b9506b2dc58dc2867b2e666af4cf3e82f36cbe2fe96f0c56961a0ae3a3dceca027e33de79e92b30cc1bbcb2d5982d8bcb85a45df2b3aae408748e8ddfca8d28239db77bfdab3c9ef9f841b1c843157e8fbd5c6117888259ad3824101c5726d65bf0c2b5fe9c0d4c8aee4eea5d54802d182135dee1362f43f812fb38e28c4d4bcf4e640975436433fc997580aaaa24d71a857181c32cec45e9e80bca802caf336c1d63bc5b173b6681ce813a001415eec12aa0f2e2d8eb7931c64e7d993df36d80faf4f281abc86373bb721ab0e8d874089c2e586f5e4c09c3f6deea82a8ff148a4f45f735a007d2fa8f586277c614062786ed23b6d4b431b52bd4cff7baf2df2209bbe044260b591de212ff952ca9a29374e3be7b9b75e532ab21d4df96cbceb748da8581ff3a8a6acbc1d252782c7baed74d74fc6b8b5c8767518ae742060832e77615999985140cf73772a5e3c1bcd6e488d5bfae29f81d62e11450685894a717047c08a49b7ead13cab46d9166ffaa036fd22247c2bc93e62237b1153b308475eceee7c702a55c103702ed74c6a7d156c921e934b51cf4bb0941d40718dbfe5ac7b02d3a7b05ca2bbac297391b1e6db7fad00c2ae4122e24cfc540dfaf953f1a2c57c3d072c6438a45a3d5c07e7c75d9927c6fcabad4859cfc6d77fefaa3ed7cf815c75908ebaf4e721514553b6085b0c6f5487fbad126eff5ae487eea1d6baabe4a3834f6a2804d0452c26312d7ef506eea738786dacfb3ba0253dbe6b15a1517774adece2e89da8fadb4239f0dad8c2eaafb1be43c87c948f676", 0x1000}, {&(0x7f00000018c0)="0bfaea15274afcdb95288fc54efb38cc61216f64336e6c9c4e401a3537feca1c52dc97652d9cd790aa04c89160445088ca73fa0313f86904e04dc204f23c5c687ddee2e9bb4d778ed74f99f8cfdea006b629d3dea191ac0b1aeb9e17cd7a9de94588d1c7cd25d3af14356dd284e986a7995abcde38b093293eee3bd719bd0f760e2f6cf96d19776f007c0e2d1ac00cc7b675f80d8df3146bd83fc22830220c4ecad9e208c0d3feb66efa1ca6179bd514295ffebc42b49ef1d3bb18f241c488a87de86c210c84e63ca0a82af6c25d6dab480c9da12223ad2869cfca9d90b6d193", 0xe0}], 0x5}, 0xbe6}, {{0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000001a40)="4fee4d896d86d596e8922568c41156b438295df384634a02eedecbe02bbfbd8bd00666f81da0e9db7cb206", 0x2b}, {&(0x7f0000001a80)="7f40db5bd61c02b38a3ec88a7e603faf61e1a15e91359b1200a381093cccd9a7272c1308d0a5f87b034d82d4cfa11f147d1fb70a40ca52de5447a9fef629d9813ad6e6d3ed2c3f6d7727a6b802525d43fa8e3773cecd5e9176f61ef111f649bd3add7e2dbf9dd7c482d32f413c08a3a96880bcba7a7e018e402fd60a5623b3bf4255f0913da2", 0x86}], 0x2, &(0x7f0000001b80)=[{0xe0, 0x113, 0x1118, "3d76f0f272773bf1ae3077d46ef00f2cf6bdb9681d8e7db02b5de2f65f78b8784bf1971460706e6ad571f3adc57463607194e9f1b2af73a05e0f32466c6560b2ba4f10709792af4568e5ce3d6b469f34e0de8297e0977dd9679215bdd923e9cde305d414cec18e743ea7a93cb0254356d4df7efcff0bbcbbea9217caac4506753b1118983d3862928b4792fc73a9ace6f1cfd10be3cb798ecbc739c095ff4ff397e78a0a9d189896df5cffc3042adf7a2951223e2785ee277d73a347f45d9072dce4c3f5f81c879542c5aa"}, {0xb0, 0x1bf, 0xffffffffffffffff, "b9a1eabcecd80f8eff0d95e5c4e839985c67bddbb8beae5aef1b839de35ba6ba11800571819bb35d19270e2a3adf0f66775cc8f111250428df49c0da34d7112e2bce48dc89e6f7575865976d3bd3f125cc712692c36097916e9e882ae139a922be82f1538600c23074d7a3c36a5efc204e6d2086b8067e6ab338c6e13ef9f89c6a02e1e97ecf5552f889bf9def3a92a64644f551ca4174bdf8b751d2ab53f148"}, {0x60, 0x107, 0x10000, "71bb25eaaeef359cb1260baeda0aa24dbedb36e086e12f827cd961f673a8ddd04204f097b419629af585c655eac9d85522af6266bc22cbc956a50329a8200c6e6858cf7a64f7101bb1a46e4255"}, {0x40, 0x0, 0x40b, "af56c495ce82afd6159336ee9935a4383fc0a8b0ae138bb49dcf2804eb3bbc0584b6b4d73471565983b748d3f97e"}], 0x230}, 0x7}], 0x3, 0x8000) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000001ec0)='/dev/btrfs-control\x00', 0x400c00, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000001f00)={'filter\x00', 0x4}, 0x68) openat$null(0xffffffffffffff9c, &(0x7f0000001e80)='/dev/null\x00', 0x180, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3189.170316] binder: BINDER_SET_CONTEXT_MGR already set 18:45:11 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500a0700000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3189.215968] binder: 13918:13931 ioctl 40046207 0 returned -16 18:45:11 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha384-ssse3,xts-serpent-avx2)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) getpid() [ 3189.268714] binder_alloc: 13918: binder_alloc_buf, no vma [ 3189.292613] binder: 13918:13921 got reply transaction with no transaction stack [ 3189.304992] binder: release 13918:13921 transaction 621 out, still active [ 3189.311973] binder: undelivered TRANSACTION_COMPLETE [ 3189.336017] binder: send failed reply for transaction 621, target dead 18:45:12 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) fcntl$setpipe(r0, 0x407, 0x20) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000040)) r2 = dup(r0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r3, 0x406, 0x70bd2b, 0x25dfdbfe, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0xd92, @link='syz1\x00'}}}, ["", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20000010}, 0x40000) 18:45:12 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="0400c7aa", 0xfffffffffffffe68) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) [ 3189.507204] binder: 13956:13957 ioctl 1260 20000040 returned -22 18:45:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3189.571243] binder: 13956:13957 ioctl 1260 20000040 returned -22 18:45:12 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000008301b48d6efc6f7bd8e89c02befa26a42fe32d71bba021e0bd2f28a8f24002567950314a2c85b50c2907ff8e2f54c33a18b11f349cea6710ff933814e13e578dceca0fc150bc33615265f322b1bc6eccddb34cb1256ad06af4071e73387818b61d05887367ea667815ed4f4463f72de26ddf9f526fa78b4298d8815152183426989e67a20029eafd9dcb08369845836228687ae693eaba22c9ee5c192d21507b82952607c4ba291bbef37646f5c405d77d6619488209117f4da99a3a46197f41e63fe132c02fdab921ff3bb43f6392a8e073bb02773f1defb676fa1753e37dbbb9bf313dfa68c69e546b37a9fb60478a5d94"], 0xfffffffffffffef5) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, r3, r4) [ 3189.616898] binder: 13962:13963 got reply transaction with bad transaction stack, transaction 626 has target 13962:0 [ 3189.715557] binder: BINDER_SET_CONTEXT_MGR already set [ 3189.725737] binder: 13962:13972 ioctl 40046207 0 returned -16 [ 3189.761615] binder_alloc: 13962: binder_alloc_buf, no vma [ 3189.783784] binder: 13962:13963 got reply transaction with no transaction stack [ 3189.808841] binder: release 13962:13963 transaction 626 out, still active [ 3189.828993] binder: undelivered TRANSACTION_COMPLETE [ 3189.845921] binder: send failed reply for transaction 626, target dead 18:45:13 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000040)={'hsr0\x00', 0x400}) 18:45:13 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050030710000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:13 executing program 2: setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, &(0x7f00000001c0)="f574f09d471660fc455b9447bef4656d2fd2c28c2dd1b555263f59a0e6a0c8e7af16fc8b0c47144ad49bca2d8148745c1b5dbe1506ba38c0682ba11d0d9eb54b6fe790fd35d53d27939923d9cbdbae9343b6e62fa8bd4dd88bcb4a3a6c0f86397a1525a6edc0a8b859a3ced84b7968ab9ac9176b8749ef40f46c35d45946df9accef140f77848a8bc24c599da153e4dde7f5c279d42e79d08b2b1ff0fc35a7c0003af284f14f070e12dd36fefa36f7f7d1b037219b903e800b9ea9e9e30ab5dfaaa6edefd2022bcfb2aee66c7f7a7a89e00cbf195b", 0xd5) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='pagemap\x00') ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000340)={0x7, 0x3, 0xfff, 0x8000, 0x2, 0x6}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000040)={0x0, @tick=0x1, 0x8, {0x0, 0x533}, 0xf5}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000380), 0x10) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r0, 0x4010ae74, &(0x7f0000000000)={0x1, 0x1f, 0x95}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$VIDIOC_G_INPUT(r2, 0x80045626, &(0x7f00000002c0)) ioctl$UI_END_FF_ERASE(0xffffffffffffffff, 0x400c55cb, &(0x7f0000000100)={0x3afb, 0x0, 0x5}) 18:45:13 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x7, &(0x7f0000000440)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) r3 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x4, 0x8000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ipddp0\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r3, 0x8936, &(0x7f0000000140)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x64, r4}) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000240)={0x29, {{0xa, 0x4e21, 0xc, @loopback, 0x59f}}}, 0x88) 18:45:13 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x401, 0x80000) write$P9_RSETATTR(r1, &(0x7f0000000040)={0x7, 0x1b, 0x1}, 0x7) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x10001, 0x7, [0x8, 0x5, 0xfffffffffffffff9, 0x80000000, 0x8, 0x3, 0x4]}, &(0x7f0000000100)=0x16) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={r2, 0x100000000}, &(0x7f0000000200)=0x8) 18:45:13 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x2) r1 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000100)={0x0, 0x9}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000200)={r2, 0x7}, &(0x7f0000000240)=0x8) bind$alg(r1, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes192\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f0000000080)={0x8, &(0x7f0000000040)=[0x401, 0x1, 0xfebb, 0x5b2, 0x1, 0x2, 0x0, 0x200]}) [ 3191.166058] binder: 13981:13983 got reply transaction with bad transaction stack, transaction 631 has target 13981:0 [ 3191.202734] binder_transaction: 11 callbacks suppressed [ 3191.202746] binder: 13981:13983 transaction failed 29201/-71, size 0-0 line 2816 [ 3191.237242] binder: BINDER_SET_CONTEXT_MGR already set [ 3191.242601] binder: 13981:13991 ioctl 40046207 0 returned -16 [ 3191.271215] binder_alloc: 13981: binder_alloc_buf, no vma 18:45:14 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) 18:45:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0xff5c) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000040)={0x2, 0x1}, 0x2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:14 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x4, 0x3c) ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f00000000c0)={0x0, 0x0, 0x2b2f, [], &(0x7f0000000080)=0x6}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) [ 3191.296441] binder: 13981:13991 transaction failed 29189/-3, size 0-0 line 3035 [ 3191.335143] binder: 13981:13983 got reply transaction with no transaction stack 18:45:14 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x1, 0x1) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000002c0)={r3, 0x7}, &(0x7f0000000300)=0x8) sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800040}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r2, 0x20, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000) [ 3191.390030] binder: release 13981:13983 transaction 631 out, still active [ 3191.402041] binder: 13981:13983 transaction failed 29201/-71, size 0-0 line 2801 [ 3191.410915] binder: undelivered TRANSACTION_COMPLETE [ 3191.425082] IPVS: ftp: loaded support on port[0] = 21 [ 3191.430343] binder_release_work: 14 callbacks suppressed 18:45:14 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x33b) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3191.430348] binder: undelivered TRANSACTION_ERROR: 29201 [ 3191.448141] binder: undelivered TRANSACTION_ERROR: 29201 [ 3191.453646] IPVS: ftp: loaded support on port[0] = 21 [ 3191.471140] binder: undelivered TRANSACTION_ERROR: 29189 [ 3191.504699] binder: send failed reply for transaction 631, target dead [ 3191.576453] device bridge_slave_1 left promiscuous mode [ 3191.581917] bridge0: port 2(bridge_slave_1) entered disabled state [ 3191.626226] device bridge_slave_0 left promiscuous mode [ 3191.631717] bridge0: port 1(bridge_slave_0) entered disabled state [ 3191.768265] device hsr_slave_1 left promiscuous mode [ 3191.820081] device hsr_slave_0 left promiscuous mode [ 3191.879592] team0 (unregistering): Port device team_slave_1 removed [ 3191.890585] team0 (unregistering): Port device team_slave_0 removed [ 3191.902597] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3191.961125] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3192.052207] bond0 (unregistering): Released all slaves [ 3192.191197] chnl_net:caif_netlink_parms(): no params data found [ 3192.239066] bridge0: port 1(bridge_slave_0) entered blocking state [ 3192.246026] bridge0: port 1(bridge_slave_0) entered disabled state [ 3192.252923] device bridge_slave_0 entered promiscuous mode [ 3192.261729] bridge0: port 2(bridge_slave_1) entered blocking state [ 3192.268614] bridge0: port 2(bridge_slave_1) entered disabled state [ 3192.275964] device bridge_slave_1 entered promiscuous mode [ 3192.316856] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3192.332017] chnl_net:caif_netlink_parms(): no params data found [ 3192.340703] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3192.368420] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3192.375909] team0: Port device team_slave_0 added [ 3192.381399] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3192.388686] team0: Port device team_slave_1 added [ 3192.408438] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3192.420171] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3192.443061] bridge0: port 1(bridge_slave_0) entered blocking state [ 3192.450628] bridge0: port 1(bridge_slave_0) entered disabled state [ 3192.458060] device bridge_slave_0 entered promiscuous mode [ 3192.471818] bridge0: port 2(bridge_slave_1) entered blocking state [ 3192.478316] bridge0: port 2(bridge_slave_1) entered disabled state [ 3192.485639] device bridge_slave_1 entered promiscuous mode [ 3192.527536] device hsr_slave_0 entered promiscuous mode [ 3192.594955] device hsr_slave_1 entered promiscuous mode [ 3192.649579] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3192.662101] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3192.673254] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3192.681782] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3192.743842] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3192.751903] team0: Port device team_slave_0 added [ 3192.758979] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3192.766591] team0: Port device team_slave_1 added [ 3192.771968] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3192.779667] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3192.867421] device hsr_slave_0 entered promiscuous mode [ 3192.924931] device hsr_slave_1 entered promiscuous mode [ 3192.965160] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3192.972094] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3192.987127] bridge0: port 2(bridge_slave_1) entered blocking state [ 3192.993480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3193.000156] bridge0: port 1(bridge_slave_0) entered blocking state [ 3193.006547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3193.040747] bridge0: port 2(bridge_slave_1) entered blocking state [ 3193.047132] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3193.053757] bridge0: port 1(bridge_slave_0) entered blocking state [ 3193.060156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3193.167183] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 3193.173252] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3193.193869] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3193.203966] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3193.212330] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3193.223972] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3193.238911] bridge0: port 1(bridge_slave_0) entered disabled state [ 3193.250807] bridge0: port 2(bridge_slave_1) entered disabled state [ 3193.270253] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 3193.283143] bridge0: port 1(bridge_slave_0) entered disabled state [ 3193.293568] bridge0: port 2(bridge_slave_1) entered disabled state [ 3193.315339] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3193.321409] 8021q: adding VLAN 0 to HW filter on device team0 [ 3193.339307] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3193.349551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3193.365067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3193.374102] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3193.384520] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3193.391281] 8021q: adding VLAN 0 to HW filter on device team0 [ 3193.397671] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3193.408882] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3193.421923] bridge0: port 1(bridge_slave_0) entered blocking state [ 3193.428329] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3193.445291] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3193.463805] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3193.473849] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3193.488374] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3193.498357] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3193.507754] bridge0: port 2(bridge_slave_1) entered blocking state [ 3193.514102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3193.521056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3193.533526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3193.544190] bridge0: port 1(bridge_slave_0) entered blocking state [ 3193.550597] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3193.565132] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3193.575675] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3193.583560] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3193.599022] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3193.607064] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3193.615047] bridge0: port 2(bridge_slave_1) entered blocking state [ 3193.621394] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3193.628641] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3193.639462] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3193.656071] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3193.673791] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3193.680890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3193.696199] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3193.703863] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3193.715269] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3193.723009] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3193.732641] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3193.741908] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3193.749557] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3193.757963] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3193.765832] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3193.773433] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3193.781544] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3193.796069] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3193.806416] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3193.813901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3193.822260] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3193.830080] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3193.837888] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3193.846689] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3193.855684] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3193.865520] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3193.876051] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3193.882072] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3193.889716] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3193.904653] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3193.912169] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3193.928054] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3193.941899] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3193.953854] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3193.960808] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3193.969050] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3193.978533] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3193.984537] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3194.000397] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3194.010880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3194.028853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3194.088269] libceph: resolve '.u [ 3194.088269] ' (ret=-3): failed [ 3194.133696] libceph: parse_ips bad ip '.u [ 3194.133696] :d]:.,[' 18:45:16 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x5, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:16 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x15, 0x4000) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000200)=0x6, 0x4) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x7b8, 0x62000) ioctl$VHOST_SET_LOG_BASE(r2, 0x4008af04, &(0x7f0000000080)=&(0x7f0000000040)) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) accept4$alg(r0, 0x0, 0x0, 0x800) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 18:45:16 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x400020000000010, 0x2, 0x0) write(r0, &(0x7f00000001c0)="1f00000056000d6dfcffff05bc0203030701ff210409000500000300000039", 0x1f) syz_open_dev$amidi(0x0, 0x800, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x9, &(0x7f0000000100)=0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2, 0x200) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000080)=0x8094, 0x4) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) 18:45:16 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="0300c7aa", 0x4) 18:45:16 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000740000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3194.221643] libceph: resolve '.u [ 3194.221643] ' (ret=-3): failed [ 3194.229787] libceph: parse_ips bad ip '.u [ 3194.229787] :d]:.,[' [ 3194.302765] binder: 14049:14054 got reply transaction with bad transaction stack, transaction 636 has target 14049:0 18:45:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000040)={0x6, 0x800, 0xc6, 0x4}) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000080)='gre0\x00') r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x42281, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000200)={0x0, {0x2, 0x4e21, @local}, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e23, @remote}, 0x101, 0x0, 0x0, 0x0, 0x1f, &(0x7f00000001c0)='gre0\x00', 0x3, 0x80000000, 0x2}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/exec\x00', 0x2, 0x0) 18:45:17 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) mremap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x9, 0x20000) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETOWNER(r1, 0x400454cc, r2) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3194.417490] libceph: resolve '.u [ 3194.417490] ' (ret=-3): failed [ 3194.423999] libceph: parse_ips bad ip '.u [ 3194.423999] :d]:.,[' [ 3194.433841] binder: 14049:14054 transaction failed 29201/-71, size 0-0 line 2816 18:45:17 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000940000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r1, 0xc0105303, &(0x7f0000000040)={0x8000000000000000, 0x8, 0xfffffffffffffffb}) [ 3194.508093] binder: BINDER_SET_CONTEXT_MGR already set [ 3194.513398] binder: 14049:14072 ioctl 40046207 0 returned -16 [ 3194.589463] libceph: resolve '.u [ 3194.589463] ' (ret=-3): failed [ 3194.599140] binder: release 14049:14054 transaction 636 out, still active 18:45:17 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) socket$inet_udplite(0x2, 0x2, 0x88) r2 = open(&(0x7f0000000100)='./file0\x00', 0x36eed2f162064f2e, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f00000001c0)=""/227) ioctl(r1, 0x2, &(0x7f0000000480)="0adc1fea3b123f3188a070488b5513a1ce83e2ba7773a1c817499517a11368188d10970e81bf19f7b4f55ad15f16cc54a9a3505cf04ffcedf5ba9db847410e4036e51cf690") sendmmsg(r1, &(0x7f0000000140)=[{{&(0x7f0000000080)=@nfc={0x27, 0x1, 0x40000000}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) r3 = syz_open_dev$swradio(&(0x7f00000002c0)='/dev/swradio#\x00', 0x1, 0x2) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha384\x00'}, 0x58) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="0300c7aa", 0xfffffffffffffd98) r4 = gettid() getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000300)={{{@in=@initdev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f0000000400)=0xe8) r6 = getegid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000440)={r4, r5, r6}, 0xc) 18:45:17 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5d00000, 0x200000) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f0000000040)={{0x3, 0x1, 0x1, 0x3, 0x8a1}, 0x8, 0x1}) [ 3194.629982] binder: undelivered TRANSACTION_COMPLETE [ 3194.634446] libceph: parse_ips bad ip '.u [ 3194.634446] :d]:.,[' [ 3194.663746] binder: undelivered TRANSACTION_ERROR: 29201 [ 3194.748310] binder: send failed reply for transaction 636, target dead [ 3194.764739] protocol 88fb is buggy, dev hsr_slave_0 [ 3194.769840] protocol 88fb is buggy, dev hsr_slave_1 [ 3194.774974] protocol 88fb is buggy, dev hsr_slave_0 [ 3194.780032] protocol 88fb is buggy, dev hsr_slave_1 18:45:17 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000240)="f0e72076614ccf939e85c1f813762b6e612d0cf22b6166b8e11b288d5273e559cbabac97dfa82abed3288e4de0d1f43170f5b92aeb7abdd8f9e32c6c48d8a3fd8b750529d2f7d39092848585354434369ebab540b2a0629c0eee94172c9d201982d947f160b6df47475b1afd37e92fb11439dce7b620a5ab297d4646f6cec630b8905391f8912e7f66f9a2a83b9628906773fe096b7bec46d58aa2709389285716c63c5e352247ff346baaec3a2a8e4ed0face8804c9791bb5e67a0ec786531f89fbd77a2091b54b55228036499d8ab441ffbd063396c3ee56948f59c7b4ee8af8331476867af5c88701697733fd7d3f3433ef0b60726e301b7000000000", 0xffffffffffffff49) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x10000, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, r2, 0x808, 0x70bd25, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008010}, 0x4) 18:45:17 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050050a00000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:17 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x40000, 0x0) socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:17 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = socket$netlink(0x10, 0x3, 0x7) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000000)={0x2, 0x21, "712c90ba8c3583d3ee57c73a92fbb1f8554a8a67ee7b5d70f8d703899b0e381496"}) [ 3194.946671] binder: 14107:14111 got reply transaction with bad transaction stack, transaction 639 has target 14107:0 [ 3194.966871] device bridge_slave_1 left promiscuous mode [ 3194.972364] bridge0: port 2(bridge_slave_1) entered disabled state 18:45:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="0400c7aa", 0x4) [ 3194.997895] libceph: resolve '.u [ 3194.997895] ' (ret=-3): failed [ 3195.014728] binder: 14107:14111 transaction failed 29201/-71, size 0-0 line 2816 18:45:17 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@remote, 0xbf4, 0x0, 0x0, 0x9, 0x62, 0xb524}, &(0x7f0000000080)=0x20) [ 3195.046719] device bridge_slave_0 left promiscuous mode [ 3195.052186] bridge0: port 1(bridge_slave_0) entered disabled state [ 3195.109481] binder: BINDER_SET_CONTEXT_MGR already set [ 3195.119345] binder: 14107:14125 ioctl 40046207 0 returned -16 [ 3195.132404] libceph: parse_ips bad ip '.u [ 3195.132404] :d]:.,[' [ 3195.140086] binder_alloc: 14107: binder_alloc_buf, no vma [ 3195.140120] binder: 14107:14125 transaction failed 29189/-3, size 0-0 line 3035 18:45:17 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000000)={{0x2, 0x4e24, @local}, {0x6, @random="5eef11dafe0a"}, 0x4, {0x2, 0x4e20, @broadcast}, 'erspan0\x00'}) [ 3195.140297] binder: release 14107:14111 transaction 639 out, still active [ 3195.161232] binder: 14107:14111 got reply transaction with no transaction stack [ 3195.189188] binder: 14107:14111 transaction failed 29201/-71, size 0-0 line 2801 18:45:17 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x80000000, 0x200) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000005c0)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@broadcast}}, &(0x7f00000006c0)=0xe8) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000700)={@mcast2, @initdev={0xfe, 0x88, [], 0x1, 0x0}, @loopback, 0x6, 0x3, 0x13, 0x400, 0x9, 0x1000000, r2}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3195.216977] binder: undelivered TRANSACTION_COMPLETE [ 3195.222102] binder: undelivered TRANSACTION_ERROR: 29201 [ 3195.224296] libceph: resolve '.u [ 3195.224296] ' (ret=-3): failed 18:45:17 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050070a00000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:17 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3195.274870] binder: undelivered TRANSACTION_ERROR: 29201 [ 3195.281377] libceph: parse_ips bad ip '.u [ 3195.281377] :d]:.,[' [ 3195.294649] binder: undelivered TRANSACTION_ERROR: 29189 [ 3195.309902] binder: send failed reply for transaction 639, target dead 18:45:18 executing program 2: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101000, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:18 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x40400, 0x0) write$P9_RLCREATE(r1, &(0x7f0000000040)={0x18, 0xf, 0x2, {{0x80, 0x2, 0x3}, 0xfff}}, 0x18) [ 3195.438037] libceph: resolve '.u [ 3195.438037] ' (ret=-3): failed [ 3195.445637] binder: 14151:14152 transaction failed 29189/-22, size 0-0 line 2896 18:45:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x4, 0x6400) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000100)=""/253) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r2 = syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x2000000000000, 0x802) ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000280)={0x0, 0xafe, 0xffffffffffff9920, &(0x7f0000000240)}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3195.483310] binder: 14151:14169 transaction failed 29189/-22, size 0-0 line 2896 [ 3195.541277] libceph: parse_ips bad ip '.u [ 3195.541277] :d]:.,[' [ 3195.548081] binder: 14151:14152 got reply transaction with no transaction stack [ 3195.573758] binder: undelivered TRANSACTION_ERROR: 29189 18:45:18 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000040)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3195.585429] binder: 14151:14152 transaction failed 29201/-71, size 0-0 line 2801 [ 3195.610119] binder: undelivered TRANSACTION_ERROR: 29201 [ 3195.616057] binder: undelivered TRANSACTION_ERROR: 29189 [ 3195.639254] libceph: resolve '.u [ 3195.639254] ' (ret=-3): failed 18:45:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3195.725969] device hsr_slave_1 left promiscuous mode 18:45:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x8100, 0x0) write$FUSE_STATFS(r2, &(0x7f0000000080)={0x60, 0x0, 0x2, {{0x81, 0xf433, 0x0, 0xfff, 0x6, 0x1f, 0x1, 0x7}}}, 0x60) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) [ 3195.754106] libceph: parse_ips bad ip '.u [ 3195.754106] :d]:.,[' [ 3195.800710] device hsr_slave_0 left promiscuous mode 18:45:18 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000001c0)=@filter={'filter\x00', 0xe, 0x4, 0x420, 0x1c8, 0x1c8, 0x0, 0xe8, 0xe8, 0x388, 0x388, 0x388, 0x388, 0x388, 0x4, &(0x7f0000000040), {[{{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, 0xff000000, 0xffffffff, 'nr0\x00', 'veth0_to_hsr\x00', {}, {}, 0xff, 0x2, 0x11}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@ttl={0x28, 'ttl\x00', 0x0, {0x3, 0x100000000}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0xb8, 0xe0, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}, {{@ip={@rand_addr=0x6, @dev={0xac, 0x14, 0x14, 0x1c}, 0xff000000, 0xffffffff, '\x00', 'veth0_to_team\x00', {}, {0xff}, 0x6, 0x1, 0x43}, 0x0, 0x98, 0x1c0}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x80, 'system_u:object_r:systemd_notify_exec_t:s0\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x480) unlink(&(0x7f0000000000)='./file0\x00') bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:18 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'salsa20-generic\x00'}, 0xffffffffffffff41) r1 = shmget(0x3, 0x3000, 0x2, &(0x7f0000ffa000/0x3000)=nil) shmctl$SHM_STAT(r1, 0xd, &(0x7f0000000100)=""/83) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3195.825089] binder: 14191:14193 got reply transaction with bad transaction stack, transaction 647 has target 14191:0 18:45:18 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005017fe00000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3195.932524] binder: BINDER_SET_CONTEXT_MGR already set [ 3195.962072] team0 (unregistering): Port device team_slave_1 removed [ 3195.968933] binder: 14191:14203 ioctl 40046207 0 returned -16 [ 3196.000178] binder_alloc: 14191: binder_alloc_buf, no vma [ 3196.001429] team0 (unregistering): Port device team_slave_0 removed [ 3196.045192] binder: send failed reply for transaction 647 to 14191:14193 [ 3196.052125] binder: undelivered TRANSACTION_COMPLETE [ 3196.083318] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3196.208998] bond0 (unregistering): Releasing backup interface bond_slave_0 18:45:19 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x8000, 0x0) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f0000000100)={0xd0}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000040)=[@window={0x3, 0x4, 0x2}, @sack_perm, @window={0x3, 0x200, 0x9}, @window={0x3, 0x2efcdc4b, 0x10000}, @timestamp, @timestamp], 0x6) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:19 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000040)="0300c7ae68dc75f2075c9a9f9171079462341cb3512d99978a94a1a38fedbeb63a82bab2ce1fe2bd9bd716178fd808b4062117dbca", 0xc) creat(&(0x7f0000000000)='./file0\x00', 0x0) 18:45:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3196.353895] binder: 14222:14223 got reply transaction with bad transaction stack, transaction 651 has target 14222:0 18:45:19 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005fffff00000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:19 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha512\x00'}, 0x58) [ 3196.409637] libceph: resolve '.u [ 3196.409637] ' (ret=-3): failed [ 3196.414005] binder_transaction: 2 callbacks suppressed [ 3196.414025] binder: 14222:14223 transaction failed 29201/-71, size 0-0 line 2816 [ 3196.440901] libceph: parse_ips bad ip '.u [ 3196.440901] :d]:.,[' [ 3196.445697] binder: BINDER_SET_CONTEXT_MGR already set 18:45:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) getpeername(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000000080)=0x80) setsockopt$inet6_buf(r1, 0x29, 0x1000000000002a, &(0x7f00000001c0)="10df93ed5906805c5b307a7e470017dcb409da589dfee2699cd28398e2879099b1ad43134e9eee3238af6d94cf28b2e0e2cc1180352dd2b7e4e60404830f7da16f085219d814f3b0ab106b9355e4d2253ad4ee4aef7fdcab705ab0e7e445b84a8a0eed33e07a5fd60ea4b91c79b54946a7cd6b3d81bbeeab", 0x78) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:19 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000100000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3196.464965] binder: 14222:14239 ioctl 40046207 0 returned -16 [ 3196.483239] binder_alloc: 14222: binder_alloc_buf, no vma [ 3196.527370] binder: 14222:14239 transaction failed 29189/-3, size 0-0 line 3035 18:45:19 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)=[&(0x7f0000000040)='aead\x00', &(0x7f0000000080)=':+^GPL\x00'], &(0x7f0000000300)=[&(0x7f00000001c0)='authenc(rmd256,cbc(blowfish))\x00', &(0x7f0000000200)='authenc(rmd256,cbc(blowfish))\x00', &(0x7f0000000240)='\x00', &(0x7f0000000280)='{bdevproc\'#\x00', &(0x7f00000002c0)='\x00']) 18:45:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = gettid() r2 = getpid() setpgid(r1, r2) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) recvfrom$unix(r0, &(0x7f0000000000)=""/52, 0x34, 0x20, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e24}, 0x6e) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:19 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x48, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3196.571262] binder: 14222:14223 got reply transaction with no transaction stack [ 3196.571278] binder: 14222:14223 transaction failed 29201/-71, size 0-0 line 2801 18:45:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) connect(r0, &(0x7f0000000000)=@pppoe={0x18, 0x0, {0x0, @link_local, 'sit0\x00'}}, 0x80) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x82, 0x0) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, &(0x7f00000001c0)="42ee26076df406268668251447a77c4958e65de61766c692c132c893c2c18bd55c6441047b12838bd70fb4ee5ecfcbcbf5e0d33176e6dff1ef16a5c7227945f0d042038104ef827311d12613c17bdfaab7916d452334c98be3c93836c9256bb776fccb386f3bb739606633de3e0f66ef2957dce6b07fbc64fbe37374e32f3e958d95ec10d0f4a6108a84b9170651") r2 = semget$private(0x0, 0x6, 0x3) semctl$IPC_INFO(r2, 0x3, 0x3, &(0x7f0000000100)) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000280)={0x0, 0x0, 0x2, 0x0, [], [{0xd2, 0x8, 0x63f4, 0x2cd, 0x401, 0x3}, {0x9, 0x0, 0x5, 0xff, 0xfffffffffffffff7, 0x4}], [[], []]}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3196.634096] bond0 (unregistering): Released all slaves 18:45:19 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500e07f0100000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:19 executing program 3: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3196.768023] binder: release 14222:14223 transaction 651 out, still active [ 3196.783760] binder: undelivered TRANSACTION_COMPLETE [ 3196.808405] libceph: resolve '.u [ 3196.808405] ' (ret=-3): failed [ 3196.830780] binder_release_work: 3 callbacks suppressed [ 3196.830785] binder: undelivered TRANSACTION_ERROR: 29201 18:45:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="887ae074", 0x2) 18:45:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = socket(0xd, 0x80000, 0x7fffffff) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x7, 0x3d, 0x101}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r2, 0x100000000}, &(0x7f0000000140)=0x8) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x80000b, &(0x7f00000000c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) [ 3196.879304] libceph: parse_ips bad ip '.u [ 3196.879304] :d]:.,[' [ 3196.886605] binder: undelivered TRANSACTION_ERROR: 29201 [ 3196.912532] binder: undelivered TRANSACTION_ERROR: 29189 [ 3196.942376] binder: BINDER_SET_CONTEXT_MGR already set [ 3197.023122] binder: send failed reply for transaction 651, target dead [ 3197.023989] binder: 14293:14302 transaction failed 29189/-22, size 0-0 line 2896 [ 3197.035446] binder: 14293:14294 ioctl 40046207 0 returned -16 18:45:19 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000820100000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:19 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = socket(0x400000000010, 0x3, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) accept$alg(r2, 0x0, 0x0) ioctl$RTC_PIE_ON(r4, 0x7005) write(r2, &(0x7f0000000000)="2400000018002551075c0165ff0ffc02020a000000100f0507e1000c0800080000000000bc0000008f3943793a5ea67658cb22d90000000000000059b97dc8f8b550e66a2bff77c4931da84157f7a733686a22fd8169f6b6b4f464e0c05df670d851f785ea2b85d32b3583d87124da3bb0b9e2cc000000dcce1fb4ac2cbd48c8378a3ad82a5b83c01295723da595c4831f65123819e204853d48a5a6bd525801d5cae983cf4544a9c4c396f36e85787a8efc32e0015c85ead2b748bc6a5fefc4e53543f9f65e3da31a110af1acb78ce510c7a70723741b34981d1b182deb7904", 0xe0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={r0}) setsockopt$inet_tcp_int(r5, 0x6, 0x2, &(0x7f0000000040)=0xf25, 0x4) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, &(0x7f00000001c0)={0x3, 0x9}) [ 3197.222272] binder: undelivered TRANSACTION_ERROR: 29189 [ 3197.232068] binder: release 14293:14302 transaction 657 out, still active 18:45:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x80000, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f0000000140)={r2, 0x20}) accept4$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000380)=0x14, 0x0) connect$packet(r1, &(0x7f00000003c0)={0x11, 0x0, r3, 0x1, 0xe0d, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r4, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x460080, 0x0) [ 3197.297437] binder: undelivered TRANSACTION_COMPLETE 18:45:20 executing program 3: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3197.365624] binder: send failed reply for transaction 657, target dead [ 3197.455531] libceph: resolve '.u [ 3197.455531] ' (ret=-3): failed [ 3197.462137] libceph: parse_ips bad ip '.u [ 3197.462137] :d]:.,[' [ 3197.462404] binder: 14332:14333 got reply transaction with bad transaction stack, transaction 659 has target 14332:0 [ 3197.485135] binder: 14332:14333 transaction failed 29201/-71, size 0-0 line 2816 [ 3197.625549] binder: BINDER_SET_CONTEXT_MGR already set [ 3197.667902] binder: 14332:14336 ioctl 40046207 0 returned -16 [ 3197.684271] binder_alloc: 14332: binder_alloc_buf, no vma 18:45:20 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4c, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:20 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/4096, 0x1000) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0xa, &(0x7f0000000040)=0x0) socket$bt_rfcomm(0x1f, 0x1, 0x3) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000200000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3197.734797] binder: 14332:14333 got reply transaction with no transaction stack [ 3197.742268] binder: 14332:14333 transaction failed 29201/-71, size 0-0 line 2801 [ 3197.749513] binder: 14332:14339 transaction failed 29189/-3, size 0-0 line 3035 18:45:20 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) msgget(0x1, 0x40000002) [ 3197.871328] binder: release 14332:14333 transaction 659 out, still active [ 3197.893586] binder: undelivered TRANSACTION_COMPLETE 18:45:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000edc000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3197.934486] binder: undelivered TRANSACTION_ERROR: 29201 [ 3197.972868] binder: undelivered TRANSACTION_ERROR: 29201 [ 3198.021025] binder: undelivered TRANSACTION_ERROR: 29189 18:45:20 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x60, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:20 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = dup2(r0, r0) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000000)={0xffffffffffffff3d, 0x3f}) [ 3198.075857] binder: send failed reply for transaction 659, target dead [ 3198.105425] binder: 14363:14365 got reply transaction with bad transaction stack, transaction 664 has target 14363:0 18:45:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x84800) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e23, @loopback}}, 0x0, 0x5, 0xda0e, 0xff}, &(0x7f0000000080)=0x98) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f00000000c0)={r2, 0xe05}, 0x8) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:20 executing program 3: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3198.184098] binder: 14363:14365 transaction failed 29201/-71, size 0-0 line 2816 [ 3198.272029] binder: BINDER_SET_CONTEXT_MGR already set [ 3198.295355] binder: 14363:14381 ioctl 40046207 0 returned -16 18:45:21 executing program 2: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x90040, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@multicast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@initdev}}, &(0x7f0000000040)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@loopback, @in=@loopback, 0x4e24, 0x4, 0x4e21, 0x0, 0x2, 0x80, 0xa0, 0x3f, 0x0, r1}, {0x1, 0x80000001, 0xffff, 0x9, 0xffff, 0x4, 0x0, 0x5}, {0x7, 0xfffffffffffffc01, 0xfffffffffffffffe, 0xff}, 0x2, 0x6e6bba, 0x0, 0x0, 0x1, 0x3}, {{@in6=@remote, 0x4d2, 0x3c}, 0x2, @in6=@loopback, 0x3504, 0x3, 0x3, 0x1, 0xd2, 0xbf7b, 0x7838}}, 0xe8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) fsetxattr$security_smack_transmute(r0, &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x3) [ 3198.322942] libceph: resolve '.u [ 3198.322942] ' (ret=-3): failed [ 3198.342244] binder_alloc: 14363: binder_alloc_buf, no vma [ 3198.375744] libceph: parse_ips bad ip '.u [ 3198.375744] :d]:.,[' [ 3198.383114] binder: 14363:14365 got reply transaction with no transaction stack [ 3198.445884] binder: release 14363:14365 transaction 664 out, still active [ 3198.452852] binder: undelivered TRANSACTION_COMPLETE [ 3198.458288] binder: 14363:14388 transaction failed 29189/-3, size 0-0 line 3035 [ 3198.475812] binder: undelivered TRANSACTION_ERROR: 29201 [ 3198.487072] binder: 14363:14365 transaction failed 29201/-71, size 0-0 line 2801 18:45:21 executing program 2: memfd_create(&(0x7f0000000000)='posix_acl_accessself\x00', 0x6) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x20000, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000100)=&(0x7f0000000080)) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0xffffffffffffff47) [ 3198.509508] binder: send failed reply for transaction 664, target dead [ 3198.542025] binder: undelivered TRANSACTION_ERROR: 29201 18:45:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3198.566279] binder: undelivered TRANSACTION_ERROR: 29189 18:45:21 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x2, 0x6c500) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1, 0x341900) fanotify_mark(r1, 0x0, 0x8000033, r2, &(0x7f0000000080)='./file0\x00') setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3198.681279] binder: 14402:14403 got reply transaction with bad transaction stack, transaction 669 has target 14402:0 [ 3198.751948] binder: BINDER_SET_CONTEXT_MGR already set [ 3198.788649] binder: 14402:14405 ioctl 40046207 0 returned -16 [ 3198.835595] binder_alloc: 14402: binder_alloc_buf, no vma 18:45:21 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r2 = socket(0x400000000010, 0x3, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) accept$alg(r2, 0x0, 0x0) ioctl$RTC_PIE_ON(r4, 0x7005) write(r2, &(0x7f0000000000)="2400000018002551075c0165ff0ffc02020a000000100f0507e1000c0800080000000000bc0000008f3943793a5ea67658cb22d90000000000000059b97dc8f8b550e66a2bff77c4931da84157f7a733686a22fd8169f6b6b4f464e0c05df670d851f785ea2b85d32b3583d87124da3bb0b9e2cc000000dcce1fb4ac2cbd48c8378a3ad82a5b83c01295723da595c4831f65123819e204853d48a5a6bd525801d5cae983cf4544a9c4c396f36e85787a8efc32e0015c85ead2b748bc6a5fefc4e53543f9f65e3da31a110af1acb78ce510c7a70723741b34981d1b182deb7904", 0xe0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={r0}) setsockopt$inet_tcp_int(r5, 0x6, 0x2, &(0x7f0000000040)=0xf25, 0x4) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, &(0x7f00000001c0)={0x3, 0x9}) [ 3198.881126] binder: 14402:14403 got reply transaction with no transaction stack 18:45:21 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x200) getsockopt$inet6_dccp_int(r1, 0x21, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3199.016181] binder: send failed reply for transaction 669 to 14402:14403 [ 3199.034697] binder: undelivered TRANSACTION_COMPLETE 18:45:22 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000060ff00000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:22 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'md4\x00'}, 0xfe44) prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) getsockname(r0, &(0x7f0000000280)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @loopback}}, &(0x7f0000000100)=0x80) r1 = syz_open_dev$admmidi(&(0x7f0000000300)='/dev/admmidi#\x00', 0x7ff, 0x3) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000340), &(0x7f0000000380)=0x4) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(0xffffffffffffffff, 0x80045530, &(0x7f00000001c0)=""/123) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x400000, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000000c0)={0x7, 0x1125, 0x101, 0x0, 0x4, 0x5, 0x20, 0x7e, 0x55c, 0x2, 0x4, 0x8001, 0x0, 0x3f, 0x344e, 0x20, 0x1, 0x3, 0x7}) accept$packet(r2, 0x0, &(0x7f0000000240)=0xd0) ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f0000000080)={&(0x7f0000ffd000/0x1000)=nil, 0x4, 0x2, 0x48, &(0x7f0000ffc000/0x2000)=nil, 0x3}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000003c0)={'rose0\x00', 0x200}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000400)="a57df154f46bfacd3b1eb26f53801efed5f4e85a5355d7c6cdcf8d20", 0x1c) write$FUSE_NOTIFY_DELETE(0xffffffffffffffff, &(0x7f0000000040)={0x30, 0x6, 0x0, {0x101, 0x0, 0x7, 0x0, 'lo\'bdev'}}, 0x30) ioctl$TIOCSCTTY(r2, 0x540e, 0x3) 18:45:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:22 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000008301b48d6efc6f7bd8e89c02befa26a42fe32d71bba021e0bd2f28a8f24002567950314a2c85b50c2907ff8e2f54c33a18b11f349cea6710ff933814e13e578dceca0fc150bc33615265f322b1bc6eccddb34cb1256ad06af4071e73387818b61d05887367ea667815ed4f4463f72de26ddf9f526fa78b4298d8815152183426989e67a20029eafd9dcb08369845836228687ae693eaba22c9ee5c192d21507b82952607c4ba291bbef37646f5c405d77d6619488209117f4da99a3a46197f41e63fe132c02fdab921ff3bb43f6392a8e073bb02773f1defb676fa1753e37dbbb9bf313dfa68c69e546b37a9fb60478a5d94"], 0xfffffffffffffef5) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, r3, r4) 18:45:22 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x68, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) io_setup(0x100000001, &(0x7f0000000000)=0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x80, 0x0) r5 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vfio/vfio\x00', 0x0, 0x0) r6 = syz_open_dev$midi(&(0x7f0000000440)='/dev/midi#\x00', 0x4, 0xc0002) io_submit(r2, 0x5, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x40000000000000, r0, &(0x7f0000000240)="9b54d0c9f96725cf8b14edeb94c5ff905c7676c0647edb788e8a72d3bb0d496a9d68ece7f363f7cb21878051e3d024d78708ba91f1da2cbb7c4cf53012bf44c8c95894ebb9e18bc2af56824ebcd26bd0c3d8a4fbd6e5d4857c3bf5342366bc0291ad6a29a4e882252b32ba2f815e1bc839560042f16fd6539777f69b47cee2ab36f46ecf", 0x84, 0x5f8, 0x0, 0x0, r3}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xa, 0xffffffff80000001, r1, &(0x7f0000000640)="84cc633c1e35e0c5b1b3b05943e3c28b7b3fece88d6b842090ddb215fa590d8f4d1e670c03b282d44d659c9625f7d85c80eacb19276286cfb291d31a05d2aa1eac4cd45b9ad0f7e3d92b3c7bf56b0bf12f1a3ca2a11f033cdbbac065b6f8e4f380f1408711666242cd855101b75f50ed721fe54184825f44313dfc9fe86bf3398b50febd1dc728d4510770454d3a2ce3da1108d005ef9509c7fec2188bb01fe469d220bc260515008ca651ee57875543951e9eb6fbfbde17eef5e30bbb4f25303a25cb2fa2f4003f68fbd5b78f3ee6b7f9f802f4d082a9b9613026e915fe8ad5ea95893c0698e4494c56e92b284ee37b021ea7b8b49c94ea373523b32bef30956c54c51c5fd8046e9c1ce46df6b60e9ab097044da66cf204a8f1f419c35e8beeb3a87064a5c994ff1127707b08fcf28c9f8aeed7b1aaaed0527bd4e12c7577bd297d391f43f851ff6392c7ff30999c1934cca8801ed023826a5514591e16355e3826bef12b783b863613c3349d6b6fd7cf806fd911b9c4a8e1222dfd9900c7cab5a14eeba664ed089ed12fa41c087400652f1df1479f27d487e0acd94ac447b44fb1576662b20508bc1da4a724f870e02ed9c7cbc5668ab0545c6f4b567d56e0578309327cfa8b3b8d64b6488a97c8b4baacf9863ceb5f9ea855e2c81b8709083f7a4ae6c4f45a30c21bc118c442b90722dfc59bfb4a61aea1e142a20db41093d2856d648a1f6c57c2dc30fa990075add06188e9831cdb961c0746885678dc3acd6ac786abc2352b5ba834e6899ab12366a943b8328774caf37ff628bc76a208844118ad2e14fc7c0b122b58777d9fe954ef7350600eea09a7c77373b2640720e69709c6b5fe95d5351aae573de0a1b19e250f4b5daf98cb63e829bd8eaafbbdf6368d728c948e120e7db852f5715d47b480ba754e2d339f9a72ec3576c727204d3a8ab8c13f8301ffc35ba14556b677ce8c53f88665efe0c27c825b9f09ebf0d26f61d83127a85836a65e27aba76bc8003dc58eb5db3fbc788a039eb37dd05404b969164e65bfb1a6199a2f03476ae31a474a4fd559fd212f85344cc8e32722d9439ceca0114aed54f3d0992a62f8a5b1703c685f69365a4da6e7ec4abe30afd29c902bdd845b4391f1bed5c63c2fd632cf5e9709557c965b82924ae4146f9cb8efe54a5017d0c121ddab1f769ff2a5262cfacc49c3ff33b22fc65748a8130b3d1a0cd329657c87258b356a2ac0feb7b8eae5af33a8033ec6293372b5c9cf545a0e8ab414f2aea9f3d46431ba81369a47e50e3e1c3a64e08de25fe5c86c2e87c5eda0fe6e9f2d963262711cce12e15bedf5baa888e5c1ed56141d79b77ab5ef9e8c7e7f70c1eb26f486b11fc60ee1bb7142497292f5d08a7a63a3f7277371206a4e286bf2a2e4dd8ea82e20a6287e368322abb1b67639479152f2e5f44afbba9571aead02da62ba3ed32c584438c456fca10e61522bc29f4ac43f271680434f29bba3b863eba4c3bf03ef71831272eb5bcb23cd163d22049874b9d95dd0456e507db5228b63853eb21d9a578c9d1b927c7e8be194b1c672a36380b8d38732c52b949084ebb61ac10fe2295f57bd55e46dc6038ff005fb998e6c148be206fbcc217f71907168d45fe7fb0fbd0c67ec35fe9ec7bc3c89bda229eafd20a85d89bbdc5f933d5218b76ff3b93bd76267568377393e010d58a8d45ea6d52481d533c7f3f6bc70a71dbaf608046b5b5a592c5315add8dc2f088d4f0e1d4440cac1ccd8f2feb4d5062007de0733b6996984bb26a124c4769926427e4f7adda5e8ce48cb700eda6cf03977390aecf3373babc1c946e8693412f1bb2536c02ecb62302996c55e7a3f89fb83f846a8ebeace8149448cee495994a3a81d4ec2a1a3ef536776a5c5e27133d6eec91d33a4bd20c7b45fb69bcc8b7c8984b4c3e66a623bb3c0f4d6186b2cf3df9f1b6573fdaa1bcb2ce43667fdf0ee21116868f7ce731e886c2880fef1e1144c488d8a4c41dbc812dc2d9b80167ae5eefe2fe17945f3d17c03a525e4e817d40d4bde80d50974c09a02b0e7d62cdc00524c699eba11837f7673939d830d68668adfce5f9310ffe57f8debb2d8a6ef18ab5b81203c7721242aae86629f62edcedeb28124734fffc1015c14be003cd1106b0195c167187f05980c801341233216c6bd75e0c197acb8c92a35c02bb76252b127cd4d2866aab2f09b5f56c468d9f6fd17afabe8e0f5da44eb9ad80ed00c355985fd5ceaa0125d40a2b392b55a3cfc788136c57ce348cb6d8aea99507698e76c1d7f1b0f1998081b814ad06448cf66df43c388ef3faf9aff0abd96e579be57b57fe9dfa59b132a5f1b559fda2060db93e5d06b586952869074c8f4a3cc081e3750e10144259fac0d802caa51a3a2de6b2cb14d7bd1d291ec0e8023b0c67cc99b7fee42008dddfbf35f2d44785b17931b135b4cc8196940d55ae15aa113fd6d62236d3a731ff306e04caf6a23691857ec0a427c2ff98389115fac24295c9e768b81dc6b2194f75c4bbc3873513e8feac8dbf44ffd3e7be65b1b83b95242308abe9a1b1bb6e51882eb911d2b7c9b5f7f0ca82fd2b883c104de44b00d2ea198e2844d26ccf028aab6a61ddd998de4d72c3d388d3012830997186643d7562cf3623ff7d0b1a321cb171439faf973bd67d15fa5286c0f475444cae5c8333a995ac021047a83b6bba1dfc496cf1b102503b9daadc592cb8f699573a3a844e833b40484b033930dfb58a5ed071a8dd615ffdf0d006d15a5014666606d37c777dd202b6320f097b7dd0c8652e1e5988edcb95c68b6e5613faaa8a928d7969541684938a4837c531b3b37f1adfddadf4c822749b6efadba7c4fe705e20de72f819e4f06561cebbcc223caff8db685910c4030abc16a01b1759654925efca40f9f2e3fe137327aae6081bef15aefb907c6baa9ba6a8dfaaf2cb5ca980fd643f6d26bb40adb8dc86b4adaa8ebb265a64f6f1c6f769405719a1cefeaab12badbded65ff5432dd3faf5499288a1a4997a84fb8942b920b4d792484fda954149f926b0d60f18f92df350d3bafa45df2a3b8d9b138f58d8d0af6263ac95e6cb5f6fdeec1d5a5c3fd809af32deeda93827355e9e252f2d85ba76af7656c7c630d8a06b036efd6cfd8d1b7d2e3e0962e8aa3e9b104643ff6f26a8dfd667780b901077ca124c346edb52968afd53d508c47e7670b5a244dc1e75efd4bc6dc2c86675f17eab54a15e9998f0f1e01bfbf4860fb839d2247dba320769668d94b5b70e0dd93557890acb2bafad013e529247f18c401c6ab7c15af5927e42c8c9c2934b3b495a1ac3270bded8c76ece1fbbabe4be416760eac3a0151e09f864cd63b94b5f89cfab0e92fbf77171932e134b36674b2e2c1d664abd1e2222f734c479e4bd2753ccc72b1401543bd08d7860d1c5265e7576c10f561cc12800acd494bed9898f376a2e33f614a5ff9da08b0d623c03a8f8fdc3c4499895cd091c333b7606107bfe8c8a91886e24566c19d1426ddbff2bd114296a405c1125f92ac58382d347b0de78356a076503e9aa5f9b78463ca1602b88ef15060e1ba1e4611a66e948ab6dc25fa36aa7c98d5108fcd01513b0d08002c893ab34ae5e06ad96f226825c62bdd73017f350e0da229f2144991a0899f3a5681210e572821011ecace7fcba1e88228285b4f066de72e59a7e00bb6f91261b96dc410dddfa8b9244bdb5259eb8ccedc305aff119bc00dbcb1b2fcdf06fd0f09610dcb95466f922e62a82a5aa320c5ace5b5c4881ef98d18278f2b6d3d3762e1a8770e67e8f4febfd4343f9e09c695547e2751a31a989944a867c80703e30dfa7869eaa8b191799ba8f76b975f7df87cf5cb807776b8fc352aebbdd1a9f8a00fa15cd4ba822fbe8b469acd7ae24f95182ea388339890576cde4bfc961fe833e798cc5c2e036b34b0d0b305f129b113e18a54a7246e72551163f0710216fe0cb6184d2972c8303017f5397db438870ec06369017313b7a84dcd4fc886a07a059e7775af2bf0683027689bda5aa1811beb8b4467fc1c5189b0e4081efc03995f8d725ca910edccd46a20740c921e483a4c7eb7da0a675eb7d7360b8aaabad7106c0e78369242126676960d1e7dcfe4905471f1aa8e40413fa6139bcc997377329c5861db63e136eda994c3b86010f1dd048deae7bc55757beb91dffeedd9fded0b532a5162f50b381f918ea35cbcfc8ff8bb51999a1fc8babc8cddaac20c0260ca435a67625998e86f71727a09a41f357c72629cfa0e4f38961153a71fd0d9a7013924154446289b14a62a29953f135ee6cad82d968e0d453d71b6e6d62ba940e01dcefe20714f0428552b50e209c6e6d56f20d41bb82f01dd3c1c072db6e5985157177ed295635a5496057d0d01be5188e517ec0f5a9b0e39defd0f9470a4499adcdbb559a63a97ab57529ca9b2efcf59b41cc931e5fe5c916b71bf099a2e74b38721f2cffad23817099e2140c6984a11db338634447c148ac037ad980cfa3b11858058d2af51600a7493577e81f59f5af7a768394b0f908599a07aa18282ab3ac8aeb8c7650ea9b7b6f429da7a98ca1d66423bfd3302b7f9d28e5dba59cc05e10676e6dff9b1f71d54a7285df2d1bf567007e2766be6b11ffeacdfb7310700dde380da85ef0cff0cda40e1b0e6763e25289ac72fecef6d438c7e213d883d0dd750a570df380798ee24dd4e3644241636abae4664e96d742f1402fcfaeab9c6983233eb564b66ba4877f996f97d5c0dc704ef4b1772ecd02890929b8ce54595ea453145ff6a9f4beeece4ee29558495c3ff740013cc0b5c0babd864b3a7bf95d796ed8f8172260641cae925e79098fee82c9895068793100566c224c1bacc26b1978a6f76ac84937d169a825f2918e5b655ed7c752439025402839f6b17e17301a790b846061f69b109a63298f9bcdf19e2a2b910262ce5dfb3419ed4b18af4d8959ce47e1fa9895df6e10c1d9eea2077e2b105372129680ab92140abc5256e17b84b6bc3bd498055d3a70cf0b91e0b9eb8db4d2ffb6ae890dcc92ebbaec381814f89fdcc3b150efec22fdaee3a0835c928ea4f90a7e2b415bbdfaf5a48b4ee59911310900dc1dce5919e1c911a102648facf3df9a5740ccbac2f0967c3245d36eb1a3391300df18652ca37caa0442c60b262c7d3fcafcccda5c3bb19c2a664b392eda47152c033a126fcba7e7a9e94f5087af937b07403326dd216ecdd38fa45ff9b6b2a79d1e7b60ad3df36800c550bd97389ba01babe727a163ef30362b3b2920b3722bfcbd469a6af2d424ad73b372e60d2ae3452b0d522b8bfccc77e60564be572a3f26e33ef7de492656cfbacd01c1bd138ea24245985a4890917d9fba6083b93b4888133dcae009fd291647055bf1084b6c35ddf29f65e588f735448d44d61a2a23ea5129f84f6a3a95478e0f7d38b8720def30ed18d1fda24ba3fe93c401fca39429f0008cce43d923bf80b5e6173997c86ced1db8271454d981aee19d9c5552cf69480d70c8ddfffddf14985c1b24a1080ad517df48407bff7be2b8d1633420fdb958df19af40a0f3de8dd1051d9528deec6ff47b413f795284126c738f3c134ae6acc7b2bf4cb9438daffff354ab2de174a0a88589660c47c25f69a4d2f72e4595da99b57683f94879936a336922f033e0bc770321b52c501d0bed224bdf254d44aa48bce58a04065b6568cfed0ebfa371263aab192b65d2193bd345a8b927dbd8da14ae407f3a221fd80519374b0c7fd9ad536503d7ba7b414762", 0x1000, 0x2, 0x0, 0x0, r4}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0xd, 0x9, r0, &(0x7f0000000300)="996ca684105c2893d790edab7dbed4556fb62aa99b92a1d8002b79a0fb3a9cd3746b61714b5829f620e5ba3b996f516e55087df256da03b498eb36f82891fbf7e75358fac13addf6231b82d77546755c3e9e28fbb49d13a5e42b42c427e237279604fbbbc90e5c0a511a55e9a119676ed66b8bb26689a356c9eb89611db0968d", 0x80, 0x8, 0x0, 0x0, r5}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, r0, &(0x7f0000000400)="1c361bcee7cfc89dd5396d5b74d1df5a2d8d77d025de5458d79500c46185a0b55dc2ed87e7e80d9366976af96b7d435a4287c001b61230", 0x37, 0x3f, 0x0, 0x2, r6}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x2, 0x54e, r0, &(0x7f00000004c0)="a73894850e1297d9265f0e3bafeb1c6aa5b9245430a70b00780f9df7c967747c9c9e0216737ffcec42e840", 0x2b, 0x40, 0x0, 0x3}]) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r7, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) [ 3199.767243] binder: 14427:14428 got reply transaction with bad transaction stack, transaction 674 has target 14427:0 18:45:22 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = shmget(0x1, 0x3000, 0x24, &(0x7f0000ffd000/0x3000)=nil) shmget(0x0, 0x2000, 0x54000801, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_STAT(r1, 0x2, &(0x7f00000001c0)=""/204) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x21) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000040)) [ 3199.825055] binder: BINDER_SET_CONTEXT_MGR already set 18:45:22 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000008301b48d6efc6f7bd8e89c02befa26a42fe32d71bba021e0bd2f28a8f24002567950314a2c85b50c2907ff8e2f54c33a18b11f349cea6710ff933814e13e578dceca0fc150bc33615265f322b1bc6eccddb34cb1256ad06af4071e73387818b61d05887367ea667815ed4f4463f72de26ddf9f526fa78b4298d8815152183426989e67a20029eafd9dcb08369845836228687ae693eaba22c9ee5c192d21507b82952607c4ba291bbef37646f5c405d77d6619488209117f4da99a3a46197f41e63fe132c02fdab921ff3bb43f6392a8e073bb02773f1defb676fa1753e37dbbb9bf313dfa68c69e546b37a9fb60478a5d94"], 0xfffffffffffffef5) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, r3, r4) [ 3199.847182] binder: 14427:14438 ioctl 40046207 0 returned -16 [ 3199.888166] binder_alloc: 14427: binder_alloc_buf, no vma [ 3199.908519] binder: 14427:14428 got reply transaction with no transaction stack 18:45:22 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000008301b48d6efc6f7bd8e89c02befa26a42fe32d71bba021e0bd2f28a8f24002567950314a2c85b50c2907ff8e2f54c33a18b11f349cea6710ff933814e13e578dceca0fc150bc33615265f322b1bc6eccddb34cb1256ad06af4071e73387818b61d05887367ea667815ed4f4463f72de26ddf9f526fa78b4298d8815152183426989e67a20029eafd9dcb08369845836228687ae693eaba22c9ee5c192d21507b82952607c4ba291bbef37646f5c405d77d6619488209117f4da99a3a46197f41e63fe132c02fdab921ff3bb43f6392a8e073bb02773f1defb676fa1753e37dbbb9bf313dfa68c69e546b37a9fb60478a5d94"], 0xfffffffffffffef5) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, r3, r4) [ 3199.945389] binder: release 14427:14428 transaction 674 out, still active [ 3199.952333] binder: undelivered TRANSACTION_COMPLETE 18:45:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) ioctl$VIDIOC_G_ENC_INDEX(r1, 0x8818564c, &(0x7f0000000640)) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x0, &(0x7f0000000240)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:22 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0xd0042, 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f00000001c0)={'broute\x00'}, &(0x7f0000000080)=0x78) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x181, 0x0) ioctl$TIOCSCTTY(r2, 0x540e, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3200.005131] binder: send failed reply for transaction 674, target dead [ 3200.098843] binder: 14459:14460 got reply transaction with bad transaction stack, transaction 679 has target 14459:0 [ 3200.195736] binder: BINDER_SET_CONTEXT_MGR already set [ 3200.214649] binder: 14459:14466 ioctl 40046207 0 returned -16 [ 3200.240660] binder_alloc: 14459: binder_alloc_buf, no vma [ 3200.276294] binder: 14459:14460 got reply transaction with no transaction stack [ 3200.303749] binder: release 14459:14460 transaction 679 out, still active [ 3200.315029] binder: undelivered TRANSACTION_COMPLETE [ 3200.320232] binder: send failed reply for transaction 679, target dead [ 3200.381034] IPVS: ftp: loaded support on port[0] = 21 [ 3200.553967] chnl_net:caif_netlink_parms(): no params data found [ 3200.605572] bridge0: port 1(bridge_slave_0) entered blocking state [ 3200.611993] bridge0: port 1(bridge_slave_0) entered disabled state [ 3200.626319] device bridge_slave_0 entered promiscuous mode [ 3200.633682] bridge0: port 2(bridge_slave_1) entered blocking state [ 3200.647116] bridge0: port 2(bridge_slave_1) entered disabled state [ 3200.654149] device bridge_slave_1 entered promiscuous mode [ 3200.672572] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3200.682039] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3200.703262] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3200.710833] team0: Port device team_slave_0 added [ 3200.716405] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3200.723929] team0: Port device team_slave_1 added [ 3200.729381] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3200.736789] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3200.797643] device hsr_slave_0 entered promiscuous mode [ 3200.835182] device hsr_slave_1 entered promiscuous mode [ 3200.882393] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3200.889458] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3200.906715] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3200.952439] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 3200.965840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3200.974163] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3200.983758] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3200.991173] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 3201.000828] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3201.008289] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3201.019191] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3201.025373] 8021q: adding VLAN 0 to HW filter on device team0 [ 3201.033106] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3201.040208] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3201.047959] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3201.055712] bridge0: port 1(bridge_slave_0) entered blocking state [ 3201.062042] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3201.069232] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3201.077638] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3201.085414] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3201.093138] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3201.101015] bridge0: port 2(bridge_slave_1) entered blocking state [ 3201.107408] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3201.131047] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3201.138885] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3201.148652] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3201.160461] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3201.170586] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3201.187317] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3201.193326] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3201.205823] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3201.215664] 8021q: adding VLAN 0 to HW filter on device batadv0 18:45:23 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500f0ffff00000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:23 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000008301b48d6efc6f7bd8e89c02befa26a42fe32d71bba021e0bd2f28a8f24002567950314a2c85b50c2907ff8e2f54c33a18b11f349cea6710ff933814e13e578dceca0fc150bc33615265f322b1bc6eccddb34cb1256ad06af4071e73387818b61d05887367ea667815ed4f4463f72de26ddf9f526fa78b4298d8815152183426989e67a20029eafd9dcb08369845836228687ae693eaba22c9ee5c192d21507b82952607c4ba291bbef37646f5c405d77d6619488209117f4da99a3a46197f41e63fe132c02fdab921ff3bb43f6392a8e073bb02773f1defb676fa1753e37dbbb9bf313dfa68c69e546b37a9fb60478a5d94"], 0xfffffffffffffef5) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) fstat(r0, &(0x7f00000001c0)) 18:45:23 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = semget(0x3, 0x0, 0x11) semtimedop(r1, &(0x7f0000000000), 0x2aaaac85, &(0x7f0000000040)) 18:45:23 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:23 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6c, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:24 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000008301b48d6efc6f7bd8e89c02befa26a42fe32d71bba021e0bd2f28a8f24002567950314a2c85b50c2907ff8e2f54c33a18b11f349cea6710ff933814e13e578dceca0fc150bc33615265f322b1bc6eccddb34cb1256ad06af4071e73387818b61d05887367ea667815ed4f4463f72de26ddf9f526fa78b4298d8815152183426989e67a20029eafd9dcb08369845836228687ae693eaba22c9ee5c192d21507b82952607c4ba291bbef37646f5c405d77d6619488209117f4da99a3a46197f41e63fe132c02fdab921ff3bb43f6392a8e073bb02773f1defb676fa1753e37dbbb9bf313dfa68c69e546b37a9fb60478a5d94"], 0xfffffffffffffef5) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) [ 3201.320567] binder: 14482:14487 got reply transaction with bad transaction stack, transaction 684 has target 14482:0 18:45:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) pread64(r0, &(0x7f0000000040)=""/82, 0x52, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="0400c7aa", 0x4) [ 3201.379612] binder: BINDER_SET_CONTEXT_MGR already set [ 3201.395529] binder: 14482:14496 ioctl 40046207 0 returned -16 [ 3201.447722] binder_alloc: 14482: binder_alloc_buf, no vma 18:45:24 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) write$UHID_INPUT2(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="0c0000008301b48d6efc6f7bd8e89c02befa26a42fe32d71bba021e0bd2f28a8f24002567950314a2c85b50c2907ff8e2f54c33a18b11f349cea6710ff933814e13e578dceca0fc150bc33615265f322b1bc6eccddb34cb1256ad06af4071e73387818b61d05887367ea667815ed4f4463f72de26ddf9f526fa78b4298d8815152183426989e67a20029eafd9dcb08369845836228687ae693eaba22c9ee5c192d21507b82952607c4ba291bbef37646f5c405d77d6619488209117f4da99a3a46197f41e63fe132c02fdab921ff3bb43f6392a8e073bb02773f1defb676fa1753e37dbbb9bf313dfa68c69e546b37a9fb60478a5d94"], 0xfffffffffffffef5) 18:45:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1000, 0x2000) getsockopt$packet_int(r2, 0x107, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=0x4) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) [ 3201.493309] binder: send failed reply for transaction 684 to 14482:14487 [ 3201.508847] binder: undelivered TRANSACTION_COMPLETE 18:45:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)='\x00\x00\x00\x00', 0x0) accept$alg(r0, 0x0, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x6, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f00000001c0)={{0xa, 0x4e24, 0xc, @dev={0xfe, 0x80, [], 0x25}, 0x2}, {0xa, 0x4e21, 0xfffffffffffffff8, @remote, 0x4}, 0x2, [0x6, 0x90e7, 0x5, 0x5, 0x3, 0x7, 0x8, 0x7fff]}, 0x5c) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xffff, 0x200) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0xfa, 0xf992, 0x80, 0x400, 0x6}, 0x14) [ 3201.586313] binder_transaction: 10 callbacks suppressed [ 3201.586329] binder: 14482:14502 transaction failed 29189/-3, size 0-0 line 3035 18:45:24 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000400000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:24 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) [ 3201.665951] device bridge_slave_1 left promiscuous mode [ 3201.671518] bridge0: port 2(bridge_slave_1) entered disabled state 18:45:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="b9714e6999c4020ca28247fe8d65166ecd76a9e2c1c11823191d2b22eab2d1315b5bd80d36e3c514750028ad8ff9569bf028453a1e130da2af8a0cc9a65fd578bed2bd895bde763cc823c5fc6386a9cb5b1ea6f68d4b1973d602b3d55ed547d94d", 0x61) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x202) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000240)={'nat\x00', 0x0, 0x0, 0x0, [], 0x4, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}, {}, {}, {}]}, 0xb8) [ 3201.755366] device bridge_slave_0 left promiscuous mode [ 3201.761051] bridge0: port 1(bridge_slave_0) entered disabled state 18:45:24 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0, 0x0}, &(0x7f0000000340)=0xc) getgroups(0x5, &(0x7f00000003c0)=[r1, r1, r1, r1, r1]) 18:45:24 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005ffffffffff600000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3201.954488] binder: 14540:14542 got reply transaction with bad transaction stack, transaction 688 has target 14540:0 18:45:24 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x74, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x101000, 0x0) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f0000000240)=""/66) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r3 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x1, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e20, 0x17d, @rand_addr="58212d09a31b06b652729979b0ce3d18", 0xf2f0}, {0xa, 0x4e23, 0xb302, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}, 0x1, [0x9, 0x8, 0x8, 0x7, 0x7ff, 0x7, 0x40, 0x9]}, 0x5c) 18:45:24 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) 18:45:24 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xd13000)=nil, 0xd13000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x29, 0x5, 0x0) setsockopt$sock_attach_bpf(r1, 0x119, 0x32, &(0x7f0000000000), 0x4) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="000000003d9dddded05f95863ba392874bbd8bbfc38527e893c0948b9d43e80fb0dd5e274cec3c00d81444f711b93799e9e5c4789a89734b09e488a82d7944de854612f11b584fd1fba83069fdc7fed60b28456b081150b36c9f91984ec40e12860ef19c25dab90de61f1e83a5882a65bf53e4a3ca2bbeeb0d589883b2a206493fe10299efddff307d44b705d22fdb845c9d33a148361797cbf9b29b55bd8f30f6c6c52b0a43122cf0fef6db1edaee91b3a8d54f5c83cc95f49cf8f2bdf50fdd15615261de4c29c75dfbaf43595b8932f7e14cbd704f63792f035a124b2e90a211aa710a7f6faf4857dceb76b1c1ddf42d9af3389b8684768419264e24009bb91c7c93530164470d80d6ccb41999726600ad28b0f96ca293b02c4f98f0429afed9a34e9ac396a468c073339315caf5ea56fe6c4d50559126f669927cc30692c1c9b208b5dc149647f5c0af2641a44a89b711559b1b3ef4ae16b4eb815e8f2d529113cbca5003b99cb7fa4ac19c41369484746c8e27f62311c60b4f47c8cd8f62f46f949a72aca785adbd9de998ffed1397a0b05ccd06541d9cbc1d950d3592a1b325d3ee092110f949fcd94485da31aa35900279bab16ef2e6", 0xe2) [ 3202.075951] binder: 14540:14542 transaction failed 29201/-71, size 0-0 line 2816 [ 3202.148062] device hsr_slave_1 left promiscuous mode 18:45:24 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) 18:45:24 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000740000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:24 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7a, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3202.173355] binder: BINDER_SET_CONTEXT_MGR already set [ 3202.215949] device hsr_slave_0 left promiscuous mode [ 3202.234751] binder: 14540:14551 ioctl 40046207 0 returned -16 [ 3202.238651] binder: release 14540:14542 transaction 688 out, still active 18:45:24 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005ffefffffff7f0000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:24 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) accept$alg(r0, 0x0, 0x0) 18:45:25 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = syz_open_dev$cec(&(0x7f0000000300)='/dev/cec#\x00', 0x3, 0x2) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000340)={0x6, 0x5, 0xef, @local, 'veth1_to_team\x00'}) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f00000002c0)) getsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000380), &(0x7f00000003c0)=0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_MMAP_OFFSETS(r2, 0x11b, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x60) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f0000000400)={0x4, 0x1, [{0x80000000, 0x0, 0x8}, {0x3, 0x0, 0x9}, {0x2, 0x0, 0x3}, {0x9, 0x0, 0x1}]}) r3 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) ioctl$KDSKBSENT(r3, 0x4b49, &(0x7f00000001c0)="7965973cc9757441931b859a18e4b11981a88caa4732b00da39da2298b9079797f98ae5e7333f944f5ebb48db5ce2cff521ce7b848c812ba0931b563dfa1de66f1cf4ca176d75f8038b81a5f97df35f668fb47bef11ed58d7b113e922ce2dbf2d40e06196fdbeb537ea706b3e1c9200ca8012c5a990b061ce5132b5d5f7fa3e721285a9371c7708049aae1e5c673806cb763b6d056eae1ad3fa6d428d82eb98f72d5d51ed656ba6ab43cad7d7a86803f8c3d33d6ffca9d5f0deaecf661ad2b756cda") [ 3202.263287] binder: undelivered TRANSACTION_COMPLETE [ 3202.274159] binder_release_work: 13 callbacks suppressed [ 3202.274164] binder: undelivered TRANSACTION_ERROR: 29201 [ 3202.294525] team0 (unregistering): Port device team_slave_1 removed 18:45:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:25 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_setup(0x458, &(0x7f0000000000)) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) [ 3202.363291] binder: BINDER_SET_CONTEXT_MGR already set [ 3202.369582] team0 (unregistering): Port device team_slave_0 removed 18:45:25 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3202.420866] binder: 14585:14586 ioctl 40046207 0 returned -16 [ 3202.420925] binder: send failed reply for transaction 688, target dead 18:45:25 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500f0ffffff7f0000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3202.463496] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3202.471874] binder: send failed reply for transaction 690 to 14540:14550 [ 3202.487688] binder: 14585:14599 transaction failed 29189/-22, size 0-0 line 2896 18:45:25 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x400, 0x410000) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000040)={0x1c, 0x7, 0x8}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x8, 0xba6e, 0x2}, &(0x7f0000000200)=0x10) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffb000/0x4000)=nil, 0x4000}, 0x2}) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000240)={r3, 0x3}, &(0x7f0000000280)=0x8) write$UHID_CREATE2(r1, &(0x7f00000002c0)={0xb, 'syz0\x00', 'syz1\x00', 'syz0\x00', 0x18, 0x0, 0x79cb08ef, 0x7, 0x1ff, 0x200, "a31427171f3f8812a0a1da8b21c65a39cb46044ed0d23ec8"}, 0x130) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3202.523912] binder: undelivered TRANSACTION_COMPLETE [ 3202.526568] binder: 14585:14586 got reply transaction with no transaction stack [ 3202.554366] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3202.554793] binder: undelivered TRANSACTION_ERROR: 29189 18:45:25 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:25 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet(0x2, 0xf, 0x4) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:25 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-control\x00', 0x80000, 0x0) fallocate(r0, 0x0, 0x1, 0xfffffffffffffff9) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x5, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) write$vhci(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="033af51e4b48d31accb28339e3572171c05f5f329de3d62eef818733350e41605c9946b899413bb5bdd1000000002a33e87fc955b2305d8e08"], 0x39) socket$alg(0x26, 0x5, 0x0) [ 3202.687369] binder: 14585:14586 transaction failed 29201/-71, size 0-0 line 2801 18:45:25 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000001820000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:25 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3202.765910] binder_alloc: binder_alloc_mmap_handler: 14585 20010000-20014000 already mapped failed -16 [ 3202.839801] binder_alloc: 14585: binder_alloc_buf, no vma [ 3202.877119] bond0 (unregistering): Released all slaves [ 3202.883108] binder: undelivered TRANSACTION_ERROR: 29201 18:45:25 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3202.883533] binder: 14585:14637 got reply transaction with no transaction stack [ 3202.891202] binder: undelivered TRANSACTION_ERROR: 29189 [ 3202.903465] binder: 14585:14599 transaction failed 29189/-3, size 0-0 line 3035 [ 3203.009275] binder: 14585:14637 transaction failed 29201/-71, size 0-0 line 2801 [ 3203.019529] binder: undelivered TRANSACTION_ERROR: 29189 [ 3203.028282] binder: undelivered TRANSACTION_ERROR: 29201 18:45:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:25 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000940000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:25 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000001c0)="eecae3349a26744d905bdd537fe474e98867bcae5bdd43d03f04542094ee8cf5d72ccc3067233b1b262c7a9bc5c961a786641ec0fa3a427c9e07b588c303e6b43821a94c90af30b698b1492802d4bb9a28dcd57a7fe2d46360b378e1a724ff3a1ece65b81ee58d0d9874f778c6325122479eb72cc06d26dab9ce9d35cb3a0b791ff0e0ac3e8ea7adc7d334a968cde8f0cc45773b988afdecbe3b704c8fc18595b037d4f5fca605e5a0d3dc33294d237b0621e33c0f285c11d1c6cb6514ddc87a90d79a5995370ce52f97caff2af8ec09f02eb4816f03c6058e585999e6408965ba95297aece1da9611e524b6481e57", 0xef) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="dae5eaadc64d8837498499d8250cd993a11efb0239389b4a260f386b43ff02558460dd92a3b95084338d735846838c51b4c67f74b8e28bdd8d761ed36a29ed20117bd938ec8318a67da7ac5ef5c832552d", 0x1) 18:45:25 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:25 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) accept4$alg(r0, 0x0, 0x0, 0x80800) openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x80, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3203.252184] binder: 14654:14656 got reply transaction with bad transaction stack, transaction 697 has target 14654:0 [ 3203.316944] binder: 14654:14656 transaction failed 29201/-71, size 0-0 line 2816 [ 3203.339739] binder: BINDER_SET_CONTEXT_MGR already set [ 3203.368037] binder: 14654:14664 ioctl 40046207 0 returned -16 [ 3203.374218] binder_alloc: 14654: binder_alloc_buf, no vma [ 3203.424044] binder: 14654:14664 transaction failed 29189/-3, size 0-0 line 3035 [ 3203.434679] binder: send failed reply for transaction 697 to 14654:14656 [ 3203.441575] binder: undelivered TRANSACTION_COMPLETE [ 3203.503422] binder: undelivered TRANSACTION_ERROR: 29201 [ 3203.532457] binder: undelivered TRANSACTION_ERROR: 29189 [ 3203.539112] binder: undelivered TRANSACTION_ERROR: 29189 18:45:26 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xfc, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:26 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:26 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000c0ed0000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:26 executing program 2: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x6, 0x400) ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0e85667, &(0x7f0000000100)={0xc0000000, 0x7, "458b3110b7c33a28d8b0ff2387c366f13976d722ef9871e6f4c372472ccdf61a", 0x4, 0x7, 0x9, 0x1000, 0x3, 0x2, 0x4, 0x3ff, [0x0, 0x0, 0x157, 0x9]}) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)) 18:45:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:26 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:27 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="0400c7aa", 0x241) [ 3204.306162] binder: 14678:14681 got reply transaction with bad transaction stack, transaction 701 has target 14678:0 18:45:27 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x4001, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000080)={r2, @dev={0xac, 0x14, 0x14, 0xc}, @remote}, 0xc) ioctl$VIDIOC_G_FMT(r1, 0xc0d05604, &(0x7f00000001c0)={0x6, @sliced={0x2, [0x8000, 0x300000000000, 0x400, 0xe, 0x18, 0x5, 0x5, 0x3f, 0x7, 0x4043e8fc, 0x5, 0x9, 0x1, 0x2, 0x7e0, 0x7, 0x1, 0x100000000, 0x84, 0xfffffffffffffffb, 0x3ff, 0x0, 0xa061, 0x9, 0x100000001, 0x5, 0x5000000000000, 0x5, 0x1, 0x5, 0xffffffff, 0x10000, 0x400, 0x8, 0x1000, 0x1, 0x1000, 0x400, 0x1, 0x4e69, 0x9, 0x81, 0x5, 0x10001, 0x2, 0x4, 0xead3, 0x2], 0x9}}) bind$alg(r1, &(0x7f00000002c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes)\x00'}, 0x24) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000100)=0x2, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3204.380779] binder: 14678:14681 transaction failed 29201/-71, size 0-0 line 2816 18:45:27 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:27 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000000), &(0x7f0000000080)=0x4) [ 3204.509840] binder: BINDER_SET_CONTEXT_MGR already set [ 3204.545613] binder: 14678:14693 ioctl 40046207 0 returned -16 [ 3204.572892] binder_alloc: 14678: binder_alloc_buf, no vma 18:45:27 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3204.597640] IPVS: ftp: loaded support on port[0] = 21 [ 3204.602015] binder: 14678:14681 got reply transaction with no transaction stack [ 3204.672731] binder: 14678:14701 transaction failed 29189/-3, size 0-0 line 3035 [ 3204.683907] binder: release 14678:14681 transaction 701 out, still active [ 3204.693372] binder: undelivered TRANSACTION_COMPLETE [ 3204.709953] binder: undelivered TRANSACTION_ERROR: 29201 [ 3204.737833] binder: send failed reply for transaction 701, target dead [ 3204.962250] chnl_net:caif_netlink_parms(): no params data found [ 3205.023737] bridge0: port 1(bridge_slave_0) entered blocking state [ 3205.035117] bridge0: port 1(bridge_slave_0) entered disabled state [ 3205.042193] device bridge_slave_0 entered promiscuous mode [ 3205.049375] bridge0: port 2(bridge_slave_1) entered blocking state [ 3205.055829] bridge0: port 2(bridge_slave_1) entered disabled state [ 3205.062982] device bridge_slave_1 entered promiscuous mode [ 3205.080259] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3205.089301] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3205.106646] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3205.113892] team0: Port device team_slave_0 added [ 3205.119318] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3205.126577] team0: Port device team_slave_1 added [ 3205.131891] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3205.139173] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3205.206980] device hsr_slave_0 entered promiscuous mode [ 3205.244879] device hsr_slave_1 entered promiscuous mode [ 3205.296136] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3205.303105] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3205.323196] bridge0: port 2(bridge_slave_1) entered blocking state [ 3205.329739] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3205.336370] bridge0: port 1(bridge_slave_0) entered blocking state [ 3205.342700] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3205.375497] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3205.382910] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3205.391472] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3205.399188] bridge0: port 1(bridge_slave_0) entered disabled state [ 3205.406253] bridge0: port 2(bridge_slave_1) entered disabled state [ 3205.418772] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3205.426008] 8021q: adding VLAN 0 to HW filter on device team0 [ 3205.435003] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3205.442558] bridge0: port 1(bridge_slave_0) entered blocking state [ 3205.448922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3205.466273] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3205.473818] bridge0: port 2(bridge_slave_1) entered blocking state [ 3205.480186] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3205.487563] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3205.495827] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3205.505008] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3205.517724] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 3205.528404] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3205.538728] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3205.550624] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3205.557820] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3205.565690] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3205.573146] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3205.591285] 8021q: adding VLAN 0 to HW filter on device batadv0 18:45:28 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x140, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:28 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x200, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f00000001c0)={0x20, 0x7e, 0x8, 'queue1\x00', 0x10001}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0xfffffffffffffee6) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58) 18:45:28 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x80000, 0x0) write$evdev(r2, &(0x7f0000000080)=[{{0x77359400}, 0x17, 0x8001, 0x9}], 0x18) 18:45:28 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:28 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000713000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:28 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3205.730730] binder: 14727:14728 got reply transaction with bad transaction stack, transaction 706 has target 14727:0 18:45:28 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000040)=r1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) [ 3205.840026] binder: BINDER_SET_CONTEXT_MGR already set [ 3205.885529] binder: 14727:14745 ioctl 40046207 0 returned -16 [ 3205.918164] binder_alloc: 14727: binder_alloc_buf, no vma 18:45:28 executing program 5: r0 = syz_open_dev$adsp(&(0x7f0000000480)='/dev/adsp#\x00', 0x3, 0x80) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f00000004c0)=0x8, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) prctl$PR_SET_TSC(0x1a, 0x2) io_setup(0x8, &(0x7f0000000100)=0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x20200, 0x0) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r6 = syz_open_dev$vbi(&(0x7f0000000240)='/dev/vbi#\x00', 0x0, 0x2) r7 = syz_open_dev$radio(&(0x7f00000003c0)='/dev/radio#\x00', 0x1, 0x2) io_submit(r3, 0x3, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0x6, r1, &(0x7f0000000000)="470b5efbf39cb616d41f1a652cff05f192c365ea72a318ba4dd683ed90c2a7177aac8d9a51299f2f5c", 0x29, 0x6, 0x0, 0x1, r4}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x8, 0xfd, r5, &(0x7f00000001c0)="78809fa10c6cd421f01e8b9678fe47f44a6341d77d984d7f69aa998385a658c75ef78cc14093742f533b83a485edae4fd598c1e58ed3", 0x36, 0x2, 0x0, 0x0, r6}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x8, 0x87, r2, &(0x7f00000002c0)="1c6a1f9f72889f7cd1bf68556d177fd001c62da453455ca4fd4c2da891c62d0196c7044e166f46713be4824405de1bc13c95e61a2452543f1ee9f923380056d16988f7ebcc354ef8bb59e0a7babb7ed2ada4653f09a2c43c4d32420767b901ce0ec2b9c13fb9b9a2f6e17a31aa2fe1d39b8f2a6a7803e0b8ba4038a42685b0820cdcade31d8fb4b805c455e02d9ba44bca1a5180ba574fa9786833e5511c473ed458b09041aaf3121b50f252188360ddc69954248c1c2ab841264181f94cff225cd7344f31d5e827d08e907798c0e4d10ee14fb750fdf9b0e1a25462c0a4f51fc5f6b7ba83992c62", 0xe8, 0x10, 0x0, 0x2, r7}]) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, 0x0}]) 18:45:28 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:28 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x1, 0x7, 0x3}}, 0x28) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="041b3b40fee8c8e33485ff00aa", 0xd) [ 3205.933763] binder: release 14727:14728 transaction 706 out, still active [ 3205.949086] binder: undelivered TRANSACTION_COMPLETE [ 3205.968710] binder: send failed reply for transaction 706, target dead 18:45:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3206.112987] binder: 14767:14768 got reply transaction with bad transaction stack, transaction 710 has target 14767:0 [ 3206.163400] binder: BINDER_SET_CONTEXT_MGR already set [ 3206.192373] binder: 14767:14773 ioctl 40046207 0 returned -16 [ 3206.216885] binder: release 14767:14773 transaction 712 out, still active [ 3206.223871] binder: undelivered TRANSACTION_COMPLETE [ 3206.234299] binder: release 14767:14768 transaction 710 out, still active 18:45:28 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x148, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:28 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000000050a000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:28 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400008}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x4c, r2, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x1d}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e23}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_AF={0x8, 0x2, 0x9087370f298b9bae}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x2b}, @FOU_ATTR_AF={0x8, 0x2, 0xa}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) 18:45:28 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:28 executing program 5: socketpair$unix(0x1, 0x6, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) [ 3206.242783] binder: undelivered TRANSACTION_COMPLETE 18:45:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:28 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x5}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000001c0)={r2, 0x76, "ee112f7f9e8f3a008d04546c08b1ae3c60964d96463452b4fa9a34a2333e8028b64cb0f9173c15d77ea8f1940f9064c2cfb6fbb7879ea0323eec0119676d226674d287a39dabc56c9697fd5b42a649268a131d175f3e4c7a20d468e70cd7b07533f5edd10bc8ee6a0ccdeb0a5deaaef7b454d4f588b8"}, &(0x7f0000000100)=0x7e) [ 3206.277419] binder: send failed reply for transaction 710, target dead [ 3206.304259] binder: send failed reply for transaction 712, target dead 18:45:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3206.325766] device bridge_slave_1 left promiscuous mode [ 3206.329394] binder: 14790:14791 got reply transaction with bad transaction stack, transaction 714 has target 14790:0 [ 3206.331484] bridge0: port 2(bridge_slave_1) entered disabled state 18:45:29 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x40, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) accept(r0, 0x0, &(0x7f0000000080)) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r1, 0xc1105518, &(0x7f0000000240)={{0x8, 0x3, 0x80002001, 0x1, 'syz1\x00'}, 0x3, 0x404, 0x100000000, r2, 0x7, 0x6, 'syz0\x00', &(0x7f0000000440)=['\x00', '\x00', '\x00', ' \xe4_@+\x874\xf8\a\x7f\x12\x19\xce\xe6_O\xd3\xfe\xdeH\xbba\xca\tg\xdfK]\xd9\x1a\xa1\x14\xbd\x98\xcd\xf4O\x00\aK\x89\xf8\xad\xbb7\x19D\xc6\xef\xcf\x001z-\xd8GqbQ\xf9\x11\xf2\xc5\x85X*\x1b\xb6\x9f\x10\x88\x93\x80\xc9\xb7mN', 'authenc(rmd256,cbc(blowfish))\x00', 'X\x00', 'authenc(\xcb?\xf3\xff\x00\x00\x00\x00bc(blowfish))\x00'], 0x8e, [], [0x3, 0x8, 0x7f, 0x8]}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x5a) fsync(r0) [ 3206.386919] binder: BINDER_SET_CONTEXT_MGR already set [ 3206.392211] binder: 14790:14802 ioctl 40046207 0 returned -16 18:45:29 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000000070a000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) arch_prctl$ARCH_SET_GS(0x1001, 0x3) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) [ 3206.466627] device bridge_slave_0 left promiscuous mode [ 3206.481782] binder: release 14790:14791 transaction 714 out, still active [ 3206.505007] bridge0: port 1(bridge_slave_0) entered disabled state [ 3206.528472] binder: undelivered TRANSACTION_COMPLETE 18:45:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) [ 3206.552063] binder: send failed reply for transaction 714, target dead 18:45:29 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x1d7, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:29 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000017fe000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:29 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni-avx2\x00'}, 0xffffffffffffff97) r1 = accept(r0, &(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x80) getsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f00000001c0)=""/122, &(0x7f0000000100)=0x7a) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x100, 0x0) ioctl$NBD_SET_SOCK(r2, 0xab00, r1) 18:45:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000000c0)="0300c7aa", 0x4) 18:45:29 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000002c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(aes-aesni)\x00'}, 0xffffffffffffff3c) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) r1 = dup(r0) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f0000000040)={0x2b, ""/43}) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x80000001, 0x4000) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r2, 0x111, 0x3, 0x1, 0x4) [ 3206.716514] binder: 14833:14834 got reply transaction with bad transaction stack, transaction 717 has target 14833:0 18:45:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/l2cap\x00') ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000080)) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r2, 0x111, 0x5, 0x1, 0x4) openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x80c0, 0x0) [ 3206.807653] binder_transaction: 5 callbacks suppressed [ 3206.807666] binder: 14833:14834 transaction failed 29201/-71, size 0-0 line 2816 18:45:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:29 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500007ffffffff000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:29 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x2000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000100)={{0x2, 0x3, 0x10001, 0x0, 0x4}}) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000080)={0x0, 0x80, 0x2b9, &(0x7f0000000040)=0x800}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(rmd256,cbc(blowfish))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="0400c7aa", 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0xffffffff7fffffff) [ 3206.908988] device hsr_slave_1 left promiscuous mode [ 3206.926259] binder: BINDER_SET_CONTEXT_MGR already set [ 3206.931670] binder: 14833:14859 ioctl 40046207 0 returned -16 [ 3206.950624] device hsr_slave_0 left promiscuous mode 18:45:29 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500a0500000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3206.976260] binder_alloc: 14833: binder_alloc_buf, no vma [ 3206.999651] team0 (unregistering): Port device team_slave_1 removed 18:45:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) r2 = dup(r0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000080)=0x4) io_setup(0x8, &(0x7f0000000100)=0x0) ioctl$VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000000240)={0x9, 0x7, 0x4, 0xf000, {}, {0x2, 0xc, 0x4, 0xe9bd, 0x5, 0x534, "fbcfcfcf"}, 0xd206, 0x7, @userptr=0x2, 0x4}) io_submit(r3, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) ioctl$VIDIOC_TRY_EXT_CTRLS(r2, 0xc0205649, &(0x7f00000001c0)={0xa20000, 0x3, 0x5, [], &(0x7f0000000140)={0x0, 0x9, [], @p_u8=&(0x7f00000000c0)=0xffffffff7fffffff}}) [ 3207.022943] binder: 14833:14834 got reply transaction with no transaction stack [ 3207.073126] team0 (unregistering): Port device team_slave_0 removed [ 3207.074250] binder: 14833:14866 transaction failed 29189/-3, size 0-0 line 3035 [ 3207.093239] binder: send failed reply for transaction 717 to 14833:14834 [ 3207.116699] binder: undelivered TRANSACTION_COMPLETE 18:45:29 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x1e4, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:29 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005fffffffffffff000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3207.153504] binder: 14833:14834 transaction failed 29201/-71, size 0-0 line 2801 [ 3207.186889] bond0 (unregistering): Releasing backup interface bond_slave_1 18:45:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:29 executing program 2 (fault-call:2 fault-nth:0): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3207.224849] binder: 14885:14889 got reply transaction with bad transaction stack, transaction 722 has target 14885:0 18:45:29 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) 18:45:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3207.272889] binder: BINDER_SET_CONTEXT_MGR already set [ 3207.284334] binder: 14885:14889 transaction failed 29201/-71, size 0-0 line 2816 [ 3207.296071] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3207.303016] binder: 14896:14897 ioctl 40046207 0 returned -16 18:45:30 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000001000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3207.341451] binder: 14896:14897 got reply transaction with bad transaction stack, transaction 724 has target 14885:0 [ 3207.369870] binder: release 14885:14889 transaction 722 out, still active [ 3207.386597] binder: undelivered TRANSACTION_COMPLETE 18:45:30 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0xffff, 0x200000) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@empty, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8) connect$packet(r0, &(0x7f0000000440)={0x11, 0x8, r1, 0x1, 0x100000001, 0x6, @local}, 0x14) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f00000001c0)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000080)={0x4, 0x80000000, 0x7199, 0x6, 0x7, 0x1000}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000000100)={0x1, 0x4, 0x6}) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x3c, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0x14, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_UPDELAY={0x8, 0x9}]}}}]}, 0x3c}}, 0x0) [ 3207.438660] binder_release_work: 10 callbacks suppressed [ 3207.438665] binder: undelivered TRANSACTION_ERROR: 29201 [ 3207.455519] binder: 14896:14897 transaction failed 29201/-71, size 0-0 line 2816 18:45:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x3, 0x0, 0x0) [ 3207.488842] binder: BINDER_SET_CONTEXT_MGR already set 18:45:30 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x18, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x2000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x0, @mcast2, 0x6}, @in6={0xa, 0x4e22, 0xe77, @loopback}, @in6={0xa, 0x4e21, 0x346d00e3, @local, 0x6}, @in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e24, 0x5, @loopback, 0x1}], 0x80) [ 3207.520220] binder: send failed reply for transaction 722, target dead [ 3207.533586] binder: 14896:14900 ioctl 40046207 0 returned -16 [ 3207.553144] binder: send failed reply for transaction 724 to 14896:14897 [ 3207.585850] binder_alloc: binder_alloc_mmap_handler: 14896 20010000-20014000 already mapped failed -16 [ 3207.631216] binder: undelivered TRANSACTION_COMPLETE [ 3207.636718] binder: undelivered TRANSACTION_ERROR: 29201 [ 3207.660563] binder: undelivered TRANSACTION_ERROR: 29189 [ 3207.686799] bond0 (unregistering): Released all slaves 18:45:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:30 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x2b9, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x300, 0x0, 0x0) [ 3207.882814] binder: 14935:14937 got reply transaction with bad transaction stack, transaction 727 has target 14935:0 18:45:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x10) [ 3207.983729] binder: 14935:14937 transaction failed 29201/-71, size 0-0 line 2816 18:45:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x50) [ 3208.041994] binder: BINDER_SET_CONTEXT_MGR already set 18:45:30 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x300, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:30 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x5000) [ 3208.085044] binder: 14935:14944 ioctl 40046207 0 returned -16 [ 3208.143872] binder: release 14935:14937 transaction 727 out, still active [ 3208.177565] binder: undelivered TRANSACTION_COMPLETE [ 3208.200311] binder: undelivered TRANSACTION_ERROR: 29201 [ 3208.236873] binder: send failed reply for transaction 727, target dead [ 3208.269845] libceph: resolve '.u [ 3208.269845] ' (ret=-3): failed [ 3208.297001] netlink: 4 bytes leftover after parsing attributes in process `syz-executor3'. [ 3208.348534] libceph: parse_ips bad ip '.u [ 3208.348534] :d]:.,[' [ 3208.563697] libceph: resolve '.u [ 3208.563697] ' (ret=-3): failed [ 3208.572955] libceph: parse_ips bad ip '.u [ 3208.572955] :d]:.,[' 18:45:31 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000002000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:31 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x500000) 18:45:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:31 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000) socketpair$unix(0x1, 0x4000000, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) pipe(&(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) recvmmsg(r2, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f00000002c0)=""/211, 0xd3}], 0x2, &(0x7f0000000400)=""/161, 0xa1, 0x4ae}}, {{&(0x7f0000000700)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8001}}, {{0x0, 0x0, 0xfffffffffffffffe, 0x0, &(0x7f0000000d00)=""/163, 0xa3, 0x100000001}, 0x40}, {{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000dc0)=""/49, 0x31}, {&(0x7f0000000e00)=""/216, 0xd8}, {0x0}], 0x3, 0x0, 0x0, 0x3}}, {{0x0, 0x0, &(0x7f0000002400)=[{0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001340)=""/12, 0xc}], 0x5, 0x0, 0x0, 0xff}}], 0x5, 0x41, 0x0) r5 = dup2(r4, r2) sendmsg$netlink(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[@rights={0x20, 0x1, 0x1, [r5, r1, r2, r3]}], 0x20}, 0x0) recvmmsg(r3, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0xb, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) io_setup(0x5, &(0x7f0000000100)=0x0) io_submit(r6, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) personality(0x510010f) [ 3208.811940] binder: 14972:14980 got reply transaction with bad transaction stack, transaction 730 has target 14972:0 18:45:31 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x36e, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:31 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x10000000) 18:45:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3208.871046] binder: 14972:14980 transaction failed 29201/-71, size 0-0 line 2816 [ 3208.927518] binder: BINDER_SET_CONTEXT_MGR already set 18:45:31 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x7ffffffff000) [ 3209.021683] binder: 14972:14989 ioctl 40046207 0 returned -16 [ 3209.021731] binder: release 14972:14980 transaction 730 out, still active 18:45:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3209.072081] binder: undelivered TRANSACTION_COMPLETE 18:45:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3209.123386] binder: undelivered TRANSACTION_ERROR: 29201 [ 3209.144083] binder: send failed reply for transaction 730, target dead [ 3209.216051] IPVS: ftp: loaded support on port[0] = 21 [ 3209.246562] binder: 15010:15011 got reply transaction with bad transaction stack, transaction 733 has target 15010:0 [ 3209.294795] binder: 15010:15011 transaction failed 29201/-71, size 0-0 line 2816 [ 3209.346420] binder: BINDER_SET_CONTEXT_MGR already set [ 3209.351731] binder: 15010:15015 ioctl 40046207 0 returned -16 [ 3209.394497] binder_alloc: 15010: binder_alloc_buf, no vma [ 3209.431850] binder: 15010:15015 transaction failed 29189/-3, size 0-0 line 3035 [ 3209.497027] binder: 15010:15011 got reply transaction with no transaction stack [ 3209.544612] chnl_net:caif_netlink_parms(): no params data found [ 3209.564975] binder: release 15010:15011 transaction 733 out, still active [ 3209.571954] binder: undelivered TRANSACTION_COMPLETE [ 3209.577523] binder: 15010:15011 transaction failed 29201/-71, size 0-0 line 2801 [ 3209.605080] binder: undelivered TRANSACTION_ERROR: 29201 [ 3209.610561] binder: send failed reply for transaction 733, target dead [ 3209.665195] binder: undelivered TRANSACTION_ERROR: 29201 [ 3209.687650] bridge0: port 1(bridge_slave_0) entered blocking state [ 3209.702808] binder: undelivered TRANSACTION_ERROR: 29189 [ 3209.725420] bridge0: port 1(bridge_slave_0) entered disabled state [ 3209.746431] device bridge_slave_0 entered promiscuous mode [ 3209.779328] bridge0: port 2(bridge_slave_1) entered blocking state [ 3209.788649] bridge0: port 2(bridge_slave_1) entered disabled state [ 3209.806639] device bridge_slave_1 entered promiscuous mode [ 3209.840757] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3209.850988] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3209.873386] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3209.882471] team0: Port device team_slave_0 added [ 3209.888212] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3209.895752] team0: Port device team_slave_1 added [ 3209.901060] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3209.908564] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3209.976833] device hsr_slave_0 entered promiscuous mode [ 3210.014815] device hsr_slave_1 entered promiscuous mode [ 3210.054987] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3210.061833] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3210.083264] bridge0: port 2(bridge_slave_1) entered blocking state [ 3210.089623] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3210.096269] bridge0: port 1(bridge_slave_0) entered blocking state [ 3210.102596] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3210.156563] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3210.171396] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3210.181115] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3210.189190] bridge0: port 1(bridge_slave_0) entered disabled state [ 3210.196487] bridge0: port 2(bridge_slave_1) entered disabled state [ 3210.219450] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3210.225884] 8021q: adding VLAN 0 to HW filter on device team0 [ 3210.235113] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3210.242656] bridge0: port 1(bridge_slave_0) entered blocking state [ 3210.249121] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3210.266248] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3210.273725] bridge0: port 2(bridge_slave_1) entered blocking state [ 3210.280074] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3210.288289] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3210.296377] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3210.309778] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3210.335320] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3210.344125] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3210.352721] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3210.363906] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3210.372362] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 18:45:33 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500007fffffffefff000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:33 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x50000000000000) 18:45:33 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:33 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000000)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:33 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x39d, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3210.385231] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3210.396377] 8021q: adding VLAN 0 to HW filter on device batadv0 18:45:33 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:33 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xf0ffffff7f0000) [ 3210.466737] binder: 15035:15036 got reply transaction with bad transaction stack, transaction 738 has target 15035:0 [ 3210.501542] libceph: resolve '.u [ 3210.501542] ' (ret=-3): failed 18:45:33 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000060ffffffffff000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3210.545672] binder: BINDER_SET_CONTEXT_MGR already set [ 3210.551051] binder: 15035:15050 ioctl 40046207 0 returned -16 [ 3210.561675] libceph: parse_ips bad ip '.u [ 3210.561675] :d]:.,[' 18:45:33 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) 18:45:33 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500f0ffffffffffff000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:33 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x80) ioctl$BLKSECTGET(r2, 0x1267, &(0x7f0000000080)) [ 3210.613633] binder_alloc: 15035: binder_alloc_buf, no vma [ 3210.634340] binder: 15035:15036 got reply transaction with no transaction stack 18:45:33 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x1000000000000000) [ 3210.711970] binder: release 15035:15036 transaction 738 out, still active [ 3210.735456] binder: undelivered TRANSACTION_COMPLETE [ 3210.756340] binder: undelivered TRANSACTION_ERROR: 29201 18:45:33 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) [ 3210.761921] binder: undelivered TRANSACTION_ERROR: 29201 [ 3210.769092] libceph: resolve '.u [ 3210.769092] ' (ret=-3): failed 18:45:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3210.804881] libceph: parse_ips bad ip '.u [ 3210.804881] :d]:.,[' 18:45:33 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050002000000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:33 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) prctl$PR_SVE_SET_VL(0x32, 0x2dc1d) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$RTC_WIE_OFF(r1, 0x7010) [ 3210.848219] binder: send failed reply for transaction 738, target dead [ 3210.881457] binder: 15086:15088 got reply transaction with bad transaction stack, transaction 743 has target 15086:0 [ 3211.000192] binder: BINDER_SET_CONTEXT_MGR already set [ 3211.016609] binder: 15086:15100 ioctl 40046207 0 returned -16 [ 3211.033353] binder_alloc: 15086: binder_alloc_buf, no vma 18:45:33 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x500, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:33 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) 18:45:33 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500f0000000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:33 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000980)={0x2, 0x0, @multicast1}, &(0x7f00000009c0)=0x10, 0x800) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000a00)={0x0, 0x0, 0x1, [0x7]}, &(0x7f0000000a40)=0xa) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000a80)={r2, 0x10000, 0xa, [0xc6, 0x1, 0x7f, 0xe1db, 0x81, 0x0, 0x0, 0x100000001, 0x1ff, 0x1]}, &(0x7f0000000ac0)=0x1c) 18:45:33 executing program 5: r0 = socket(0x9, 0x3, 0x9) accept4$unix(r0, &(0x7f00000001c0)=@abs, &(0x7f0000000000)=0x6e, 0x800) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) 18:45:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3211.114805] binder: send failed reply for transaction 743 to 15086:15088 [ 3211.121807] binder: undelivered TRANSACTION_COMPLETE [ 3211.191639] binder: 15110:15111 got reply transaction with bad transaction stack, transaction 747 has target 15110:0 18:45:33 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3211.235434] libceph: resolve '.u [ 3211.235434] ' (ret=-3): failed 18:45:33 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes192\x00'}, 0xa5) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-generic\x00'}, 0x58) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x800, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r1, 0x40045731, &(0x7f00000000c0)=0x8003) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3211.278805] libceph: parse_ips bad ip '.u [ 3211.278805] :d]:.,[' [ 3211.323942] binder: BINDER_SET_CONTEXT_MGR already set 18:45:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:34 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000400000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3211.384232] device bridge_slave_1 left promiscuous mode [ 3211.390098] binder: 15110:15125 ioctl 40046207 0 returned -16 [ 3211.397464] bridge0: port 2(bridge_slave_1) entered disabled state 18:45:34 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x0) ioctl$KVM_KVMCLOCK_CTRL(r2, 0xaead) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:34 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x50100, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)={0x4}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3211.424961] binder_alloc: 15110: binder_alloc_buf, no vma [ 3211.429642] binder: release 15110:15111 transaction 747 out, still active [ 3211.457559] binder: undelivered TRANSACTION_COMPLETE [ 3211.477785] libceph: resolve '.u [ 3211.477785] ' (ret=-3): failed [ 3211.505639] binder: send failed reply for transaction 747, target dead 18:45:34 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x600, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3211.530613] device bridge_slave_0 left promiscuous mode [ 3211.536376] bridge0: port 1(bridge_slave_0) entered disabled state 18:45:34 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='pids.events\x00', 0x0, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000240)=0x200000, 0x4) r1 = socket$alg(0x26, 0x5, 0x0) getpeername(r1, &(0x7f0000000000)=@tipc, &(0x7f0000000080)=0x80) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) [ 3211.587212] binder: 15153:15154 got reply transaction with bad transaction stack, transaction 751 has target 15153:0 [ 3211.617199] libceph: parse_ips bad ip '.u [ 3211.617199] :d]:.,[' 18:45:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:34 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000004c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) r2 = add_key$user(&(0x7f0000000500)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="22a764f2a69d08f67c0946ee255cb6d6972fbe0657d29843d00533c2983ca5170c0454f878ffaee9fdfae566c79732886bc03da679a27fd21ab42e222bd59743570acbaa3c92", 0x46, r1) r3 = openat$cgroup_ro(r0, &(0x7f0000000000)='pids.events\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000540)={0x0, 0x72, "e5729c06c582b081f482739d7d80c5c6cfe99ca2cc300001099b87cea4abeafc998f7128f76b1db7a61f4bf0814f9c75823014913cbd22a05e62260548e62db5610e1fa7f28805b87b500ccba4609fc2e9be634883d25768089dcda1fa873ea170c20ea9743a804cc907c206bcef8496fc9a"}, &(0x7f00000005c0)=0x7a) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000600)={r4, 0x8, 0x6, [0xd97, 0xdc, 0x2d7, 0xa358, 0xda6, 0x2]}, 0x14) r5 = pkey_alloc(0x0, 0x1) pkey_free(r5) r6 = request_key(&(0x7f0000000300)='rxrpc_s\x00', &(0x7f0000000340)={'syz', 0x3}, &(0x7f00000003c0)='aead\b\xe2\x80\x146\xdf\xa1\xf0\xce\xc8\xa7\xcc\xc0\xf3`\x01\x99\xb0\nW!\r \xa2F\x99\x87=#}\x194V<\xb2\x8f7 vg%L\x18\x8a\xe8j<\x92dK\xb8Zd\x1f\xdb\x9a\xa1B\xd9\x1e\xe0\x1b\a\rN\xc0\xa0O\xb9\x9d\x05\xc2nw\xe5\x00\x00\x00\x00\x00\x00\x00\x00{\xec\tg\x1f\rHLl\xe6\xd4\xcb\xb2\xe09\xc5\x19Z\xc7\xcfZ~\x88\x11(.D\x05O\xf2\x8ac\x19\xd7\xa9\x84w\xdb\x80\f$\xdau<\xcc\x00z\x1a\xa6\xee\a\xa0\xa1\x14Z9\xde\x0eh7\x8b9\xee\x9d;0\xa0Dl\xc1mo\x109Y\x93\xf3\x8a\x9f\x99\x1e\xee&\xbc\xf9H\x00\\\xec\x0e\xc6\xd9mM<\xd0\x17\x93s\xd7\xa4\\\x92\xa1\xeeIBL]\xa9\xdc\xd5\x06,', 0xfffffffffffffffa) keyctl$instantiate_iov(0x14, r2, &(0x7f00000002c0)=[{&(0x7f00000001c0)="bfe7b49422c6bc1bc37124e2a7040e0f20c1993fca9e3fcba7da5fa981b5f9054eb5824ca008ec273a7ef629281f816bc2e7c14bb9e39dbb6b070bcf5f1eca2995ab9b6fc06371b4ebc1653422863e91e1c7a8a86d74211872ad383852be25f427dbba4df0bd95f02b09df62cec6a65aef0a3efe40a38051d3efedfa5bb8ba1c26dd", 0x82}, {&(0x7f0000000100)="0ca004dca947479cfd36b579d80b208de2155ade", 0x14}, {&(0x7f0000000280)="85a1cb243d6ebbf1363c3f33341fd41c6aa82f329311b61cce3c9e34962946ca80d1b03338dc0bd718713b5ee38f7160b1d9b2b270abfc63ecf719e921cb", 0x3e}], 0x3, r6) r7 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) close(r7) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:34 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500ff600000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3211.686036] libceph: resolve '.u [ 3211.686036] ' (ret=-3): failed [ 3211.725117] binder: BINDER_SET_CONTEXT_MGR already set [ 3211.734909] libceph: parse_ips bad ip '.u [ 3211.734909] :d]:.,[' 18:45:34 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x2, 0x0) ioctl$UI_BEGIN_FF_ERASE(r2, 0xc00c55ca, &(0x7f00000000c0)={0x4, 0x1, 0xfffffffffffffffc}) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000080)={0x2000000000000000, 0x1f, 0x89, 0x80000001, 0x6, 0x5f17, 0xa, 0xe479, 0x695e00a7, 0x81, 0x6}, 0xb) [ 3211.766522] binder: 15153:15170 ioctl 40046207 0 returned -16 [ 3211.772649] binder_alloc: 15153: binder_alloc_buf, no vma 18:45:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3211.835652] binder: release 15153:15154 transaction 751 out, still active [ 3211.838152] binder: 15153:15187 got reply transaction with no transaction stack [ 3211.842616] binder: undelivered TRANSACTION_COMPLETE [ 3211.855926] binder_transaction: 8 callbacks suppressed [ 3211.855938] binder: 15153:15179 transaction failed 29189/-3, size 0-0 line 3035 18:45:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3211.920985] device hsr_slave_1 left promiscuous mode [ 3211.923101] binder: send failed reply for transaction 751, target dead [ 3211.958862] binder: 15153:15187 transaction failed 29201/-71, size 0-0 line 2801 18:45:34 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000740000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3211.983088] device hsr_slave_0 left promiscuous mode 18:45:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) [ 3212.111966] team0 (unregistering): Port device team_slave_1 removed [ 3212.189509] team0 (unregistering): Port device team_slave_0 removed [ 3212.221737] bond0 (unregistering): Releasing backup interface bond_slave_1 18:45:34 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x700, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:34 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=0x0) ptrace$setsig(0x4203, r1, 0x6, &(0x7f0000000240)={0x2a, 0x3, 0x3}) openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:34 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050001820000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) [ 3212.303021] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3212.318659] binder: 15212:15216 got reply transaction with bad transaction stack, transaction 756 has target 15212:0 [ 3212.344511] libceph: resolve '.u [ 3212.344511] ' (ret=-3): failed [ 3212.382053] libceph: parse_ips bad ip '.u [ 3212.382053] :d]:.,[' [ 3212.403549] binder: 15212:15216 transaction failed 29201/-71, size 0-0 line 2816 [ 3212.450979] bond0 (unregistering): Released all slaves [ 3212.470803] binder: BINDER_SET_CONTEXT_MGR already set [ 3212.481990] binder: 15212:15227 ioctl 40046207 0 returned -16 [ 3212.489316] binder: release 15212:15216 transaction 756 out, still active [ 3212.501520] binder: undelivered TRANSACTION_COMPLETE [ 3212.508021] binder_release_work: 9 callbacks suppressed [ 3212.508026] binder: undelivered TRANSACTION_ERROR: 29201 [ 3212.523589] binder: release 15212:15227 transaction 758 out, still active [ 3212.532452] binder: undelivered TRANSACTION_COMPLETE [ 3212.542647] binder: send failed reply for transaction 756, target dead [ 3212.550338] binder: send failed reply for transaction 758, target dead 18:45:35 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x0, &(0x7f000039a000)}, 0x10) open(&(0x7f00000001c0)='.\x00', 0x400001, 0x10) syz_open_dev$video(&(0x7f0000000140)='/dev/video#\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='fdinfo/4\x00') ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x10000014c) openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) ioctl$SNDRV_TIMER_IOCTL_PAUSE(0xffffffffffffffff, 0x54a3) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={0x0}) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmmsg(r1, &(0x7f0000002bc0)=[{{0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000000180)="e319e9a5", 0x4}], 0x1}}], 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00'}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:35 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) 18:45:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:35 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0, 0x0, 0x40000000000}]) 18:45:35 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf00, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3212.710319] binder: 15237:15239 got reply transaction with bad transaction stack, transaction 760 has target 15237:0 18:45:35 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000940000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3212.767717] binder: 15237:15239 transaction failed 29201/-71, size 0-0 line 2816 [ 3212.794606] binder: BINDER_SET_CONTEXT_MGR already set 18:45:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) shmat(0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000) socketpair$unix(0x1, 0x4000000, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) pipe(&(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) recvmmsg(r2, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f00000002c0)=""/211, 0xd3}], 0x2, &(0x7f0000000400)=""/161, 0xa1, 0x4ae}}, {{&(0x7f0000000700)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x8001}}, {{0x0, 0x0, 0xfffffffffffffffe, 0x0, &(0x7f0000000d00)=""/163, 0xa3, 0x100000001}, 0x40}, {{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000dc0)=""/49, 0x31}, {&(0x7f0000000e00)=""/216, 0xd8}, {0x0}], 0x3, 0x0, 0x0, 0x3}}, {{0x0, 0x0, &(0x7f0000002400)=[{0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000001340)=""/12, 0xc}], 0x5, 0x0, 0x0, 0xff}}], 0x5, 0x41, 0x0) r5 = dup2(r4, r2) sendmsg$netlink(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[@rights={0x20, 0x1, 0x1, [r5, r1, r2, r3]}], 0x20}, 0x0) recvmmsg(r3, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0xb, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) io_setup(0x5, &(0x7f0000000100)=0x0) io_submit(r6, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) personality(0x510010f) [ 3212.815096] binder: 15237:15251 ioctl 40046207 0 returned -16 [ 3212.829103] binder_alloc: 15237: binder_alloc_buf, no vma [ 3212.851543] binder: 15237:15251 transaction failed 29189/-3, size 0-0 line 3035 18:45:35 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x1020, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3212.926626] binder: undelivered TRANSACTION_ERROR: 29189 [ 3212.978441] binder: send failed reply for transaction 760 to 15237:15239 18:45:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3213.022158] binder: undelivered TRANSACTION_COMPLETE [ 3213.054828] binder: undelivered TRANSACTION_ERROR: 29201 [ 3213.081215] binder: 15262:15263 got reply transaction with bad transaction stack, transaction 764 has target 15262:0 [ 3213.099298] binder: undelivered TRANSACTION_ERROR: 29189 [ 3213.166130] binder: 15262:15263 transaction failed 29201/-71, size 0-0 line 2816 [ 3213.224050] binder: BINDER_SET_CONTEXT_MGR already set [ 3213.308189] binder: 15262:15264 ioctl 40046207 0 returned -16 [ 3213.353799] binder_alloc: 15262: binder_alloc_buf, no vma 18:45:36 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='auxv\x00') ioctl$CAPI_INSTALLED(r1, 0x80024322) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x74) [ 3213.411000] binder: release 15262:15263 transaction 764 out, still active [ 3213.418599] binder: 15262:15265 transaction failed 29189/-3, size 0-0 line 3035 [ 3213.435041] binder: undelivered TRANSACTION_COMPLETE [ 3213.440245] binder: undelivered TRANSACTION_ERROR: 29201 18:45:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3213.468121] binder: send failed reply for transaction 764, target dead [ 3213.504101] binder: undelivered TRANSACTION_ERROR: 29189 18:45:36 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3213.620368] binder: 15272:15273 got reply transaction with bad transaction stack, transaction 768 has target 15272:0 18:45:36 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x6, 0x80) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000080)="fcb60931ab") 18:45:36 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, 0x10, r0, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xffffffffffffff54, 0x2d00) ioctl$KVM_SET_VAPIC_ADDR(r1, 0x4008ae93, &(0x7f0000000040)=0x321b4373e828afd0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x101) [ 3213.755035] binder: 15272:15273 transaction failed 29201/-71, size 0-0 line 2816 [ 3213.847773] binder: BINDER_SET_CONTEXT_MGR already set [ 3213.853070] binder: 15272:15283 ioctl 40046207 0 returned -16 18:45:36 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40, 0x0) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000040)=0xffffffffffffff01, 0x4) [ 3213.903666] binder_alloc: 15272: binder_alloc_buf, no vma [ 3213.938896] binder: 15272:15287 transaction failed 29189/-3, size 0-0 line 3035 18:45:36 executing program 3 (fault-call:2 fault-nth:0): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:36 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) write$P9_RLERRORu(r0, &(0x7f00000000c0)={0x2b, 0x7, 0x2, {{0x1e, 'vmnet0vboxnet1selfsystemvmnet1'}, 0x9}}, 0x2b) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) r3 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x1, 0x2) ioctl$IMDELTIMER(r3, 0x80044941, &(0x7f00000001c0)=0x3) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000240)) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, 0x0}]) ioctl$NBD_SET_SIZE_BLOCKS(r3, 0xab07, 0xfffffffffffffffe) [ 3214.076528] binder: undelivered TRANSACTION_ERROR: 29189 [ 3214.082131] binder: send failed reply for transaction 768 to 15272:15273 [ 3214.171737] binder: undelivered TRANSACTION_COMPLETE [ 3214.218675] binder: undelivered TRANSACTION_ERROR: 29201 [ 3214.224126] binder: undelivered TRANSACTION_ERROR: 29189 18:45:37 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500c0ed0000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3215.080045] binder: 15302:15303 got reply transaction with bad transaction stack, transaction 772 has target 15302:0 [ 3215.146250] binder: 15302:15303 transaction failed 29201/-71, size 0-0 line 2816 [ 3215.178102] binder: BINDER_SET_CONTEXT_MGR already set [ 3215.183480] binder: 15302:15305 ioctl 40046207 0 returned -16 [ 3215.206778] binder_alloc: 15302: binder_alloc_buf, no vma [ 3215.212662] binder: undelivered TRANSACTION_ERROR: 29189 [ 3215.221365] binder: send failed reply for transaction 772 to 15302:15303 [ 3215.232890] IPVS: ftp: loaded support on port[0] = 21 [ 3215.241323] binder: undelivered TRANSACTION_COMPLETE [ 3215.401874] chnl_net:caif_netlink_parms(): no params data found 18:45:38 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x2000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:38 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x4}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000000c0)={r2, 0xfff, 0x8, [0x6, 0x9, 0x0, 0x7, 0xd2f, 0x3, 0x101, 0x8]}, 0x18) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x8000, 0x0) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000000640)={"627cfb0fc17da349562b2e5b03d6f266785abd897a4e5a261e08558aabe268ddbdd656a032a04d7fa313e378feefc0ce6df154bca1ca5d5081d1611cc7b3142e2c360328ece23bfef81d91d746ed8eb1d9cc2c03594aff2a9820a5dabf869f4510a3f89f054a43a3f526930d13905a670ec9ece96d935f81db70befaa93f32d3870e275af7c49b447b4575d02b4978261ac07a339dd30dd06c220a187be17947dff75eec8746aa0e809d2a097d674a4b02509f438970ef75dd12558ab6b0d7aa812d705a7ebb17f6b6bbb3c311c518aa611d6194a634e0fb62d57d7297fe28cc347f1adfb7e34a8afdd1f677c6489482af6d1db5690a775f78528da77d2a0031fb986e605352e3cbb69f1fbab2cbb4463f249497729aa9081e1c02a228c442152ff20db56a796f65b29d9d507eb7087e7b542da434aa806dc2c7b3841e04574961179fcdbf3d63683e14527f1b480a57d408c768839e312ad7ef9602472c130ca40144dd8101d29f3855f12ce724d2fddb017a6656a1ce90d5ca5555441972ddb1a2a66b45bf8867cb04de526af89a9d109bff0b2a32ef23a3dd740dafd5aeec20ea3a1af63d26551dfa4e6c07d15d204904f29c3042d78dbbc12c247b4d5b6bc4e975b8498526f8a789ed2e5779e3cb605c811cbf7009c3320943eac3990cedfd39bbff60f3d0f0327b03a432f2e376aae03c85095b99798fda22678417b14c00ae529adcb074ab5e1faa894721c7b9a90ae4556d8edb1fdd185d91e44fc18e693881a49f56722aa51c99966d5f118643c98d83a800c30e59a6e307b95373cbfae277a2884f0548649932367d8140c7e37f984ff4566ced71fd26bd4e52d26dd3cf1888e526e88755054b9ad93a928b66618abf2cdc27f1a78de09d0e50028fd432a2ac07a32171a4b843544404e7e0ce065f4735a3100a392d20a5057e26c7d413c4ebed6631e84035b4bbfb3d8687b94ced9465f668bf75c3d50ef2a6176ec441a4f8e673e5cdb34ece40b4d5b56a34b1d2e34ba80602696584976e894c6bd988b778e05ab48509a7da6e343cc026ad776c58d26dc33d133c937e85ac39c36e09ccc4ccb4691a17b9e4a0cfce62b49c9ff2db0bcb2651bdb4aa613a1ecc48e61a656311848591db90dc6f56fcfa22accbcc28d97f51d5ff238e3095952c46065da94566f28ac0e04f1daa4f4ed623391798e0acffae7d9bf240af617db33b6052dfeca1d722228c90b8d8890299119168678a238e2e07a358a8735e1b4fc17e7416f5389b41da8e45dd5e5416ce7ee302d7d7578711e339573d62589c4e49f76dd31f85990b4e1e8bac3cee10d5fbcf9b7b478a1e9008d7d738fce80e4a2b89fd296f953795a01467efbc33c5a4f2703ea7fa99b404bb9709a3135927b2660cda1c18a2d40fd20647b7ee8f08275d06d993e1abd07e58627db48944e329e0"}) openat$vnet(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x5, &(0x7f00000000c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:38 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3215.447462] bridge0: port 1(bridge_slave_0) entered blocking state [ 3215.453848] bridge0: port 1(bridge_slave_0) entered disabled state [ 3215.466561] device bridge_slave_0 entered promiscuous mode [ 3215.473619] bridge0: port 2(bridge_slave_1) entered blocking state [ 3215.484323] bridge0: port 2(bridge_slave_1) entered disabled state 18:45:38 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x7) [ 3215.512517] device bridge_slave_1 entered promiscuous mode [ 3215.519693] binder: 15311:15317 got reply transaction with bad transaction stack, transaction 776 has target 15311:0 [ 3215.559969] binder: BINDER_SET_CONTEXT_MGR already set 18:45:38 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x101, 0x80000) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x2, 0x7]) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f00000000c0)={0x5, &(0x7f0000000080)=[{0x0}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000000100)={r2, 0x1}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3215.587611] binder: 15311:15321 ioctl 40046207 0 returned -16 18:45:38 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3215.630581] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3215.635217] binder_alloc: 15311: binder_alloc_buf, no vma [ 3215.664388] binder: send failed reply for transaction 776 to 15311:15317 18:45:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400000, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000080)={0x1, 'dummy0\x00', 0x4}, 0x18) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:38 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'ccm-aes-ce\x00'}, 0x34) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="710000000b7686e46d0b31d5ba51ab354bee31dcfa1ae93cbdea0efe6f4dcfcdccb417056686cb688e7fe610ad04b4f1dfb4e5dd469cde735f41de59811ff7fc2d4b195b750a853d562a42193c4b3578ee82ae145ee60192c6ab98dd95f1c2c7ba8923b2510f135876b291224ba2bc21a4de6287e08b08b4639b26ee10817a3fcff0e68af7e998fd609da31213"], &(0x7f00000000c0)=0x79) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000100)={r2, 0x4, 0x4}, 0x8) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3215.688887] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3215.702880] binder: undelivered TRANSACTION_COMPLETE [ 3215.799797] IPVS: ftp: loaded support on port[0] = 21 [ 3215.806570] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3215.825145] team0: Port device team_slave_0 added [ 3215.843971] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3215.860241] team0: Port device team_slave_1 added [ 3215.869033] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3215.888437] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3215.966826] device hsr_slave_0 entered promiscuous mode [ 3216.006045] device hsr_slave_1 entered promiscuous mode [ 3216.065392] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3216.073641] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3216.095132] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3216.169866] chnl_net:caif_netlink_parms(): no params data found [ 3216.209071] bridge0: port 1(bridge_slave_0) entered blocking state [ 3216.215501] bridge0: port 1(bridge_slave_0) entered disabled state [ 3216.222571] device bridge_slave_0 entered promiscuous mode [ 3216.232637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3216.239642] bridge0: port 2(bridge_slave_1) entered blocking state [ 3216.247210] bridge0: port 2(bridge_slave_1) entered disabled state [ 3216.254326] device bridge_slave_1 entered promiscuous mode [ 3216.263160] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3216.281370] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3216.292050] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3216.306381] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3216.318883] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3216.325873] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3216.333248] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3216.340490] team0: Port device team_slave_0 added [ 3216.346096] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3216.353157] team0: Port device team_slave_1 added [ 3216.358774] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3216.366193] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3216.377668] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3216.383797] 8021q: adding VLAN 0 to HW filter on device team0 [ 3216.447071] device hsr_slave_0 entered promiscuous mode [ 3216.485037] device hsr_slave_1 entered promiscuous mode [ 3216.515180] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3216.523228] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3216.532628] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3216.540070] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3216.550007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3216.557768] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3216.565704] bridge0: port 1(bridge_slave_0) entered blocking state [ 3216.572023] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3216.578784] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3216.586918] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3216.594372] bridge0: port 2(bridge_slave_1) entered blocking state [ 3216.600727] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3216.609594] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3216.617262] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3216.624222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3216.635441] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3216.643562] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3216.652177] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3216.660264] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3216.668035] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3216.676438] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3216.684525] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3216.697022] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3216.705014] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3216.712425] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3216.722680] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3216.735101] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3216.745598] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3216.751594] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3216.781443] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3216.791894] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3216.834905] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3216.843054] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3216.854855] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3216.863515] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3216.869854] 8021q: adding VLAN 0 to HW filter on device team0 18:45:39 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000f00000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3216.902549] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3216.916540] bridge0: port 1(bridge_slave_0) entered blocking state [ 3216.922993] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3216.939929] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3216.958265] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3216.970627] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3216.979614] binder: 15356:15357 got reply transaction with bad transaction stack, transaction 780 has target 15356:0 [ 3216.980254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3217.005376] binder_transaction: 3 callbacks suppressed [ 3217.005391] binder: 15356:15357 transaction failed 29201/-71, size 0-0 line 2816 [ 3217.024211] bridge0: port 2(bridge_slave_1) entered blocking state [ 3217.030592] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3217.031286] binder: BINDER_SET_CONTEXT_MGR already set [ 3217.042845] binder: 15356:15365 ioctl 40046207 0 returned -16 [ 3217.045656] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3217.063277] binder_alloc: 15356: binder_alloc_buf, no vma [ 3217.069842] binder: 15356:15365 transaction failed 29189/-3, size 0-0 line 3035 [ 3217.078789] binder: 15356:15357 got reply transaction with no transaction stack [ 3217.086451] binder: release 15356:15357 transaction 780 out, still active [ 3217.086460] binder: undelivered TRANSACTION_COMPLETE [ 3217.086586] binder: send failed reply for transaction 780, target dead [ 3217.094027] binder: 15356:15357 transaction failed 29201/-71, size 0-0 line 2801 [ 3217.116736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3217.132556] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3217.142866] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3217.156500] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3217.163489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3217.163971] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3217.187829] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3217.194955] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3217.201777] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3217.209697] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3217.218931] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3217.229637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3217.237347] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3217.246419] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3217.260544] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3217.268839] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3217.277421] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3217.283400] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3217.301586] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3217.312761] 8021q: adding VLAN 0 to HW filter on device batadv0 18:45:40 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x2010, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x700) 18:45:40 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000040)={{0x97, @multicast1, 0x4e21, 0x0, 'none\x00', 0x10, 0x5, 0x4e}, {@dev={0xac, 0x14, 0x14, 0x2a}, 0x4e23, 0x2000, 0x5, 0x4, 0x6}}, 0x44) 18:45:40 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x800, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x35) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:40 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000713000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3217.385387] device bridge_slave_1 left promiscuous mode [ 3217.391057] bridge0: port 2(bridge_slave_1) entered disabled state [ 3217.398612] binder: 15379:15380 got reply transaction with bad transaction stack, transaction 785 has target 15379:0 18:45:40 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000004000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x7000000) 18:45:40 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'vmac64(seed)\x00'}, 0x58) r1 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) openat$cgroup(r3, &(0x7f0000000140)='syz0\x00', 0x200002, 0x0) write$P9_RREAD(r3, &(0x7f0000000a40)=ANY=[@ANYBLOB="e60a000075fcff00060000e4c8031aba1d615aa86fa38cbfd4de9aa961a5d420e59c663d63b55587ac2e1db8980f8f15687c89d0590d3ac0e31f56c672d344295932533dfab39eaf9cff6ba3d0ae9706f64746c513a2f23231001def119cc7bcd797a7e3420e06f79bdc4c313268fc8fcd1b3b785e114f821c612cb723e23e117c42f76f5c67e2b1a69280abd2ae4646db3bdd062c5d76edc0f703c01b3cc6bcf4978e51d675f795320dcc3b1f5d2caf4d63cd16cef04ce552ca2bb833e20e11163141e878f50b97fd57db6d2d8e4ebc94bb92c34b71eeb6aa6290fba76a04ae0767c80b9dbb3681b523a87b5beb6d03f4acaa1492400b008a16de9ba129a12b768d924a12443e99399a685ace007b86ed3a0d2cc2479e6933282f88037c48fba958fe59819db5815f2c20314993042c9ea2f889dbd94cb996987f1111f03a3ad5e00c7450c658982d63ac10ff1b7347b030122b52812d2e5765c20dd31120e9f3456fc41e4a65f8f8a8515003112f95dc5d575bc2ff73340b4ba9514b9bd51e8269ae933f3751c4d8780f18e4d001395a100d56fc4def1d001834e3ef9229bcde328e3e547cc797ad63337c5531905679c2c13cdd5b79c2bdf1135b7822312c0a1dd4fa81df81f64cbffdac01ec779fbb2e2fac0ea5b5ab1367ebd5fcec7ed17240bdb82ec94d8773416b4e255eb08f777c528cad27d1cbdaed59efd169804e1f5b70c3425321d466daabef1ff0334b1a0f12b24998c6c7360f7d309cc5beba67aa0e820422528037273666fbe76ca8d9f035f5f1c15695bf385467f27af6dd3501000100e3142205414b3100d0888aebf15ef5c35fb6a53121ef9979e6cc403c2c74708de401e17ce59c8a8a05a6d5d72cda47549f1833c1d624ccd743fbb1a9e64f7af8283dd6ea60d2557f69546d2e127e1710c908abcb1338f2373a97730c9f3a6689508ae9d09fc8d0e25a36d754e528d6843890698ae094339a44432c1d369a59e3c19e88c8b58cf0a7a9559a289aebf035fa3e9245cfdb5ed8b90f59decdab71810889a1fcd988d455a7bf2c18b81bf89634f6aafd60016351e679ec553471ea1bfffe47c36f2066bc0c88de7bcfa8d391582212214b2d761bd823165a2c2543f33111bbd2cd0dd50c0af34c08243eca15c86ec36fedd298f6f78ed7ad88f89cbdfd5f12cb41ed78106ed5e14b38942cb2b576552d05cb610f9b71b1888b88c15ccb5a8a02d4b5ccbbc219ae7ebaa64980e518c5ba1209231dd3d53305ae21b6e9423550ec098c8eb6d585f17381031623a3f66b61917a44a768e75e24841ace0364419c9e483ab3e6544f6a79b4a20b16fff62e93ef2e48f73ed96e464938dacf82d93d84ea48545bb2925c5857f5aad47106d78b7dc8d803d72d2b2787b9160b54e7c02fd9f36a6aec24a7be702689ba31bd77677f649e5fa6f670755ecba40d30dd5794e13cf3ae17714e4694c1bc39d6ca9988ee3892fc50c92ab3124e6ed31ff72f629277df4489d834e9a8dd2422bea309c18bdb658cc6dd6c93624fe104db3bf7f7a68606540014a6c48fc83a002430bee190bcf53dbbfcd67fd48adc2fd9f5eb5142e78bc13fc9b1844e53bed1dafcf650c08e1c76ca451ed1d13bdd71b64b14ac26bbe31453c8c7f45c43e1ee3eaa27cbe3e6c12e36dd25d587a409576ed4f73be91c6636065eabbdda2a4bf0f2febb836a8876df5ac5dc4f7b951ef1b38a81333ac50674d2452d0d5e7df9b0f44fb0807f9cf13bab2d8a85952edf0aa7c78641dfcef6ea82ef3df42f32842944471ffbc74c0009a452adf8495a2a9156a1bbf72882019fd29d57b984887d7b8a05c85684a263789bd70e5a294870550fe51d8a71c5c67243dd88612ce740ff25f1a5933dad7ecfe972eb56adf0fb5a3d7349dafeaa93f8b181b7f31ea8bf73a18a0c4c42063e8ddd7093db3bc5ea2fa5c3d78ba9208bedca696f38c4e68f8e2ea1e6ab275d4f10c3755842b7e683bce3960a268cdeaf0801440d9740b5945ae73f95aacb434f420b3bfd686b0def86c4546e0f22dbb6ba96a0c431fac26290da4bdcd10f23d0e392ac9b497d9ef1e737469c87174aa1172bc57d008f38364439f9094497f5c41604097844933d5ee3d94a054adb2f15663ce6453cba0d0e53c6c09da10b88ab518301122818bb24925fd2e013c20efe35e86afe2b4e162d1580140181c5cffb0f707d0ed329321c06c9180a1b78592fcd7430229556e619a1fee89f681b3a5dbed3825aef97036570501d21e6799a1fac077386544a63125f3017dcdcc8b354282b34b7a3622b7f476dc82d2a5a2f8d5b8b4d31c5c42cc20a74e2571ba7c96b799f282ff1f59e991f425c82a3910148f60ab52b944859f9b68822e0d108b70d8e088c66af9192260716781ac6ee259da16d8b78d0fb44f001e1d8b4d000000000"], 0x2a2) getsockopt$inet_mreqsrc(r1, 0x0, 0x25, &(0x7f00000000c0)={@multicast2, @loopback, @empty}, &(0x7f0000000100)=0xc) r4 = syz_open_dev$cec(&(0x7f0000000240)='/dev/cec#\x00', 0x0, 0x2) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000180)={0x0, 0x1000, 0x20, 0x1, 0x8}, &(0x7f00000001c0)=0x18) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000200)={r5, 0x6}, 0x8) getsockopt$packet_int(r3, 0x107, 0x15, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r6 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) socket$inet(0x2, 0x806, 0x3) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3217.427328] binder: 15379:15380 transaction failed 29201/-71, size 0-0 line 2816 [ 3217.455553] device bridge_slave_0 left promiscuous mode [ 3217.460980] bridge0: port 1(bridge_slave_0) entered disabled state [ 3217.485463] binder: BINDER_SET_CONTEXT_MGR already set [ 3217.509354] binder: 15379:15395 ioctl 40046207 0 returned -16 [ 3217.537883] device bridge_slave_1 left promiscuous mode [ 3217.543487] bridge0: port 2(bridge_slave_1) entered disabled state 18:45:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10000000) 18:45:40 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xa9, 0x2000) write$FUSE_LSEEK(r2, &(0x7f0000000080)={0x18, 0x0, 0x6, {0x100000001}}, 0x18) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) [ 3217.558498] binder_alloc: 15379: binder_alloc_buf, no vma [ 3217.604441] binder: send failed reply for transaction 785 to 15379:15380 [ 3217.628495] binder: undelivered TRANSACTION_COMPLETE [ 3217.641815] binder_release_work: 8 callbacks suppressed [ 3217.641820] binder: undelivered TRANSACTION_ERROR: 29201 18:45:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x700000000000000) [ 3217.659270] binder: 15379:15408 transaction failed 29189/-3, size 0-0 line 3035 [ 3217.728420] binder: undelivered TRANSACTION_ERROR: 29189 [ 3217.770983] device bridge_slave_0 left promiscuous mode [ 3217.776971] bridge0: port 1(bridge_slave_0) entered disabled state [ 3217.801367] binder: undelivered TRANSACTION_ERROR: 29189 18:45:40 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:40 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000a05000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x1000000000000000) 18:45:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) io_setup(0x8, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, 0x0}]) 18:45:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x1ee) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x40, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f00000000c0)=0x4000, 0x4) [ 3217.960671] binder: 15445:15447 got reply transaction with bad transaction stack, transaction 789 has target 15445:0 [ 3217.994907] binder: 15445:15447 transaction failed 29201/-71, size 0-0 line 2816 18:45:40 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000a07000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:40 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x420c40, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f0000000040)={0x2624, 0x4, 0x1, 0x0, 0x101}) write$P9_RCREATE(r1, &(0x7f00000000c0)={0x18, 0x73, 0x2, {{0x4, 0x4, 0x7}}}, 0x18) [ 3218.027638] libceph: resolve '.u [ 3218.027638] ' (ret=-3): failed [ 3218.044837] binder: BINDER_SET_CONTEXT_MGR already set [ 3218.087699] binder: 15445:15461 ioctl 40046207 0 returned -16 [ 3218.110682] binder_alloc: 15445: binder_alloc_buf, no vma [ 3218.134975] libceph: parse_ips bad ip '.u [ 3218.134975] :d]:.,[' [ 3218.142872] binder: send failed reply for transaction 789 to 15445:15447 [ 3218.154306] binder: undelivered TRANSACTION_COMPLETE [ 3218.176550] binder: undelivered TRANSACTION_ERROR: 29201 [ 3218.197209] binder: 15445:15464 transaction failed 29189/-3, size 0-0 line 3035 [ 3218.199941] binder: undelivered TRANSACTION_ERROR: 29189 [ 3218.287893] binder: undelivered TRANSACTION_ERROR: 29189 [ 3218.322882] libceph: resolve '.u [ 3218.322882] ' (ret=-3): failed [ 3218.337129] libceph: parse_ips bad ip '.u [ 3218.337129] :d]:.,[' [ 3218.368831] device hsr_slave_1 left promiscuous mode [ 3218.411161] device hsr_slave_0 left promiscuous mode [ 3218.468831] team0 (unregistering): Port device team_slave_1 removed [ 3218.484562] team0 (unregistering): Port device team_slave_0 removed [ 3218.500598] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3218.539847] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3218.631585] bond0 (unregistering): Released all slaves [ 3218.856975] device hsr_slave_1 left promiscuous mode [ 3218.908981] device hsr_slave_0 left promiscuous mode [ 3218.949151] team0 (unregistering): Port device team_slave_1 removed [ 3218.958975] team0 (unregistering): Port device team_slave_0 removed [ 3218.970883] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3219.018543] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3219.083041] bond0 (unregistering): Released all slaves 18:45:41 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) sendmsg$nl_xfrm(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="10020000120002032abd7000ffdbdf25e0000002000000000000000000000000000004d60a00ff00b0000800aa0008000197a200916bc6a1d73ec337530fa83acea02cc42ef68973207a69435a02b2a28209b9935464582f497045699014420da12f18bb82f5d823031bdb918dbf7ae081be02c8eb136cf104febb53da1aa9a219eee441eb92091ee9115117d5055dc3cba0278d9a6fa7796a156ae20d140ed7441b4dfb26c5981e4d0b68cef3904d072b08a0ee8a32e7357958ac02a31a3d04b8148c11a69f7be501120c58c93928addb802c23facd0000140103006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600600004a46b18d2f8d6e476a62bb9370bac0b2769e55511243f4d276361c08ec89a0724932960ec8a262810dfd1c5fe6782ba2a48b58fbadaccb9f2a12f8dadfa305ad7d665347b05b25f74e8c4723e4e711c5bf0d18ba43e7142b515dfcdd8b97782acad0509b33e6ccd6050000c15dbb3f705e0593d6b3393b1696377a598bd2cc1a31f2663bd4ba5e8d97c220bb14eac26f775ce2aadb31333ed08646fac5d368f41cbc6a428ffe505f2cc8d87f07b1931c2a80c984a5c370f307f4efbc727f2429654b33ccef5f583f9a0d2af21c00040003004e224e200000e00000020000000000001600000000000800180002000000"], 0x210}, 0x1, 0x0, 0x0, 0x80}, 0x2004c000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000000)={0x3, {{0xa, 0x4e22, 0x1000, @mcast1, 0x3}}}, 0x88) socket$alg(0x26, 0x5, 0x0) 18:45:41 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000307100000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:41 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x13) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:41 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4001, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:41 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000007400000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3219.235448] libceph: resolve '.u [ 3219.235448] ' (ret=-3): failed [ 3219.242266] binder: 15487:15495 got reply transaction with bad transaction stack, transaction 793 has target 15487:0 [ 3219.242280] binder: 15487:15495 transaction failed 29201/-71, size 0-0 line 2816 18:45:41 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:41 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffea3) sendmsg(r0, &(0x7f0000000100)={&(0x7f0000000000)=@l2={0x1f, 0x9, {0xf1a, 0xf9c9, 0xd4, 0x0, 0x8, 0x4}, 0x9, 0x81}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000080)="e060847e", 0x4}, {&(0x7f00000001c0)="75759479d0d1a46bd78ca7d7eb2527157776290d246ed0b0da3bfadff4a9527283e99b164fe24bc82fd81aa092e822bf3ce7613c225e93343541ee025845672c50d0d4cc03d2386bca55efac1c8be3bf4e1857906e6d0d468e0845057e35d3e5219f9120c40c17763e1873292d919c919f61bcb2ffd1abc084a9bb9d1bbcdc6725", 0x81}, {&(0x7f0000000280)="aeed69250c1fbdc7c3aa5321a5e7903190559b9d12d8aae21ba01989ab84187f8aaf6ea74be443f02b6e6945f778c4d1d2eab538215601341f41e112cccab3e5a1de2600713692f80f089aae27e5a5bd6156866f9a2f3a4c3ce51a1072418a4f612c640a49d084e4877e47677f46db30a7e3a2dbbe83817a80ee54c92dbad31a883f113b282672bd1d0634ca65074120eda5bfc35b63cf19ee13d972ce4c387a93ad5229bda02b7045a082f8ef354c23ebb0478745df0bd26f572cde56021f907f142015ccb0f0122f1e6b7308e6d795bf69aebba80491286baac69beec5bd", 0xdf}], 0x3}, 0x4000) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000380)='/dev/sequencer2\x00', 0x40000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000003c0)={0x3, 0x3, 0x0, 0x2, 0x5, 0x3, 0x7, 0x1, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000480)={r2, 0x10a7}, &(0x7f00000004c0)=0x8) accept4$packet(0xffffffffffffff9c, &(0x7f0000001980)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000019c0)=0x14, 0x80000) bind$can_raw(r1, &(0x7f0000000400)={0x1d, r3}, 0xfffffffffffffe14) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000540)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x84600000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r4, 0x703, 0x70bd28, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x1) [ 3219.281074] libceph: parse_ips bad ip '.u [ 3219.281074] :d]:.,[' [ 3219.306906] binder: BINDER_SET_CONTEXT_MGR already set [ 3219.322208] binder: 15487:15509 ioctl 40046207 0 returned -16 18:45:42 executing program 2: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x10000, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f00000000c0)={0x1000, ""/4096}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) 18:45:42 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3219.349633] binder_alloc: 15487: binder_alloc_buf, no vma [ 3219.378769] binder: 15487:15509 transaction failed 29189/-3, size 0-0 line 3035 18:45:42 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000009400000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:42 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xfffffffffffffec8) [ 3219.395125] binder: 15487:15495 got reply transaction with no transaction stack [ 3219.396976] libceph: resolve '.u [ 3219.396976] ' (ret=-3): failed [ 3219.408282] binder: release 15487:15495 transaction 793 out, still active [ 3219.417481] binder: 15487:15495 transaction failed 29201/-71, size 0-0 line 2801 [ 3219.427994] binder: undelivered TRANSACTION_COMPLETE [ 3219.439909] binder: undelivered TRANSACTION_ERROR: 29201 18:45:42 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:42 executing program 3: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x101000, 0x0) r1 = timerfd_create(0xb, 0x800) splice(r0, &(0x7f0000000040), r1, &(0x7f0000000080), 0x8, 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f00000001c0)={{0xa, 0x4, 0x5, 0x100, 'syz1\x00', 0x1000}, 0x0, [0x6, 0x400, 0x5, 0x2, 0x8, 0xfff, 0x4, 0x8, 0x9c, 0x0, 0x8001, 0x3, 0x3, 0x7e5a, 0x1ff, 0x1d, 0xcc3, 0x9, 0x1, 0x21485f41, 0x0, 0x8, 0xfffffffffffffffc, 0x0, 0x8, 0xff, 0xe84, 0x1f, 0x3f, 0x2, 0x3f8000000, 0x2, 0xfffffffffffffffc, 0x1, 0x0, 0x3, 0x1fe00000000, 0x2, 0x200, 0x80, 0x200000000000, 0x1, 0x2, 0x8, 0x9, 0xac80, 0x4, 0xa2c, 0x401, 0xdd, 0x3, 0x1, 0x0, 0x80, 0x2, 0x4, 0x80000001, 0x5172, 0x8, 0x400, 0x4, 0x1000000000, 0x1ff, 0x800, 0xfffffffffffffffc, 0x1, 0x7, 0x7c, 0x400000, 0xfffffffffffffffa, 0x9, 0x6, 0x3, 0x3, 0x6, 0x100, 0x1ff, 0x0, 0x8, 0xfa3, 0x7, 0x1, 0xfc27, 0xf3fe, 0x7, 0x80000001, 0x240, 0x100000000, 0x1ff, 0x7, 0x3571, 0x8, 0x9, 0x8001, 0x9794, 0x8, 0x6, 0x0, 0x0, 0x1000, 0xffff, 0x100000000, 0x71a9, 0x3, 0x4000000000000000, 0x3faa5b39, 0xfffffffffffffffc, 0x9, 0x1, 0x6969cccc, 0x81, 0x1bc, 0xa81, 0x3, 0x10001, 0x111, 0x80000000, 0x4841329d, 0xe000000000000, 0x2, 0x1, 0x2, 0xd73, 0xffffffffffffffe1, 0x2, 0xf602, 0x1ff, 0x7], {0x77359400}}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffec6) [ 3219.474479] binder: undelivered TRANSACTION_ERROR: 29201 [ 3219.512334] libceph: parse_ips bad ip '.u [ 3219.512334] :d]:.,[' 18:45:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3219.520365] binder: undelivered TRANSACTION_ERROR: 29189 [ 3219.539999] binder: send failed reply for transaction 793, target dead [ 3219.562277] binder: 15545:15546 got reply transaction with bad transaction stack, transaction 798 has target 15545:0 18:45:42 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3219.632932] binder: BINDER_SET_CONTEXT_MGR already set [ 3219.655053] binder: 15545:15552 ioctl 40046207 0 returned -16 [ 3219.692888] binder_alloc: 15545: binder_alloc_buf, no vma [ 3219.724414] binder: 15545:15546 got reply transaction with no transaction stack [ 3219.738337] binder: release 15545:15546 transaction 798 out, still active [ 3219.749166] binder: undelivered TRANSACTION_COMPLETE [ 3219.766238] binder: undelivered TRANSACTION_ERROR: 29201 18:45:42 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x3f860767, 0x100) ioctl$KVM_ENABLE_CAP(r0, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, [0x4a0, 0x6, 0x9, 0xfffffffffffffff8]}) openat$urandom(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom\x00', 0x210000, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$TCXONC(r0, 0x540a, 0x2e1) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) mq_unlink(&(0x7f0000000000)=',\\vboxnet0em0[\x00') ioctl$TCSBRKP(r0, 0x5425, 0x4) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="2600000003000000000000060000000000000005000000000000004950565300000000000000"], 0x26) 18:45:42 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000040)={0x7, 0x7, 0x10000, 0x43, 0x5, 0x7ff}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:42 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4800, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:42 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:42 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000050a000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3219.786441] binder: send failed reply for transaction 798, target dead 18:45:42 executing program 5: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3219.837669] libceph: resolve '.u [ 3219.837669] ' (ret=-3): failed [ 3219.844269] libceph: parse_ips bad ip '.u [ 3219.844269] :d]:.,[' [ 3219.866814] binder: 15575:15576 got reply transaction with bad transaction stack, transaction 803 has target 15575:0 18:45:42 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="a4010000", @ANYRES16=r2, @ANYBLOB="040529bd7000fddbdf250e00000014000100100001007564703a73797a3000000000a8000500080001006574680054000200080004000600000008000400000000800800030007000000080004000500000008000400ff7f000008000100050000000800010005000000080004008d0a000008000300daa9ffff08000100050000000c00020008000200be0e00001c00020008000400090000000800040009000000080001000d0000000800010075647000080001006962000008000100696200000800010075647000ac0001001400020008000100100000000800020000000000100001007564703a73797a320000000038000400200001000a004e240000000400000000000000000000000000000001060000001400020002004e20ffffffff0000000000000000180001006574683a76657468315f746f5f62726964676500100001007564703a73797a30001000000800030004000000140002000800030081000000080002000000000008000300000000801c0007000c000400cf090000000000000c000300e8000000000000000c0002000800010002000000"], 0x1a4}, 0x1, 0x0, 0x0, 0x4011}, 0x8000) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x7) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) ioctl$KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000000480)=ANY=[@ANYBLOB="0496370000000000000000000000000000000000000000000000000000000000000000000000000002000000010000000000000000000000000000000000000000000000000000fab14a6b36cd5c3e52d80447eb09d983cc609072df4137dbb29cedbfdffbebdcdecd2324fb50a41cc49f8f6910be884ca0c97ce2a1cced64a0dcfed8848e6144b792ee6f6da91ac1fd6db2682213b358026785df9d93d42562ed046d147a49a30a03e8557923598e58699a47483ad65ba6f660465415c5802d5479ad27f9d19c14ac0000000000000004c45c553f6fbb1c115548b48110e866245a"]) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000400)=0x3) 18:45:42 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x389) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x1f8) [ 3219.986887] binder: BINDER_SET_CONTEXT_MGR already set [ 3219.994523] libceph: resolve '.u [ 3219.994523] ' (ret=-3): failed 18:45:42 executing program 5: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) 18:45:42 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x3d) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000100)=r2) 18:45:42 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4801, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3220.028035] libceph: parse_ips bad ip '.u [ 3220.028035] :d]:.,[' [ 3220.044375] binder: 15575:15593 ioctl 40046207 0 returned -16 [ 3220.044445] binder_alloc: 15575: binder_alloc_buf, no vma 18:45:42 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x81000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002b0005010000000000002000010000001400000000000030a06f953f75dd9bc78a876280"], 0x28}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000001500)='/dev/rfkill\x00', 0x2, 0x0) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbff, 0x88000000}, 0xc) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r3, 0x111, 0x5, 0xf158, 0x4) fcntl$getflags(r3, 0x1) ioctl$DRM_IOCTL_GET_CAP(r3, 0xc010640c, &(0x7f0000000000)={0x100000000, 0x3}) 18:45:42 executing program 5: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3220.131191] binder: 15575:15576 got reply transaction with no transaction stack 18:45:42 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:42 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3220.222719] binder: send failed reply for transaction 803 to 15575:15576 [ 3220.280896] binder: undelivered TRANSACTION_COMPLETE 18:45:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3220.304396] libceph: resolve '.u [ 3220.304396] ' (ret=-3): failed [ 3220.358478] binder: 15621:15626 got reply transaction with bad transaction stack, transaction 808 has target 15621:0 [ 3220.398224] libceph: parse_ips bad ip '.u [ 3220.398224] :d]:.,[' [ 3220.447446] binder: BINDER_SET_CONTEXT_MGR already set [ 3220.485948] binder: 15621:15631 ioctl 40046207 0 returned -16 [ 3220.493723] binder_alloc: 15621: binder_alloc_buf, no vma [ 3220.525151] binder: 15621:15626 got reply transaction with no transaction stack 18:45:43 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000070a000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:43 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_snmp6\x00') bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) 18:45:43 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4c00, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt6_stats\x00') ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r1, 0xc0305602, &(0x7f0000000040)={0x0, 0x3, 0x201b, 0x1}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) accept$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0x41}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000240)={r3, 0x1000, "4ab1fc60d777fa9f218a3705d64438dafe8eec836582750b2ac626f81c003b6cd6c9c8b76ca723ca25d07677a070b5c2da9fbcd3b47aea40a6d3c88b1e9541a3319e56933975507f7c5acf50a216cec164689ea0dd70df3c3f2f90bb0c7ab3aa3b691994241676cefcb60c66aa3d101e089600d7924c37f8b8e31a19d12b9c92cab45db30da5e4a198f8db353972b850481598c33627e599f0d2167c287b2a35a1ea12f40c1d462323b2b53bb542f370551d660412f9daa73d0e2eb982c702a243c9b3e95282e6034b363e4b78f9f94274b321f85a121994fd0b244240168e02ab8eccf6407441038bbb6daae40db334e587521b7293afb6994de34c6dbe6a2f40276349250189ec871a01fdc7cc76c68078c222c7fecdc3140a0a5a98621dda17272c2317ddfe64a564f446ef21dd06256680b912d4d00ca468b8ca175fcf5e9395e29e8ed42bc7b97986427b21ad7cb3e2ecb1d3857abe9546ad08224ee9606f2a6a3010f45d5067af20731d464aa7236cb158d612348fb810f3ddcf10eb6f796d92b438cf15094d3d27556db1d214bd08ba3960057ef1c69f37b0d8dcc9f0a31caba4159d5a50d6d936e10ec6bdae344cee2ca4e5e69d5b991ff5687f2f4f56200805808c536b46911ad69f41229d6f12e9d67bb81ff0313607005336371e1cd3a242036b91eb9623e66bf5b07ad6a8d11aa0485b9dbc587f08b5d1bb02e99e3fe89939409d32301ef89d9d335489139b0fff5c6b1ad969ce7e2783bc1723d897c022611bc06ad7a17dd4cee9175167290a310b0892455d7e5973082d6b4b9021a87563c8a34f455f3466701a73a30f383b8a3c1736c33c23f89c7ddfeaf72eb043c329cd249b48cd4c844c5b29e8ef5baed0b3860087178da83c7458b32071ec241efffadd5a5f2e88934d84d2c60f3641462f230fbcdc15c845eaae5503b3139bf4afb084fa4b96f0d9c6a79e2e5841bd8914f4d99a806694435cc271f9184ee012431bb3e35367ffc933799d38e556f79b52b7850c4e61abec023bd3ec52ccc5f77c5f59b8e90d6b41720c877f34b497d869e80581bdad9f0ee620e51bc1bbc527be8e7ec16f0dbbbdf7c42c58060543fa9314e7db405ed77b64a0d59753c7846182426f650fa819f6217cfe8cd7f98f1a347ab0be76fce4beea5cecc2df33204aa54c0c1d00cb283d80bb6250d2e33c1a09127f3d9c29aba124db4ab4cb7282618cc504bedd3d20bf68f4a66a70f0d30ac1f79139a55227e5e76935400f1c7fc6adb1eaa5ec0bd3975d515fd987f1a536f3d00681c318f99ff31ce3655bf2d5cf1b5aebc93663584367982b09e59fc56f79296e1a41f89e1328b0070d59c372ce7d7245404aa1dab289a6699465c9a6b72578aa6bf44644ced91ee917a5780b306a68c1d24976b6189dd45091f40d0626fcfb51205820bd441d3cfd2b9ce058ac75c439db5bf38eadd5a3cf1a68afe86a0ca42cd95a8e03243c261382780e0bc487e67f2e6c5b3577bc873e44aa3c9eff1aa233a09b17a86d2d589b1b60793c9286c66646e15c67d96e65339494fad368a64309649d0980f9f982a40190ba7c755ba644af5b95c649d479645e4fda71decda69f6e8c5c65a37c80187e0230123425826169da2227f5cefebb9d6a1a4d8ace40f74824457fdcc5c99ceffa306709ff961f4ce0f77e69b966c0f29e977c11e7511e28ec2fffd623519059b92863ef3c9dc4b7e78e7deb6e5198f768089326547efa5ccdf2de4e0b3dc7da8089e8a6b202d30a9a7cda9253abe5f84de6bf3b547a249ee811bba1c7f3d703a49001b5d681f69cb748fa84ebbb6a566c59696da14f5fb942ef37ea6f469ce76949c12b86bf887f415958369dda5ef9d970a95d7c0cf2ce90174837b29073911170331b5f745a1cae07581b79b4d8d0d0f752a57b8b4824f3816b4efa5481f4505a2192f72404787258c678be25daab06d3b50f894281850e33102beaaa11b725d33cf4203c0cae16a55287207b0def78914b47afd640d766bee11252bac19ad08b64f3d7da5ef7144c83ff9827196fd2364b711b7fd4bc758c99a345041b8c6520f809d7eb0ffb660dee68cac9bc00498d3224e6ced76a090f736455a492a713e8ce41d73f23e668a1893ca06a164ecc26c0db76b9839622931bceae361140ea22b5da953f445b0140552339f2fcbda36aff7bde459c3895555b2334f3c8c319df27e7e0e78fa95b1da2c091d8db02b10f01e7a4302b7cc68528315586f10471e5a014c53edf3c454730e60c0221689e17963016b094b23d6b4c765777df75b029a4c86ab467a318822e41f2c96feaa338c42e3623fe5e07757d039fd2a853b912983cf60971ede143aacdb228efbbf4c3d3579654dda7c6bf1380dfbc966e68b424d10e151d2234ce985077854f5594a4f30a36e03ffb0195467c823d28aa294faca617602e30513cd66e1ca9626a67d7fec6af765a9b57cbb16ae9e248be315cc158a64738b18d300541621041fdc161739c81ce88472ce77e4f053c5a117e332fc0729505648ea1fdd5356f29b0d767339c2bb468318a01167874ca4cb5e606593c19a3fc84c61241c974ccea31ccad057c65da435d9b396badfe58b35b8c99b5b4e9773ac5f8a1177bdd3a7f3eea3020f48feadcc74e00e8f7d9e306c6f8a0cd6cb20d4d4bfa37f03732c2cd4ccf19974617c96ea9934f6c9e878fb1d83365644aeebea33fb85fac1addfdcc82c3636f1549e9d802052a7b5c5d26b9002b28de32cbf0708baf1fda8d35b88c6765bb5a9f5d563a10a49f1c93a4f97a9fafb636eb2f3a59b154c70d05a15de82f7edf5f36e899e63c636267c0182e61873ea3cb1f02bb257141aa53d2e5f6d1c04f7ca4702fe71f9f706e4258fc23ab128826544a77dfc69d94b0e716771fab2d48c9a54b3f46517bf1274442d950fc8ed0d0700a883bafce3e796ae04231cb9542192a3f0bf00e06943976976e0774fe1a9aefddbc89c1abff25750b1715a77f824c752c6d6d0d5d59146fc6b2ef7b6a60a00ab634d345de07a32422ead5a1a930f81babb24f45e2a1565a252bfb86e72cf600772da772c9c63510fd77639162e7354c087b193b6ac5e19102a1cf023d676478355328251d493510875f7f8e5818c258f5e35fa3aef7fb963104142e3c900a83c453c4fa5292d2e00f5d13e31dd873e46d0f2e996027d1cbacd84ab1a241161c55405a87c8800d2f19e807e9564b11fa6174e063eb30552a338e7c653a74744eb2864c0a536d09bebade4c7840b77b318b2ab6dbc732db2c69549fc9d57cf46fbcac6e76a3b7c79561ec3bba6365cf962080e2d7079af0e353c38aeffcf20472d18743a29b369a7bd8a7af04355f8d3771ac45d1ed927d747b48722625b3b20de7c173d19bff56e9a436dc9f53d1943c366a9c04d0e01e1c99ec368b87af8a34354faed30bf5e220cff1162d52953273665170040d0232e30e562abe1dfc9de9357fb6de330cdd5d6e3d210ded6e875807202fef731e312de96b664687f8e52f0b0230ab9ee6e833c8f3d261fd5527509a8dc16e8da2ff70689e0eeb17823cbed22cb26e51c0d4eca9aaa4cc7406b12c653e185c8cf2fb6a8d40a208157e2a44c552e46c120b0be25feb1ae3caf6ce13ab08c15daef38a9c63b358ec27f6ed6761c68468308f40e0cec73ccf47b5db2b585593abda051e87ae8f4ec3f80631ef99dca55418b2edc2c94a944b3f799675a1b9a7e2120a79f278fc53c18c5cb4d8ae5173e2669e7994ec9bf49f6eef58fd4c2e13eec3c34499c3f5326a6f23429fc571196a42494afe5fcab8cccea0daca3f255db468456b7a8ed6651447ec841030ef121c0433783efb23fdaa416a71c956a28d1438487ba40f5db88b6e8d783d8dda660ef717425417be0c0f767f1491e15a47134df4410d5ec47aba8ef4569f7e42008b35c3b2fde8cb3070d34cce443aeb671d333351d68e78ace133d87ee77f8e6435a6c20282c90ccffb20d7d7202725f593630ea23de774195774d5799367700314f081d399f9779775c49bdb5b768f5fe490025aedb91878df105ed1316bb3dc5b2be7343870b579a40f0a0192637a4091846edc205046afcfbfb3c749fcedc3fb501bc834d1c4759478088d3f03652d3a1541cae3e88b64ca1b635e15aabba5b7a58a58a586ffaf95d03fba631fa8482105332d9ec1e9bab4bfd212ab5183c8f8eb02c144213edb9b73d523f5bc75c000af81a8f4866d4a235df377598bca7429138f3120daebfd0b5d03caafa729de36ee1534db414e4a93bf01b449e08f2e5308301510fe74f1cc4fc067bdf0ef460e8e68a7c153128a4e6c713503c4f0ca9b291190bf13af869a50ba318507af7dd853d7efeced305256f40606e22258d193794c416b31bad617ad9b26142129df90b6eff23c380763aef8005aad8829fdb1a464ef03975de5ede5c28a36708310694d2751c17813be8e22394ec7e548e6529d8f513c0c6b2a7ac58ec77352bd4b71eedab82ce829b19d8b666fee0587ce5dca552299ab255bac7ff78eb76b3d677fbcc4120635d4c3a89c012e543fc5fc61d3f2f5f7e85635fa2d5548b364f966da0264f5394175ff67f727add2472f58279e2916948f7b0cb812b6f0c4889fb837ec5728f5150d566c2fa0a28f21c1942180381393a5f91a18349acbf46f3e44969974aaa4e7648939b8d4d098ac030b4b4107a6a2e451bccbb9de3b8ca6510403e3a5b59f1dcc3bf427c9f8bf606dbd75f0952c06abf93fc9d60897e73d6a6b1e88ba599f2fab74640b033ba45621b4145469edda07697836fbc6459599f04731e4f63a7e7c443f18c664a90ac4d4b8b62b50a91bce470edf66fa5976eddadb4a603fcd38b126c29e4f3f222ee455d13bf3c274b1a37f9f753866c2e67e656c5e602442dbb223046c0b5028f96a48989367f1fc82bcaf79d2b39e9491ce7f5781d0b013463d9826f5adf49f44a128f4b6f6cb99c6feb60978708567b037746a6d68690cff20f445281c71cc9a802d565ec244fdaff4c5a326abe903c23769e39954add6d57d60addaeb46461d7837372f985ab8cbe2c200fc0edcca8d0d6d04bbcce9fb2d0f2e751abe3137c6561b7a189215c5908b1ad798f8f178a0e93ea4ab8a24716d55f58dffca8b5278776bbe744e9dca58142077c42573c12b939d2f427dfb2a41ec91b8e5a831ca0985648b704274b54e2e02de8fd3f7e9b0b942ac0c8e1a3d974b219e02e56ddc7ccebe6e5496a2abfef3873d6f3a76534357c3e5882be5feadb9062e977693144a107c1711c25028da389710ea2e9587987d7ab1e6bab8b375967a3e9b0b016579d9b5d2f41121ec1fb16713ec837568f102ed9ae391aff881f0af5394dfe0746d3705d134c38a03b7247ba0c41fab2837d8e7ad1322d44b3383b86e3f28da3e438833cbb68c49a4bf2cb25adb2f33faab16de1239948e94fa41e22af824bcae11bd6594a3e4e37d8aa81ce787d1aff5bf660f53666fba0bda9de28707399a8099617d5f24e49eb717676f0dc199967fc2b6bb0157e8f841b2bd9e5a2f98f60b6e2f9fe87149239d0e92a95c71c3e3be715b8a676f15f814d31a69f60658ccb64a1e77b79ca2ba21e8918bea750b7d5519e63addf60eef41daa967ec4873751aaa640cd83af118bf0617313d2a5ebc28ae3b57adfc07fdcea41f78b0d64ed7a04c6d3631dd3764d481bda459a49665775254b4ff3334de5a9e457406632ba6a34c46d4288da506609b018f258cfba2c6f2d2a46432590666b5db29e7ab14"}, &(0x7f0000001280)=0x1008) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)={'team0\x00', r2}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:43 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3220.594710] binder: release 15621:15626 transaction 808 out, still active [ 3220.601721] binder: undelivered TRANSACTION_COMPLETE [ 3220.614696] binder: send failed reply for transaction 808, target dead 18:45:43 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-avx2\x00'}, 0xffffff72) socketpair(0x200000000000004, 0x1, 0xfffffffffffffffa, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000040)={0x97}) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) getpeername$netlink(r1, &(0x7f00000000c0), &(0x7f00000001c0)=0xc) r3 = syz_open_dev$usb(&(0x7f0000000200)='/dev/bus/usb/00#/00#\x00', 0x1, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000880)={0x9f0b9efb1ab3b8ea, 0x1, 0xf002, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) recvmsg$kcm(r3, &(0x7f0000000840)={&(0x7f0000000240)=@caif=@dbg, 0x80, &(0x7f00000007c0)=[{&(0x7f00000002c0)=""/116, 0x74}, {&(0x7f0000000340)=""/248, 0xf8}, {&(0x7f0000000440)=""/230, 0xe6}, {&(0x7f0000000540)=""/55, 0x37}, {&(0x7f0000000580)=""/238, 0xee}, {&(0x7f0000000680)=""/93, 0x5d}, {&(0x7f0000000700)=""/180, 0xb4}], 0x7}, 0x10002) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xff15) ioctl$SCSI_IOCTL_START_UNIT(r0, 0x5) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f00000008c0)=@generic={0x3, 0x7fffffff}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000900)={0x1000, 0x3}) [ 3220.698097] binder: 15647:15649 got reply transaction with bad transaction stack, transaction 813 has target 15647:0 18:45:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) 18:45:43 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3220.755058] libceph: resolve '.u [ 3220.755058] ' (ret=-3): failed [ 3220.766007] binder: BINDER_SET_CONTEXT_MGR already set [ 3220.810461] libceph: parse_ips bad ip '.u [ 3220.810461] :d]:.,[' 18:45:43 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x52000, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f0000000040)=""/20) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xff3a) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) 18:45:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000080)) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x880, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000880)=0x0) r3 = fcntl$getown(r0, 0x9) stat(&(0x7f0000001040)='./file0\x00', &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001100)={0x0, 0x0, 0x0}, &(0x7f0000001140)=0xc) sendmsg$netlink(r1, &(0x7f00000011c0)={&(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfd, 0x4814}, 0xc, &(0x7f0000001000)=[{&(0x7f00000001c0)={0x218, 0x3f, 0x200, 0x70bd2c, 0x25dfdbfc, "", [@nested={0x94, 0x14, [@typed={0x90, 0x96, @binary="d5a3f985db88a0eef202eff7d06c9f88c32342c0132876de1f8ab5005ef6cc85a5af2b94d94756fb202b12bc34a1ae47944f55351b59ac97cf17e55b28c5ae12c6c8f071bc4cfca6fe0784ce38885a8e1942bff774fb1fa35ba73f1172e14611c20996d6dfdc4d2683e340d97fe9fb102c5c5472a4b31aa230279c1f0fedd76feab5278282e09f4dec141541"}]}, @typed={0x14, 0x2e, @ipv6=@dev={0xfe, 0x80, [], 0x1b}}, @typed={0x8, 0x3d, @ipv4=@local}, @typed={0x8, 0x7f, @u32=0xa26}, @generic="96880fa807191fb264af22d5225c9acf8feaf6a0edb80e80310d2f80e5eccffba3fe767ba0e7d1f0792c028acad60d277f28469b06069fb6bf24b974417e71d73e99d8d0f9ca258f96ca98ba0f24df3b12b490b6268276f93c897869", @generic="e807e0782a8fe6ece0244b7f20ad8887fc9724d68b04f45550c409c7a2d04d30059879d32aec56f441dac8199920397a36dee8869067669d0460508582a7d146b6e47a195d8daa8dd1b3bd668cc880eeb8178517ba85b412cc56b5f3294e07e9664e6c31aaca4ce05a855848be282e1ce6bc2551270017fdc363ede2e84e583f0f8e98a03a5192dcc52efb9a968afac2ca09a417f204b64fce6bd12185064fb2fb942d1999b0d4688fdbdd41e5cb48508ab69deec5833101cbc7ac54b65593d7afd4ae41fd82ea422f5eee793c43c4a16b62438e58d3f48fdac049a49f5ed56c162dac7dd94c5162", @typed={0xc, 0x26, @str='aead\x00'}]}, 0x218}, {&(0x7f0000000400)={0x458, 0x12, 0x100, 0x70bd26, 0x25dfdbfb, "", [@typed={0x8, 0x39, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @typed={0xc, 0x83, @str='aead\x00'}, @nested={0x78, 0x91, [@generic="bbb971267e59698cfc30bc250b6af48877f8a28f3bac3542d111b433116d2f1a4df1cd6eb5a5e025888b57a271e2573e9c69c6de429a63c5b5ae1df7d1eef70c5779714ecefe1e82919b753c77689aff070294c0ddad3a1bd6a1dde1a74c0358a0e9806418879990a7eabb1d9533ac066d39e133"]}, @nested={0x128, 0x60, [@generic="770d387e8d127045160d638e77c487ea0b7c8c422f80a382d952a224beffda996728b502d0a23e33ba58f8091f28ccc493cf2b5bc21c4f319cb42643358b51c5e9f6f4d883906f9972d9ab09376a439c21dfdd200b4864e8bdb71af9cc1d3c0dd99a303ef5957494aa11ec8fc84e28c3f24af4d5ee01a0784ee3169cce5fefdbe77f39aec34b8e83b1da7c9082530632ef284b6f97a9f553a516759a8a42f353fc69f0233176278d598e513161bb986ac73e237dd2630bf6a42e4f2d27efa1e7efb87094b23436db3d8ecf483e314b25d5f5dd09d8b46b027fd2161e1d0dbe1f7f792060226b6a7eedd93d2ea56296051bdeb8a305192b53f0469b1409", @typed={0x18, 0xf, @str='xts-camellia-aesni\x00'}, @typed={0xc, 0xf, @u64=0x4}]}, @nested={0x294, 0x3, [@generic="c694c25c68b1d4ed39aeb9c1a4a20b40a80686f20d9f8c797e106edbc7", @typed={0x8, 0x94, @fd=r0}, @typed={0x8, 0x76, @u32=0x5}, @generic="2e615eca42f270d021dba2f58b9347ab31573d90bfa76f1c298911e9254e54", @typed={0xcc, 0x1d, @binary="cd213f63daac9974b59637b25ebf16faaffdaa5ab80ce5ef8a384ee5fb196f47dbc5ff349e3e1efda6079d78900dbfbd9ec5d6a60c765d8dc84dfd2eba1801261e7e94f2c952ccbb30ac2c978748ce82f1fca64f47bf1300fe6e340dbfe08e660488321ef8feaf8f3c2987024696771bb09bcea0ad4ffe8d71401391b0520dab2659abf950dc7b9d3d85eb7cbe3664397d2546e3e2f12f7aef7ae13e7df4330eac2e7cc392c4447a2cc3456a039d7b39dda341fc783e53b1cee1fbbd1a458c8ca4c08e2082b48947"}, @generic="1ae13592a21c01ed93898ff7440e60c47b53e9b40473cbccf9a848c4ada525e5b44d6efc12505b457864e6e9cfef56172a26d0251ef92c501de0a74dfcd4b4ba624d0e", @generic="ea7171008fd3dda941e8fd9b55b3ef7e406c44cd92b7ef27f57ceb07daf68f532429e7f2565917c9c444aa512a3efeb2343a6a501e63ec551775c021050dd7151f1f0d41ac68688a909b087f06817c453d8a2a00213ba383517466fde82cfefead7d86c30e744a1a7f1ddaffaf869b4d26c35cfa3ca030ef2dd97e59ee768a7e8a65a19e7f2ba9c42d27d3", @generic="f8ebb25c222170c077b920c5061473d13ce761997f4264db6297398164e97dbddb5b480ec0ea517c8157307701d8f8fd2f92bdebe210c8509d50bc93de1454d5754e9d1d2815e587a13655d16035f047148218dcffa2ac37108a752a7c2df28bc3a613b7ad2a38d3237ea918bccd3210cd25801e5ebc6c20cb0d428f81bb0ef8e206226e517d7a85dfec271cc479213a6d4b32d1a7a5ecc1184df1376e5bd7fbd13249afbd2e9d"]}]}, 0x458}, {&(0x7f00000008c0)={0x448, 0x32, 0x300, 0x70bd29, 0x25dfdbfc, "", [@typed={0x8, 0x5, @str='%lo\x00'}, @nested={0x248, 0x7f, [@typed={0x8, 0x36, @fd=r0}, @generic="256023cccfd258c9697dec5c93975b159409137c2ff36a3b5c55f1c5af1b3af898f59201a3e13471bee6ed2e85e7a3dad6c51980927ef2f4188c1f3cc8fa61996d7729e9bc0fe9deeec16bc22854e5a424893db73cbe8c658d233c385115788e539b9580ff194460761b18944e", @generic="f442ffdc6ec4e62663d3cfdf2e19a82b6966e80f2fec7deaa2047a66320159bfb48eb3a0a01246b4b7e0515d71b74eb015e3f3b6f8e075bf933fb1a370ad2d25ad39182c79ef699a663e33a584dd58ea4c2d78c113a4186d77076c84aabb408b4ef360b939300c40a8a394571fc3cfb958c56ac683898db8cb5fe8c0dd4f7b857f70e73464d5efd538ba59bc3e4a76fd822cede5d4721ef9d5de966248d826bc20599b8e1ded36451f81f3ad7d99a4322ab32820bedc5cd3c5edf1f944b59cb63ed580bd02c51cd8f4105a542b6e14a1d98342a044a1f23d0e97aafa3b7781fce6943a85e3f8b019ce1b9be91c17ca7022aeefdf55bbea352abb4a0fa4c7", @generic="05f8b7a170dabc1996e11ea8c226a5e556dc7e1ed3a049be9d5433c9abd78387b275a8f98169ff42d27b7b3f2bfe8951727996b16963e30573732f71c68dc4ffb2011ccbdd6716f6e91012d960f542a8c51518ce26277a24dc69b0d277691b905fe525ec4b783bec20202851ddcb0eb1ce12be76a651d84deb32", @generic="bbb1c07b34bb43fe0e6ca5f37cac39ff89e9d1b2428ed95196082329f1c7181546482fcbdbab1471fad04e2f6282", @typed={0xc, 0x53, @u64=0x1}, @typed={0x14, 0x6, @str='aegis128l-aesni\x00'}, @typed={0x8, 0x8d, @pid=r2}]}, @nested={0x1e8, 0x4e, [@generic="90c58e58e2fae5a65d0a6109", @generic="1a97ba772f80772c5e79352b1ed3bff6468b1b80f92adec054670d079c98d5e199a207c567064b9cfc6affd66efc11c7b8d6ddda1c2e2a4444fab09b31b8e26057c0ae94a3cf25cf22138f29b6543ecff10741acc544ea54e05f943201360f3edd320e7e5f67415ee984a7a183dcb44d8b4ef3bc97c97ba3d282796f151269361a3f66875329ab9c809c646fb2d1bc5b08b89e48a4ce61dfd094b4312c9bb9bda2ab5696ec5967243722e9debc7e43ebfd4757cf76a470ff9376a78dee4f2dde72", @generic="0c3ebd417be22d76ec555aa16ac8b46a726b2ef6bf459646baac6852c8d9bb480d3a3c5f373e1762d199e4be0f9c0e8385144b96214952bc3ad1842083eb2728d73108b605fff8987ef78f80e09b8b68f4c825aa5712a156eafa2f93bc337d15c4afc795fe2ae7ca0962b4aed6a9fc5cf1d51aed7580ac9f1b10ee4fd54f80d71594af272bd935367e2969fc2e735b97b1bb9a95f2d1026f7e713e74f9ac5151518d005ccee6584cd37110cc5874132d27218de6", @generic="25c0567cfd0b29a2278543a0ff2a84f72169967c6879ecbbe2c67e2834eef316fa211c34a0607c2cceba6a5b25df8296d0fd0a03cfb38bbc686f4c4eaaccfd3701ace2a5be0fdab007a2ee0d8c90f25bcd793ac868ca92f8e306e90acbf349f4eb"]}]}, 0x448}, {&(0x7f0000000d40)={0x2b0, 0x1c, 0x800, 0x70bd2a, 0x25dfdbfc, "", [@generic="e980a63c2330ede1398ed59c9b5b94c5ec24fdd0abcc546fb24da9a58d5ef783c2b21de6dfb9b4a0f3ee32c8312fa5d5", @nested={0x270, 0x7, [@generic="d69e6794c62c98abc0f23996639df1c7318a7337514ce60b0441befbdf9bded8b90f7a5684363a3f8fbaea8394e9ea8a1828e7f90f28fc20423e6785ff152c4a7b304d55c3dbedf5e4a953a96e5f397b3473be8a504317d021d21d35d4e803bf55b088e5fadb2028", @generic="d42927815fb2eb4e4b477d1ccc4f5feb26a7a229f212a5bf3b8573b497060d48e002c1091bcfb1ab382e739ebade602f310c039647d01d91e00e096270e0e371e2a831194b0db1868a6757b9a7bda8eeaeec8e9e9f99de81f7756b6da6ed43755d804e5241c1ea31fb4819c73c24800e2d343809057a0c9bee0a6d7a134dfd8a3e2c2a6759e762cfd9d9b0399f724081237c545d619df628efeb6c1d037099d6c082218d71a313fd9ed2de8f6a45a5b04933712077dc7c209480a40920dd896241e606c4b50ac2c680557dceb8361e3aca1e1f51df533ed33f0bb17ee61b71d224b97c2af0fa43c54c80aba6f757995729536bbc2a50", @generic="0bfde232e01021f38454bf185405d8b3be2f129f514348254785bf321a4c80401c4aec9b3d8ed3e4d2f8f37a7f13018d22ddbf88", @generic="a05516ef313d5d98ef7890995f115b5e3a5baf2b1b8b711dbb65062bcb065c4ceace6413e0ca35e6747e7e52dac3f2484f2b185c5809f50460790b3c6ab0f01328e93db7c28e1094fef97f1b731fca3e1e07e440abf388992ce1653af44e166655d1250d6d43f12ec223cd9c253218747179771fdb03c4d7e02a64bda7bb2b6ecf7cd788107d67392e885284cc8d75929282c247bc133711e681a5a2d9ccaaddd1f434b0694268b94942089bb598f0d2dbbe0d52191182e3a9165575af6a131b38681de5008f61d78c79185766e99030bbc64532edb5c486b2"]}]}, 0x2b0}], 0x4, &(0x7f0000001180)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}], 0x40, 0x20040000}, 0x8000) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) setsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000001200)=0xfffffffffffffffe, 0x4) [ 3220.862610] binder: 15647:15655 ioctl 40046207 0 returned -16 [ 3220.892424] binder_alloc: 15647: binder_alloc_buf, no vma 18:45:43 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3220.922703] libceph: resolve '.u [ 3220.922703] ' (ret=-3): failed [ 3220.938970] binder: 15647:15649 got reply transaction with no transaction stack [ 3220.982086] libceph: parse_ips bad ip '.u [ 3220.982086] :d]:.,[' [ 3220.999355] binder: release 15647:15649 transaction 813 out, still active [ 3221.017042] binder: undelivered TRANSACTION_COMPLETE [ 3221.051412] binder: send failed reply for transaction 813, target dead 18:45:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:44 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:44 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x220000, 0x0) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000000c0)={0x6, 0x0, 0x8000}, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080), 0x10) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x4000) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, r2, 0x9, 0x3}, 0x14) alarm(0xc746) 18:45:44 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:44 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500017fe000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:44 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_pts(0xffffffffffffffff, 0x20801) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:44 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3221.866903] binder: 15691:15692 got reply transaction with bad transaction stack, transaction 818 has target 15691:0 [ 3221.889946] binder: BINDER_SET_CONTEXT_MGR already set 18:45:44 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3221.937003] binder: 15691:15700 ioctl 40046207 0 returned -16 18:45:44 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 3221.982330] binder: 15691:15692 got reply transaction with no transaction stack 18:45:44 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400000) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, &(0x7f00000000c0)=ANY=[@ANYBLOB="060000000000000000000000000000000000000000000000000000000000000068a83643d51bd8c0f80e87eb711a1fc97c9619dc7459ce21c760ff1716b9ba84bb4c4b970babea3188ef1dce194afaae6381484f"]) [ 3222.045005] binder_transaction: 13 callbacks suppressed [ 3222.045018] binder: 15691:15692 transaction failed 29201/-71, size 0-0 line 2801 [ 3222.059794] binder: release 15691:15692 transaction 818 out, still active [ 3222.070122] binder: undelivered TRANSACTION_COMPLETE 18:45:44 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) 18:45:44 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) r2 = getpgid(0x0) tgkill(r2, r1, 0x20000002f) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(fcrypt-generic)\x00'}, 0x58) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000000c0), &(0x7f0000000100)=0x10) r3 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x4000) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xffffffffffffffe4) pkey_alloc(0x0, 0x2) [ 3222.127033] binder: send failed reply for transaction 818, target dead 18:45:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3222.245490] binder: 15730:15731 got reply transaction with bad transaction stack, transaction 822 has target 15730:0 [ 3222.306861] IPVS: ftp: loaded support on port[0] = 21 [ 3222.334305] binder: 15730:15731 transaction failed 29201/-71, size 0-0 line 2816 [ 3222.380601] binder: BINDER_SET_CONTEXT_MGR already set [ 3222.404369] binder: 15730:15741 ioctl 40046207 0 returned -16 [ 3222.419761] binder_alloc: 15730: binder_alloc_buf, no vma [ 3222.434196] binder: 15730:15741 transaction failed 29189/-3, size 0-0 line 3035 [ 3222.452656] binder: 15730:15731 got reply transaction with no transaction stack [ 3222.470500] binder: release 15730:15731 transaction 822 out, still active [ 3222.478037] binder: 15730:15731 transaction failed 29201/-71, size 0-0 line 2801 [ 3222.488957] binder: undelivered TRANSACTION_COMPLETE [ 3222.504194] binder: send failed reply for transaction 822, target dead [ 3222.548582] chnl_net:caif_netlink_parms(): no params data found [ 3222.590756] bridge0: port 1(bridge_slave_0) entered blocking state [ 3222.598017] bridge0: port 1(bridge_slave_0) entered disabled state [ 3222.605432] device bridge_slave_0 entered promiscuous mode [ 3222.612457] bridge0: port 2(bridge_slave_1) entered blocking state [ 3222.619230] bridge0: port 2(bridge_slave_1) entered disabled state [ 3222.626525] device bridge_slave_1 entered promiscuous mode [ 3222.646335] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3222.656198] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3222.673601] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3222.681979] team0: Port device team_slave_0 added [ 3222.687611] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3222.694726] team0: Port device team_slave_1 added [ 3222.699813] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3222.707213] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3222.756368] device hsr_slave_0 entered promiscuous mode [ 3222.805260] device hsr_slave_1 entered promiscuous mode [ 3222.873994] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3222.880911] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3222.892537] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3222.921610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3222.929847] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3222.938453] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3222.944548] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3222.951583] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3222.960068] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3222.966269] 8021q: adding VLAN 0 to HW filter on device team0 [ 3222.973728] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3222.980748] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3222.988783] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3222.996358] bridge0: port 1(bridge_slave_0) entered blocking state [ 3223.002667] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3223.015070] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3223.023378] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3223.030430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3223.037713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3223.045526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3223.052972] bridge0: port 2(bridge_slave_1) entered blocking state [ 3223.059318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3223.066461] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3223.075678] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3223.082552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3223.097891] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3223.104972] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3223.112576] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3223.120665] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3223.129058] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3223.136573] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3223.144126] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3223.159133] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3223.166193] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3223.173597] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3223.182552] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3223.189761] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3223.190129] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3223.208611] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3223.214836] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3223.226577] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3223.236568] 8021q: adding VLAN 0 to HW filter on device batadv0 18:45:45 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500fffff000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:45 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6800, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:45 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) 18:45:45 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x8000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000000040)={0x6, 0x6, 0x2, {}, 0x3bb, 0x7}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) dup3(r0, r0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:45 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x315900, 0x0) syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x3, 0x24000) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) getsockopt$inet_udp_int(r1, 0x11, 0x0, &(0x7f0000000100), &(0x7f0000000200)=0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:46 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3223.321838] binder: 15766:15767 got reply transaction with bad transaction stack, transaction 827 has target 15766:0 18:45:46 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x0, 0x400100) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000000c0)={0x2, r2}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) syz_genetlink_get_family_id$tipc(&(0x7f0000000000)='TIPC\x00') setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:46 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 3223.375840] device bridge_slave_1 left promiscuous mode [ 3223.381449] bridge0: port 2(bridge_slave_1) entered disabled state [ 3223.381752] binder: 15766:15767 transaction failed 29201/-71, size 0-0 line 2816 [ 3223.412188] binder: BINDER_SET_CONTEXT_MGR already set [ 3223.448428] device bridge_slave_0 left promiscuous mode [ 3223.471566] bridge0: port 1(bridge_slave_0) entered disabled state [ 3223.478338] binder: 15766:15778 ioctl 40046207 0 returned -16 [ 3223.511854] binder: release 15766:15767 transaction 827 out, still active 18:45:46 executing program 3: r0 = msgget(0x2, 0x0) msgsnd(r0, &(0x7f00000001c0)={0x0, "739bcb3b50053dfa146cb6374c1770f3795c7020aebee435578802bb9cfe5a712cd590a75a8fad5c0064c3af748bbaaaac0a37bb4a63da08808ef008063dacba2f09c8d189fad3646096a1da266a8b8dc64ff772b5e71a9c33d3dc1411b8105075e2070cf04dbb87fcefd410119e2c5c2574a4d0467bbcdbabf863dd914ea7d326b7bd5aa0f53792b9756e4a95936fc4f3507923e6f9d858a6b6976b98bce532ea35267e9e89fc9201c777f0ba6d454c5be5aa6fa6f8b6b1e4f0fd35dfd655b277b55c9f92e101"}, 0xcf, 0x800) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000000)={0x2}) msgget(0x0, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) 18:45:46 executing program 2: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000040)=[0x1]) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000100)={0x1, 0x9, 0x5, 0x4}) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$SCSI_IOCTL_DOORUNLOCK(r0, 0x5381) setsockopt$CAIFSO_REQ_PARAM(r0, 0x116, 0x80, &(0x7f00000001c0)="0262ba101474bd4b0d229749cae559eb854794100765d2a5c89318d429c527181e7bc1d2b4c74ae8397f433cb035fdd09a32df904149c2d349f3f172fa15446e574be4c2a1abcd2cde590b7bd8f6d0509098d0a97071dc7dbac5ec6e1fbab80bb82d7a9840581d749c4028256cb6bf1c0bb66d99053141c81638d82c79f23b87ee6b27d175a3121cb968f2d22b1b9d1e7f56a60e4180e7b50e00a4effb47ff8454ad7cd57cdbd054d69da87739e688", 0xaf) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{}, {}]}) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f0000000500)={0x1, 0x4, 0x3, 0x7, 0x4}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8404}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x148, r2, 0x6, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xed}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x25}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3f6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_BEARER={0xe8, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xbfa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x2, @loopback, 0x401}}, {0x14, 0x2, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @empty}}, {0x14, 0x2, @in={0x2, 0x4e21, @loopback}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xb6c}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x800, @mcast1, 0xf1}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x2, @remote, 0x200}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x8010}, 0x4000000) 18:45:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3223.520581] binder: undelivered TRANSACTION_COMPLETE [ 3223.531891] binder_release_work: 17 callbacks suppressed [ 3223.531896] binder: undelivered TRANSACTION_ERROR: 29201 [ 3223.538011] binder: send failed reply for transaction 827, target dead 18:45:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:46 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6c00, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:46 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000001000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:46 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='rdma.current\x00', 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) r2 = geteuid() setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@multicast2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x8, 0x4e22, 0x0, 0xff57c373a22bc58a, 0x20, 0x20, 0x3b, r1, r2}, {0x2, 0x784, 0x2, 0x2, 0xc3c, 0xfffffffffffffffd, 0xffffffff, 0x9}, {0x9de9, 0x9, 0x7, 0x5}, 0x8, 0x6e6bbb, 0x3, 0x0, 0x1, 0x2}, {{@in6=@mcast2, 0x4d4, 0x6c}, 0xa, @in=@rand_addr=0x7, 0x3505, 0x6, 0x1, 0x9, 0x80000000, 0x10001, 0x1}}, 0xe8) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) 18:45:46 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x400000, 0x0) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000100)=0x3, 0x4) [ 3223.667266] binder: 15803:15807 got reply transaction with bad transaction stack, transaction 830 has target 15803:0 [ 3223.680356] binder: BINDER_SET_CONTEXT_MGR already set [ 3223.695048] binder: 15803:15807 transaction failed 29201/-71, size 0-0 line 2816 [ 3223.702616] binder: 15808:15809 ioctl 40046207 0 returned -16 [ 3223.745876] binder: release 15803:15807 transaction 830 out, still active [ 3223.758815] binder: undelivered TRANSACTION_COMPLETE 18:45:46 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000e07f01000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:46 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw-cast6-avx\x00'}, 0xfffffffffffffe27) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) arch_prctl$ARCH_SET_GS(0x1001, 0x7fa3) 18:45:46 executing program 5 (fault-call:2 fault-nth:0): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3223.791876] binder: undelivered TRANSACTION_ERROR: 29201 [ 3223.815628] binder: 15808:15809 got reply transaction with bad transaction stack, transaction 832 has target 15803:0 [ 3223.828108] binder: send failed reply for transaction 830, target dead 18:45:46 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x6, 0x9}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000000c0)={r1, 0x3d8, 0x12, 0x1, 0x8d, 0x6}, &(0x7f0000000100)=0x14) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) 18:45:46 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000008201000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3223.891999] binder: send failed reply for transaction 832 to 15808:15809 [ 3223.923836] binder: 15808:15809 transaction failed 29201/-71, size 0-0 line 2816 [ 3223.935592] device hsr_slave_1 left promiscuous mode 18:45:46 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:46 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)='\x00', 0xffffffffffffffff}, 0x30) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x80, 0x0) ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000000c0)=r3) r4 = creat(&(0x7f0000000240)='./file0\x00', 0x3) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000280)={r0, r4}) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x2, r1}) accept4$alg(r0, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) ioctl(r2, 0x8, &(0x7f00000002c0)="3418f4144500fe0c3cf6d76e0cbfc85c068fed988de192dc69c05a0b12c3f53b91bc6ebf0e22aa1ca9b768aebef7112fb3d86905e971d335d0696376728d324b57709e6fccc2c0db7313f4907d9dfaee902d2c532b92ef4480775db087fd21958e9b1574e2ae6fab0dcce73ffc794fef4517") [ 3224.002432] device hsr_slave_0 left promiscuous mode [ 3224.014756] binder: release 15808:15850 transaction 835 out, still active [ 3224.024233] binder: undelivered TRANSACTION_COMPLETE 18:45:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3224.069162] team0 (unregistering): Port device team_slave_1 removed [ 3224.083582] binder: send failed reply for transaction 835, target dead [ 3224.117692] binder: undelivered TRANSACTION_COMPLETE [ 3224.121778] binder: 15861:15862 got reply transaction with bad transaction stack, transaction 837 has target 15861:0 [ 3224.131903] binder: undelivered TRANSACTION_ERROR: 29189 [ 3224.147980] binder: undelivered TRANSACTION_ERROR: 29201 [ 3224.154640] team0 (unregistering): Port device team_slave_0 removed [ 3224.222779] binder: 15861:15862 transaction failed 29201/-71, size 0-0 line 2816 [ 3224.240564] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3224.282476] binder: BINDER_SET_CONTEXT_MGR already set [ 3224.288460] binder: 15861:15870 ioctl 40046207 0 returned -16 [ 3224.314866] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3224.322140] binder_alloc: 15861: binder_alloc_buf, no vma [ 3224.334729] binder: 15861:15870 transaction failed 29189/-3, size 0-0 line 3035 [ 3224.347372] binder: 15861:15862 got reply transaction with no transaction stack [ 3224.355170] binder: release 15861:15862 transaction 837 out, still active [ 3224.362107] binder: undelivered TRANSACTION_COMPLETE [ 3224.367630] binder: 15861:15862 transaction failed 29201/-71, size 0-0 line 2801 [ 3224.384285] binder: undelivered TRANSACTION_ERROR: 29201 [ 3224.406873] binder: undelivered TRANSACTION_ERROR: 29201 [ 3224.412333] binder: undelivered TRANSACTION_ERROR: 29189 [ 3224.446692] binder: send failed reply for transaction 837, target dead [ 3224.471538] bond0 (unregistering): Released all slaves 18:45:47 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6e03, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:47 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x12000, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0xfffffed5) 18:45:47 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x7) 18:45:47 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffc45) 18:45:47 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000002000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:47 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000edc0000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:47 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3224.605794] binder: 15879:15880 got reply transaction with bad transaction stack, transaction 842 has target 15879:0 18:45:47 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) ioctl$KVM_ARM_SET_DEVICE_ADDR(r1, 0x4010aeab, &(0x7f0000000040)={0x8, 0x2}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:47 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0xffffffb3) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3224.711855] binder: BINDER_SET_CONTEXT_MGR already set 18:45:47 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000060ff000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:47 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000040)=0x200, 0x8) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:47 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7400, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3224.785492] binder: 15879:15901 ioctl 40046207 0 returned -16 [ 3224.823429] binder_alloc: 15879: binder_alloc_buf, no vma 18:45:47 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xfffffffffffffe95) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/autofs\x00', 0x200101c7c, 0x0) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) setsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f00000000c0)={@mcast2, r2}, 0x14) sched_yield() setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000200)={0x22c, r3, 0x2, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x20, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5b}]}, @TIPC_NLA_BEARER={0x118, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x20, @rand_addr="06381c98906637320095e78503ac4362", 0x400}}, {0x14, 0x2, @in={0x2, 0x4e23, @rand_addr=0x1}}}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'syzkaller0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x44}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffffffffffffd}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2b}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xfff, @mcast2, 0x20}}}}]}, @TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9e1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xf2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x43b38f74}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xf8b}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}]}, @TIPC_NLA_NET={0x1c, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3fa5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9d}]}, @TIPC_NLA_NODE={0x20, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xeed}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x44, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1000000000000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xbaa}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xcda}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xf2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x22c}, 0x1, 0x0, 0x0, 0x800}, 0x40000) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) 18:45:47 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x20, 0x200) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000040)={@mcast2, 0x0}, &(0x7f0000000080)=0x14) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f00000000c0)={@loopback, r2}, 0x14) 18:45:47 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:47 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000f0ffff000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3224.868290] binder: release 15879:15880 transaction 842 out, still active [ 3224.885403] binder: undelivered TRANSACTION_COMPLETE [ 3224.890632] binder: undelivered TRANSACTION_ERROR: 29201 18:45:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3224.984482] binder: undelivered TRANSACTION_ERROR: 29189 [ 3225.003233] binder: send failed reply for transaction 842, target dead 18:45:47 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = dup(r0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x8}}, 0x4, 0x100000001}, &(0x7f0000000040)=0x90) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000001c0)={r2, 0x8}, &(0x7f0000000200)=0x18) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x2d0004, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r3, 0x29, 0x2d, &(0x7f0000000080)={0xfffffffffffffff7, {{0xa, 0x4e21, 0xff, @ipv4={[], [], @local}, 0x7}}}, 0x88) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) syslog(0x10, &(0x7f0000000540)=""/117, 0x75) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x8, 0x40000000000000, 0x240000000000000, 0x9, 0x20000000000000, 0xffffffffffffff9c, 0xffffffff}, 0x2c) r4 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x20, 0x20000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f00000006c0)=0x2, 0x0, 0x2, &(0x7f00000004c0)={0x0, 0x989680}, 0x0, 0x0) epoll_wait(0xffffffffffffffff, 0x0, 0x0, 0x3) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000d00)=ANY=[@ANYBLOB="080000000000000002004e217f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000400000002004e240000000800000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000001000000000000000000000000000000000000000000e9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d1071e47ab86b3d7c5c100000000000000000000000000000000000000000003000000000000000002004e237f0000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002ea6d443eaad0f0000c34c0d18a188ca298a6fbe47f61734cc759dd4a26b596291a39a7435ded1ec664defb102da5844ffe8e651184880fae713813fbe9986044ec747194b06a3e710f532685166df9276e1607a318f0d6a04a86d15dd361bd94f0aa5096f363ff718abf8c1547d6f74fe8a8df31f9ad75d1ce28e611b17fa2d0121aa774c2e35fcbc85bf90d391d0e10fc4b3cbc62310025f03d0645f2be634edaace6766f617fe2596be43775b2a52d92c49e1a12dadeaa7702671eebd71ae1941b6b9810dda24e8533902640000000000000000"], 0x1) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) bind$can_raw(r5, &(0x7f0000000140), 0x10) setsockopt(r5, 0x65, 0x1, &(0x7f0000000700)="3b3561ac00814a4548c78d250bdd795fd74ffc69a3565b45f64e53148f3f1ba2f9ef4cd9bc9accca5a9e66aa66083c540e1c390ef3733d2d4aa8d18ac54b2a11459a84cd69778e626bf2180598cf27123f9e627bf4e0467e04f91dd4c9824be1fec0ce58dd168688e6c45a2d8381f4c9a4dfa0fdbb9c9f9e0ffe482aabc46830685fd52c4413cd4d9929999530dec36e01bfcd34099fbe33339b575ff07af0ec8c1a3c4470c103362070b6230923b6a576f83bd964cdafeaeec9e341d82f90054773b4bb1886feeab2b03ec217b9c7e1caba03da6c718f16cbf30431abe8bb25295fb02cdf4fe3a04f89cf9cc5152d48d92b3f8c9e53beb90474488822da8c6ff25760c06fa435f9d0854024945f872c2d61c78c2db8a5d40e8acbd8c00e008aa50d36c09ac673fb47850a7bf8c3394a2e8112c10c10b5c9a7ee6d364ca52a1e1422e433bb020f2e74eb600033d1af7f5e2bd98ba21417e6daa73284c958ac353dc9add51e9b3ce7558cd3f47417d148444ac3a4012a393f87f3edfe83a68f9c5c80fa3e3605150e199f0443b908f11934f96745dcdf9079b275908bdfa7f470c6583c2f17d00f865afa83a0161d65624de63dfa09e359e1eb0000000100000000b8726651fba34a330eb4d117571008a9634576a1d3e245355788c524a072e1dd361370769a3250291fbb1c0015bbe190d93320e4cf2bfe640f9082a4a33524291403c723ff866b37e651eb32b16803511b5e4ca7afa48ff5dba1559deb21413bee6d818b648d60e299d9ef9e39846d771f4eb6e2fbefac6290fc2cbb1af648451675a870b77b956db74420005e9393520c971741bb4529", 0x258) fgetxattr(0xffffffffffffffff, 0x0, &(0x7f0000000280)=""/214, 0x484) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f00000003c0)={'icmp6\x00'}, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f0000000040)={0x0, 0x0, r6}) close(r5) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e24, @empty}]}, &(0x7f0000000200)=0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000380)={r7}, &(0x7f0000000480)=0x8) ioctl$KVM_GET_PIT2(r4, 0x8070ae9f, &(0x7f0000000400)) 18:45:47 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='\\md5sumnodevvboxnet1&proc!em0selinuxself^-\x00') [ 3225.029341] binder: 15952:15953 got reply transaction with bad transaction stack, transaction 846 has target 15952:0 18:45:47 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="47dcb8bf8e1739afc6cb6be22cff7cf759feb838a50c709b41675190c36c598b71ec70f573a9849234a2956ed870f5a3e368342d335f42508b2889c3b55cdf1780899f515f758dafdcc8899870c8c09c99dee783c0e4814d6d5d3c7adff307af680a1a83d37fa4877024b53776c366bd3fb87269c047a7b6a69d711c76aba8b9", 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x242}, 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="88030000", @ANYRES16=r2, @ANYBLOB="01002abd7000fbdbdf250f0000004c0004002c000700080004008100000008000400fbffffff080001000d00000008000400010000000800020080080000f81f070008000300010400000800030008000000080001000000000014000500080001007564700008000100756470002001010008000300060000001800010069623a76657468305f746f5f7465616d00000000180001006574683a76657468315f746f5f6272696467650038000400200001000a004e230000000900000000000000000000000000000000070000001400020002004e217f00000100000000000000000c000200080002000400000044000400200001000a004e2300000004ff01000000000000000000000000000103000000200002000a004e2100000e3eff020000000000000000000000000001030000000c0002000800030002000000080003000600000004000a0044000400200001000a004e2000000005ff02000000000000000000000000000100000000200002000a004e2400000004fe8000000000000000000000000000bbf8ffffff38000100100001007564703a73797a3200000000240002000800020006000000080003000300000008000300ffffff7f08000300fffbffff90000500140002000800040002000000080001001c0000000800010069620000540002000800040000000080080003004300000008000100070000000800030007000000080003000400000008000100190000000800040000020000080004000300000008000200090000000800030069050000080001006962000008000100756470000c00020008000300040000002c0009000800010002000000080001000500000008000200030000000800010005000000080001000700000048000100100001007564703a73797a32000000002400020008000400ff00000008000400e0040000080003002700000008000400ff010000100001006574683a73797a5f74756e00300007000c0003002a0000000000000008000200050000000c00040000000000000000000c0003002a0182030000000058000100100001007564703a73797a300000000044000400200001000a004e23000000ff0000000000000000000000000000000100000000200002000a004e2300000001fe88000000000000000000000000000104000000300007000c000400090000000000000008000100000000000c00040001040000000000000c0004000500000000000000606a50f5b3756bf6770afe777a137fad2813b847"], 0x388}, 0x1, 0x0, 0x0, 0x40844}, 0x4048880) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:45:47 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000004000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:47 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7a00, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3225.183605] binder: BINDER_SET_CONTEXT_MGR already set 18:45:47 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x2eba) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) socket$tipc(0x1e, 0x7, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x6000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000040)={0x2, 0x3, 0xc3de, 0x5, 'syz0\x00', 0xb3c2}) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x4dbd) 18:45:47 executing program 5: r0 = semget(0x1, 0x7, 0x40) semctl$SEM_STAT(r0, 0x3, 0x12, &(0x7f0000000100)=""/42) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000080)) ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000040)) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f00000000c0)) [ 3225.277291] binder: 15952:15966 ioctl 40046207 0 returned -16 [ 3225.277382] binder: release 15952:15953 transaction 846 out, still active [ 3225.337178] binder: undelivered TRANSACTION_COMPLETE 18:45:48 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:48 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) accept4(r0, &(0x7f0000000000)=@alg, &(0x7f0000000080)=0x80, 0x800) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x200000, 0x0) r2 = accept$alg(r1, 0x0, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) dup2(r2, r2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3225.371171] binder: undelivered TRANSACTION_ERROR: 29201 [ 3225.404178] binder: send failed reply for transaction 846, target dead 18:45:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:48 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500ffffffffff6000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:48 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x8000, 0x0) ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000080)=""/15) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) finit_module(r0, &(0x7f0000000000)='aegis128l-aesni\x00', 0x2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3225.540628] binder: 15993:15995 got reply transaction with bad transaction stack, transaction 849 has target 15993:0 [ 3225.652093] QAT: Invalid ioctl [ 3225.670107] binder: BINDER_SET_CONTEXT_MGR already set [ 3225.676690] binder: 15993:16005 ioctl 40046207 0 returned -16 [ 3225.682961] binder_alloc: 15993: binder_alloc_buf, no vma [ 3225.694152] QAT: Invalid ioctl [ 3225.700283] binder: 15993:15995 got reply transaction with no transaction stack [ 3225.774860] binder: send failed reply for transaction 849 to 15993:15995 [ 3225.793593] binder: undelivered TRANSACTION_COMPLETE 18:45:49 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f00000000c0), 0x4) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000040)={0x10000000, 0x1, 0x29}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:49 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = semget$private(0x0, 0x4, 0x1) semctl$GETPID(r1, 0x0, 0xb, &(0x7f00000021c0)=""/4096) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000000)={0x10001, 0x3, 0x9066, 0x90}, 0x8) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x7ebb06170d8f3ee7) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:49 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000007400000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:49 executing program 3: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x1, 0x0) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f00000000c0)=0x3) read$eventfd(r0, &(0x7f0000000400), 0xfffffffffffffde9) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000100), 0x4) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) rt_sigtimedwait(&(0x7f00000001c0)={0x4}, &(0x7f0000000200), &(0x7f0000000280)={0x0, 0x1c9c380}, 0x8) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x32b) rt_sigprocmask(0x2, &(0x7f0000000000)={0x7}, &(0x7f0000000040), 0x8) 18:45:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:49 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x9d03, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:49 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$video(&(0x7f0000000480)='/dev/video#\x00', 0x100000007fffffff, 0x0) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000240)={0x0, 0x7, 0x2, {0x1, @pix={0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}}) pipe2(&(0x7f0000000340)={0xffffffffffffffff}, 0x80000) ioctl$DRM_IOCTL_AGP_ENABLE(r2, 0x40086432, &(0x7f0000000380)=0x1ff) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x101001, 0x0) recvmsg$kcm(r3, &(0x7f0000000100)={&(0x7f0000000040)=@sco, 0x80, &(0x7f00000000c0)=[{&(0x7f00000001c0)=""/137, 0x89}], 0x1, &(0x7f0000000280)=""/78, 0x4e}, 0x2003) [ 3226.587975] binder: 16025:16026 got reply transaction with bad transaction stack, transaction 854 has target 16025:0 18:45:49 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:49 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500ffefffffff7f00000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:49 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7, 0x8000) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x0, 0x70bd29, 0x25dfdbfb, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0xffffffffffff9587, 0x200, 0x9, 0x800}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000000) [ 3226.697621] binder: BINDER_SET_CONTEXT_MGR already set 18:45:49 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x6, 0x4000) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:49 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x5) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x8000, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) [ 3226.766753] binder: 16025:16041 ioctl 40046207 0 returned -16 18:45:49 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x0, 0xfffffffffffffffd) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) ioctl$sock_SIOCBRDELBR(r4, 0x89a1, &(0x7f0000000040)='syzkaller1\x00') setsockopt$inet_tcp_int(r4, 0x6, 0x4000000000014, &(0x7f00000000c0)=0x80400000001, 0x240) setsockopt$inet_tcp_int(r4, 0x6, 0x1, &(0x7f0000000000)=0x1, 0x4) connect$inet(r4, &(0x7f0000000200)={0x2, 0x0, @remote}, 0x10) sendto$inet(r4, &(0x7f0000000100), 0xffffffffffffff1f, 0x0, 0x0, 0x548f) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, 0x0, 0x0) close(r4) dup3(r2, r3, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3226.818114] binder_alloc: 16025: binder_alloc_buf, no vma 18:45:49 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x100, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000000, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(&(0x7f00000001c0)=ANY=[@ANYBLOB="5d13a30d7b7e8871322d2711962233c840d2491b5b43249f62227d5c728c701aca09a37aac24858760a1129d9258c2d8aa55420837af63f464c200c814081df9e3c1635b400598676236291cebf067e0dee6e8d3b5e8e07ad3579e416c5c8108a39083474f2d360ec710d5fa72dc9ee8146d46177c1c4afacc42f8c9839c0d46d4a8ca015e89d2a6fe7f9fab1a49ee4a6da3254d239fe06927b9b2113b57db01416fb10b46dc1ad74577fda9d4ea9d652af3758737060439df017fd56b4c95315a2e3abe90d1bef2acd587fc5fac7122e8a174b902e81dfc5a875797440ed89d72b478a93e24afe5e447787876903ad212472a95b82d551bc2e7c74e1fcb7d051e63505406940f182124f9ae4d9415d5a2d13f13d9cd3606a9a96a2757979bc69b04947ca4095870e7358112b9e1ddc1457271c90e41495bc4963436c38797b1a14f6fb5a7b01eecfadcef892f48b6171895e88ce2b86eac06e256a909a4a037ca48181ee7af307b2359aa37d920534ac4608897d9f7ebf598db96469e82fa0f6ef5b577f587a8251cdb5dfaec7ff4956779246414ae8a4d75e54b356ac44352bb4e33331c896a5130f6db802e43add58802825fe4e9d3f45d6e8e590d814ed9614d5fc8b3f097a22c45b161e33bc0c4aab7418e75a3450e9d6bf40636a0e5fa10d51044ac634f520edb0f558d3b500a9c40dce49e62277177460e027696013a41a275cf549fd2327190828968d4961279ad2128a9f63545b7534539f4140b8eecc4c08fb127e651c7e16b7e29aea6224583bfc29f9a5af2d20d25cecedfe57ebb9780215c6f29bddc61cd1390a71e75ce0cd1f31bafe369a8ed6ca324fe28142bbca2630b6b29a1d92df3edcc3c6de009146473610c4f929ea1b61cc44a3b1e5468da34bc5e7e4c97ab79299f605ba464b0fded26597c0ce71ca371030a78d757cad5656aac16ec839e023625d1a42239a321e81bfc033da8cf3847ddaf4c51660b49d18d1bf89b0533690135ac6a6247a865dbe5feeb63e4250e34fef181956c74b9a0184749448e3c160e4f24ea529d362334e48dcc760cc1ec4aad683d917a4e4c23c0b83a6de975efe3ed14fc2c2db629acd558d8b134f166eed5fe06f141b46bb1fa67e8e21a3f4fa4e56537f32f617ec378cf2440d91f79b08c024c19d7be2cfee74e803f3a4a859b5f09b2f8c6e52c384fb28aeba5a4afecde0eac3cd91e60d7882ac7058da29cb93739d3cbe66bd07c314171d24a43544b84680209e59e90087cba7c37c71fb370fea20b8190c631e87505ba42e2cce13db03612fcf4d365a59e444576e9d7a6d2baba21916c4057b81dd8581ccfda480bdbc6086f6a51c209984c7827975306116731fa11b1eea322c9791190769b7a088330bbd957fd1f5b638d23073f4120fbb4f287e80f91d8ce4fa294bf29d97181d39376a6a1d06940bd4edefc6de7411b8e5a3ec694fcae310d94ac98db77cefd653bee5d7a8c7fdd9c6dfa05f7e5524a2996c2b0a98342e0543f76864d0f458545ca5f47c940a62b26c722321ce87407ecdc0ce95ab4a2ca600fc0f785494dfc316043f39a3bb581d721e5fc7c272e18c1752125eafa4709cebe707f58d3db90ce43c7c08fa7fa81a4179239b4b5c27efa2b8b488ca56130a3d7ad4e44eded824fe420c71811e88e579ec297a4afdf72e4cfabe008c5c7815481aeee64557acad0e3ce4d4e0fa36223467a324ac2c7154849a61283cec42415e8de16c94d70ca5ba34f4f798b225f8147c5a83bf0c41969dfd51f8955ea46b4df9a0b24e2b323062dcadfb3e4f6427b658f185d2c10975277b5b049c3b9853cc18c87cba52f1ecadbaca4d1ddce3b4c052fb1cc457804a9cf9e3605df6864db87d1df2a061a503cab2c2f2463245b289e8405c2641e95a9301dfd7eec748ab8f33e2ef30933216f296e8737a6d863829b7ca96d752c3a102e8d71aac4e78bdab0d219ede3150417c76663da55ab4171b7a08bbea778c1f60536f7220e6a7351c8586c582d654e8046456307b9a3487e2317e899c9884d8b01dce6ad45493740e28a673b549cbe81900c84ff699c50ac1c863c90010fb204a4aeb5b81e8cd5a39518c4769f0e4c7d4b528bb114d741df921fa6367cbd6f6c6724e015ab7398653b8aa7741d2d75507cdbc9f3effa888bf95683e3cab56edd27be371f0a9c131bd3825ef3a637ec5d5be720010ccd52d1b5e923dbd2b7974fc5ec5d92750097b45d96a64d464efc3564a9f633253accf2ff8f10214a01ce43c3933bc0fd3174fdbd5daedf34e5f12920d6becee72c31d997f0ac163524c17caeef0283e5d8e5f72f3358213c729176ff8b07fe2aa184f8d5b5cafe402d3f9ada770fe61d36ff81e73dee9a032dbd8b564dff37c839913a73fa7454cd34512a8d2f9f17aa8304583f1b9c31e6c5baaecff5772163c6215825df078f6a6d5d33a2b6f67f46736b0f1c9bdf0f6c92ddf5cc643e5cb3a030ed36cfcc7a381e08780893de3112447b188ce1639324ff0c548d2f3df2fd39cb3628d32f5754901144fc5de48ebb704e0a39e8bbd95e958651ac740c46c36cc0599606cd21babb7f35046e6aefc530e23ab0cbb2704b9d123a9f1465e8b5d481df7a06d1961160b8db0a84324b1d6cee"], 0x0, 0x0, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r2, 0x0) r3 = getpgrp(0x0) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, &(0x7f0000000200)={'ip6gre0\x00', 0xd5ac}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000002a40)={{{@in6=@mcast2, @in6=@loopback}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000002980)=0xe8) getpgrp(r3) ioctl$KVM_DIRTY_TLB(0xffffffffffffffff, 0x4010aeaa, &(0x7f0000000c80)={0x5}) gettid() ioctl$BLKROGET(r2, 0x125e, &(0x7f0000000cc0)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000029c0)) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000480)=@proc={0x10, 0x0, 0x25dfdbfb, 0x400}, 0xc, &(0x7f00000044c0)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="9a974a2aaa6c7d641bb8c816cda430917ef7bec63659ee1e5a74285bc138"], 0x1}], 0x1, 0x0, 0x0, 0x100000}, 0x7fd) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000980)='/dev/sequencer\x00', 0xfffd, 0x0) getsockname$unix(r4, &(0x7f00000009c0)=@abs, &(0x7f0000000a40)=0x6e) write$binfmt_misc(r2, &(0x7f0000000440)={'syz1'}, 0x1200e) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000c40)={0x5c, 0x0, &(0x7f0000000b00)=[@increfs, @clear_death={0x400c630f, 0x2, 0x1}, @reply={0x40406301, {0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x30, 0x20, &(0x7f0000000a80)=[@fd, @fd={0x66642a85, 0x0, r1, 0x0, 0x2}], &(0x7f0000000ac0)=[0x18, 0x38, 0x20, 0x0]}}], 0xbd, 0x0, &(0x7f0000000b80)="34cbb9eb53d4d20aaf6f3294c75f03d2f9746ac51400da53fe4dbdf0009175b24e32c995e876a959ef690a32052d32027d67ac59db1e9ff812dc800b5beac4edf783c8fbb587571e33ce443a50c2f2482cb367287c8eb5de2e911a3ab5160343f30c5fa907c3d3a7a232388c48fb02eced132ba0d4a4ecc9937b55793f7dddf18ef2b5793d2ad18d252b2c762cc821953bdbc8c03b77e0794c052ed684802f7dd73fa808906a4f19a537f4a249bd1f3aecd4af63706815e2a5b5d1c80c"}) openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_ifreq(r5, 0x8991, &(0x7f0000000040)={'bond0\x00', @ifru_names='bond_slave_1\x00'}) r6 = syz_open_dev$usbmon(&(0x7f00000012c0)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r6, 0x9204, 0x8001) getsockopt$inet6_int(r6, 0x29, 0x5f, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 3226.859429] binder: release 16025:16026 transaction 854 out, still active [ 3226.871483] binder: undelivered TRANSACTION_COMPLETE [ 3226.897755] binder: send failed reply for transaction 854, target dead 18:45:49 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) munlockall() r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000000000)={'bridge0\x00\x00\x00@\x00\x00\x00\x00\x01', &(0x7f00000000c0)=@ethtool_ringparam={0xe}}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3227.029655] binder: 16072:16074 got reply transaction with bad transaction stack, transaction 858 has target 16072:0 [ 3227.069512] binder_transaction: 8 callbacks suppressed 18:45:49 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x800) ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x41) [ 3227.069525] binder: 16072:16074 transaction failed 29201/-71, size 0-0 line 2816 [ 3227.129872] binder: BINDER_SET_CONTEXT_MGR already set [ 3227.167007] binder: 16072:16080 ioctl 40046207 0 returned -16 [ 3227.181990] binder_alloc: 16072: binder_alloc_buf, no vma 18:45:49 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xb902, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:49 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3227.218361] binder: 16072:16080 transaction failed 29189/-3, size 0-0 line 3035 [ 3227.249896] binder: 16072:16074 got reply transaction with no transaction stack 18:45:50 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3227.378231] binder: 16072:16074 transaction failed 29201/-71, size 0-0 line 2801 [ 3227.391783] binder: send failed reply for transaction 858 to 16072:16074 [ 3227.443478] binder: undelivered TRANSACTION_COMPLETE [ 3227.698867] bond0: Releasing backup interface bond_slave_1 18:45:51 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000f0ffffff7f00000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:51 executing program 2: getsockname(0xffffffffffffff9c, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f00000001c0)=0x80) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000000200)={0x0, 0x7, 0x100000001, 0x3}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000280)={r1, 0xff}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) prctl$PR_SET_DUMPABLE(0x4, 0x2) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) ioctl$VIDIOC_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000000)={0x7a5, 0x0, [], {0x0, @reserved}}) 18:45:51 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x1f, 0x602c40) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000040)=0x33f4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) 18:45:51 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = msgget(0x1, 0x40) msgctl$IPC_RMID(r1, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x4002, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r2, 0x40106410, &(0x7f00000000c0)={0x72, &(0x7f0000000040)="694014600464e2c5dfe13bdd87ced1d71374dbe7342d4bc6b0dbf0b2e1ecd90fe2d3c854ec0e31b5a45839a675ec5ef8a5566339694fd185dbeadfab285ebfc146c46c2920c63c6cad7d0c0e621f9c13016832b6fbd0a85c61d52b2a0f96fa40bce024a8d52b44f92b0cdfe81f0f4bf4a110"}) 18:45:51 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = semget(0x2, 0x2, 0x2) semctl$GETNCNT(r1, 0x2, 0xe, &(0x7f0000000000)=""/33) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xb37befeeffd83805) 18:45:51 executing program 3: r0 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000000)='vcan0\x00') r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) 18:45:51 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x482) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x200480, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x100b}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r2, 0x1}}, 0x10) truncate(&(0x7f0000000100)='./file0\x00', 0x36) [ 3229.049944] binder: 16103:16112 got reply transaction with bad transaction stack, transaction 863 has target 16103:0 [ 3229.118388] binder: 16103:16112 transaction failed 29201/-71, size 0-0 line 2816 18:45:51 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x78) [ 3229.196204] binder: BINDER_SET_CONTEXT_MGR already set [ 3229.213888] binder: 16103:16128 ioctl 40046207 0 returned -16 [ 3229.228047] binder_alloc: 16103: binder_alloc_buf, no vma [ 3229.242255] binder: 16103:16128 transaction failed 29189/-3, size 0-0 line 3035 [ 3229.247749] IPVS: ftp: loaded support on port[0] = 21 [ 3229.258350] binder: 16103:16112 got reply transaction with no transaction stack [ 3229.287048] binder: release 16103:16112 transaction 863 out, still active [ 3229.294209] binder: undelivered TRANSACTION_COMPLETE [ 3229.299768] binder: 16103:16112 transaction failed 29201/-71, size 0-0 line 2801 18:45:52 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xd701, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:52 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) sigaltstack(&(0x7f0000ffc000/0x3000)=nil, &(0x7f0000000000)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:52 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) pread64(r0, &(0x7f00000001c0)=""/4096, 0x1000, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3229.332382] binder_release_work: 10 callbacks suppressed [ 3229.332387] binder: undelivered TRANSACTION_ERROR: 29201 [ 3229.356201] binder: undelivered TRANSACTION_ERROR: 29201 [ 3229.361680] binder: undelivered TRANSACTION_ERROR: 29189 [ 3229.374656] binder: send failed reply for transaction 863, target dead [ 3229.492924] IPVS: ftp: loaded support on port[0] = 21 [ 3229.522762] chnl_net:caif_netlink_parms(): no params data found [ 3229.568835] bridge0: port 1(bridge_slave_0) entered blocking state [ 3229.575432] bridge0: port 1(bridge_slave_0) entered disabled state [ 3229.582181] device bridge_slave_0 entered promiscuous mode [ 3229.593087] bridge0: port 2(bridge_slave_1) entered blocking state [ 3229.599950] bridge0: port 2(bridge_slave_1) entered disabled state [ 3229.606875] device bridge_slave_1 entered promiscuous mode [ 3229.624006] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3229.633363] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3229.669579] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3229.678060] team0: Port device team_slave_0 added [ 3229.690989] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3229.698085] team0: Port device team_slave_1 added [ 3229.703191] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3229.716066] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3229.733264] chnl_net:caif_netlink_parms(): no params data found [ 3229.777176] device hsr_slave_0 entered promiscuous mode [ 3229.815253] device hsr_slave_1 entered promiscuous mode [ 3229.858005] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3229.870474] device bridge_slave_1 left promiscuous mode [ 3229.876794] bridge0: port 2(bridge_slave_1) entered disabled state [ 3229.925728] device bridge_slave_0 left promiscuous mode [ 3229.931147] bridge0: port 1(bridge_slave_0) entered disabled state [ 3230.079092] device hsr_slave_1 left promiscuous mode [ 3230.129266] device hsr_slave_0 left promiscuous mode [ 3230.169263] team0 (unregistering): Port device team_slave_1 removed [ 3230.179055] team0 (unregistering): Port device team_slave_0 removed [ 3230.188763] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3230.239877] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3230.307353] bond0 (unregistering): Released all slaves [ 3230.388815] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3230.406550] bridge0: port 1(bridge_slave_0) entered blocking state [ 3230.412917] bridge0: port 1(bridge_slave_0) entered disabled state [ 3230.419991] device bridge_slave_0 entered promiscuous mode [ 3230.427074] bridge0: port 2(bridge_slave_1) entered blocking state [ 3230.433440] bridge0: port 2(bridge_slave_1) entered disabled state [ 3230.440653] device bridge_slave_1 entered promiscuous mode [ 3230.457463] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3230.466929] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3230.479301] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3230.502870] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3230.510209] team0: Port device team_slave_0 added [ 3230.517349] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3230.524340] team0: Port device team_slave_1 added [ 3230.530075] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3230.537991] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3230.597100] device hsr_slave_0 entered promiscuous mode [ 3230.634909] device hsr_slave_1 entered promiscuous mode [ 3230.752970] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3230.759420] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3230.774182] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3230.785037] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3230.795157] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3230.811234] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3230.833098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3230.847528] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3230.853579] 8021q: adding VLAN 0 to HW filter on device team0 [ 3230.872965] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3230.880594] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3230.888187] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3230.896728] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3230.904277] bridge0: port 1(bridge_slave_0) entered blocking state [ 3230.910658] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3230.919672] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3230.927780] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3230.940245] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3230.948505] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3230.962468] bridge0: port 2(bridge_slave_1) entered blocking state [ 3230.968952] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3230.983840] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3230.993045] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3231.007637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3231.019648] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3231.031467] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3231.043146] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3231.052956] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3231.069988] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3231.080613] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3231.090929] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3231.102926] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3231.116013] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3231.131418] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3231.139598] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3231.154020] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3231.162046] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3231.176945] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3231.191722] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3231.198887] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3231.223801] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3231.239771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3231.257808] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3231.272024] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3231.310272] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3231.331133] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3231.340986] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3231.354728] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3231.360870] 8021q: adding VLAN 0 to HW filter on device team0 [ 3231.370150] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3231.377549] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3231.386004] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3231.393573] bridge0: port 1(bridge_slave_0) entered blocking state [ 3231.399939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3231.413508] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3231.429363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3231.438595] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3231.456504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready 18:45:54 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000018200000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:54 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xe56e, 0x800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x2}}, 0x20) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x387a01, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f00000001c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r1, r2}}, 0x18) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x5, 0x0, 0x10) 18:45:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:54 executing program 2: r0 = socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) 18:45:54 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-ce\x00'}, 0x18a) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xf7) [ 3231.488584] bridge0: port 2(bridge_slave_1) entered blocking state [ 3231.494939] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3231.518031] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3231.529129] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3231.552136] binder: 16159:16160 got reply transaction with bad transaction stack, transaction 868 has target 16159:0 [ 3231.581338] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready 18:45:54 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="7f454c460308004b9a8b00000000000003000000050000004a020000000000004000000000000000dc01000000000000040000000400380002000400000005000700000005000000000000000024d5175d8d120079000000573e0000000000000400000000000000a606000000000000040000000000000003000000409100000800000000000000ffffff7f000000000100000000000000fdffffffffffffff4874000000000000090000000000c5270bf314abf444069ec6b694cd9690a736e302b6e55d50299761f61e383e36032394800000000000000000000000000000000000000000000000000000000000000000000000000000000074a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1d2) [ 3231.609554] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3231.609578] binder: 16159:16160 transaction failed 29201/-71, size 0-0 line 2816 [ 3231.631232] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3231.647700] binder: BINDER_SET_CONTEXT_MGR already set 18:45:54 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x4c8735e0003d4811) r1 = fcntl$dupfd(r0, 0x0, r0) write$cgroup_int(r1, &(0x7f00000000c0)=0xd779, 0x12) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000000000)="34a2683f20c563cb0a4b2c16ec1ded04", 0x10) 18:45:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x5eab0c677756372) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3231.685633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3231.693574] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3231.701114] binder: 16159:16172 ioctl 40046207 0 returned -16 [ 3231.704739] binder_alloc: 16159: binder_alloc_buf, no vma [ 3231.740243] binder: release 16159:16160 transaction 868 out, still active [ 3231.747584] binder: 16159:16174 transaction failed 29189/-3, size 0-0 line 3035 [ 3231.762125] binder: undelivered TRANSACTION_COMPLETE [ 3231.765169] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready 18:45:54 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x2, 0x2) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000040)=""/206) [ 3231.802174] binder: undelivered TRANSACTION_ERROR: 29201 [ 3231.819629] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3231.836678] binder: undelivered TRANSACTION_ERROR: 29189 [ 3231.856634] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3231.864530] binder: send failed reply for transaction 868, target dead [ 3231.924365] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3231.939512] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3231.952240] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3231.972179] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3232.000533] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3232.010496] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3232.021909] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3232.033907] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3232.043682] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3232.069084] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3232.083820] 8021q: adding VLAN 0 to HW filter on device batadv0 18:45:54 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xe401, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000003c0)=[@in6={0xa, 0x4e23, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7}, @in6={0xa, 0x4e24, 0x4, @mcast2, 0x686e891b}, @in6={0xa, 0x4e20, 0xbee, @remote, 0xfffffffffffffffe}, @in6={0xa, 0x4e23, 0x10000, @remote, 0x200}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e23, 0x1, @remote, 0x48}], 0x2ed) 18:45:54 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000009400000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:54 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(lrw-camellia-asm,sha256-ssse3)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f00000000c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000000), r2}}, 0x18) 18:45:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:54 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x210) 18:45:54 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000c0ed00000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3232.211681] binder: 16210:16211 got reply transaction with bad transaction stack, transaction 872 has target 16210:0 18:45:54 executing program 2: r0 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x3, 0x2) fcntl$addseals(r0, 0x409, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha1\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) 18:45:54 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x40, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000240)="490f66ab9307da83a2ba28eccfc78af7ae7ad49cd0d547a6257ad1c8a75e06b2140ae3747283fb2827fa61d30ce7e6408a0a149ae55c957f77dbaad165a319e6c31a30935d4da800ee3453699bca1d3230b9d893a5e5659026f7ce3090442f3766161b88000000000000b2b277f99808203098848db7e7bd6863e10bbf80228b374067cc3117667022609a1fd75a", 0x8e) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000000000000b000040070000000000000003000000835c000000000000fcc41530350e5fa066c563ff6da337e258d05e36052b51563307feee41a8c22cc11bec568143f2bda7f6b7586144e0f96f73563058dd314336f9b520500ee6b8dec29858e2018ab235e2b88daeaf9977cd88c83acc31faa6cebe94a928374e9f56736bf158b44316216b4795ab1884539b651fd8fc9b96797115ace4e6e6fe4eeba614fa69ede7d2abf8ae384f0268a68ac208a7c0b3fcb2bd43f80bf249cd961e6f92dd463eab689c21a1ba3304cee09c430de96bf84571af7a39c0836606e4cd557000"]) syz_execute_func(&(0x7f00000000c0)="362646c0960000008100451d00000100c401d558c0c463855d745f0f00f3f081971b4e137f77780000c4a33979ebe423baa9c90000ddc3420fd21867420f0e") ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000100)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3232.271694] binder: 16210:16211 transaction failed 29201/-71, size 0-0 line 2816 [ 3232.326635] binder: BINDER_SET_CONTEXT_MGR already set [ 3232.332001] binder: 16210:16234 ioctl 40046207 0 returned -16 18:45:55 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r0, 0x3, 0x1, 0x100000000, 0x3adeba2e}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3232.397711] binder_alloc: 16210: binder_alloc_buf, no vma [ 3232.444017] binder: 16210:16211 got reply transaction with no transaction stack [ 3232.474894] binder: release 16210:16211 transaction 872 out, still active [ 3232.481855] binder: undelivered TRANSACTION_COMPLETE 18:45:55 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = dup2(r0, r0) setsockopt$inet_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000200)=0x5, 0x4) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r2, 0x304, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x100}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'irlan0\x00'}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x80d4) [ 3232.487890] binder: 16210:16243 transaction failed 29189/-3, size 0-0 line 3035 18:45:55 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000007130000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3232.515430] binder: undelivered TRANSACTION_ERROR: 29201 [ 3232.534663] binder: 16210:16211 transaction failed 29201/-71, size 0-0 line 2801 [ 3232.571423] binder: send failed reply for transaction 872, target dead [ 3232.592874] binder: undelivered TRANSACTION_ERROR: 29201 [ 3232.642336] binder: undelivered TRANSACTION_ERROR: 29189 18:45:55 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xedc0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:55 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffe4c) 18:45:55 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) 18:45:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:55 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xffffffffffffff8a) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syzkaller0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bridge\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x25}}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x800}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0x84}, 0x1, 0x0, 0x0, 0x20004841}, 0x80) 18:45:55 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000000050a0000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:55 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x3e5) 18:45:55 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) r3 = getpgrp(0x0) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000100)={{0x1000, 0x0, 0xe, 0x5, 0x4, 0x72, 0x7, 0x7, 0x5, 0xffffffff, 0x6, 0x4}, {0x0, 0x0, 0xb, 0x1, 0x0, 0x9, 0x7ff, 0x3, 0xf486, 0x7fffffff, 0x7}, {0xf000, 0x15000, 0x1f, 0x136, 0x7, 0x9d7, 0x4, 0x0, 0x1f4, 0x2, 0x7, 0x9}, {0x6004, 0x104002, 0x0, 0x1543, 0x5, 0x5, 0x7, 0x7, 0x4, 0x700, 0x20, 0x1}, {0x0, 0x7003, 0xc, 0x2, 0xffffffff, 0x9, 0xffffffffffffffc1, 0x3, 0x1000, 0xfffffffffffffb27, 0xfff}, {0x0, 0x102000, 0x8, 0xff, 0x0, 0x4, 0x2, 0x7f, 0x8ff1, 0x66, 0x200, 0x9}, {0x0, 0x1000, 0x1d, 0xcd8c, 0x81, 0x4, 0xa1c, 0x40, 0x8, 0x6, 0x3e9, 0x100000000}, {0x0, 0xf000, 0xc, 0x80000000, 0x9, 0x9, 0xff, 0x8, 0x9, 0x4, 0x1f, 0x4}, {0x101000, 0x1000}, {0x1000, 0x10000}, 0x40000000, 0x0, 0x2000, 0x100090, 0x9, 0x8000, 0x5000, [0x5, 0x10000, 0x4, 0xffffffffffffffff]}) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x60040, 0x0) kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r0, &(0x7f0000000080)={r4, r0, 0x9}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3232.976099] binder: 16274:16282 got reply transaction with bad transaction stack, transaction 877 has target 16274:0 18:45:55 executing program 2: ioctl$FIBMAP(0xffffffffffffffff, 0x1, &(0x7f0000000040)=0x1) r0 = socket$alg(0x26, 0x5, 0x0) lseek(r0, 0x27, 0x58ecf2a69de6532e) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000200)={{{@in=@multicast2, @in6=@local}}, {{@in=@loopback}, 0x0, @in=@broadcast}}, &(0x7f0000000300)=0xe8) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x4000, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000080)={'broute\x00'}, &(0x7f0000000100)=0x78) [ 3233.044891] binder: 16274:16282 transaction failed 29201/-71, size 0-0 line 2816 [ 3233.107063] binder: BINDER_SET_CONTEXT_MGR already set 18:45:55 executing program 3: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x20) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x110, 0x70bd25, 0x25dfdbfe, {}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x73}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4040000) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x5, 0x0, 0x0) 18:45:55 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x18) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) connect$vsock_dgram(r1, &(0x7f00000001c0)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) write(r0, &(0x7f00000000c0)="5fb68651a81ac029bbca150535604b9c3c3e8b084b74061615d691c9fefd85ba5dad3206622f0bc7b64489353679cadcfd18302e8572d341008504c85bb2969315b5ae5dd45195289baea45adf6498fbc0156f", 0x53) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000200)={0xaa, 0x8}) [ 3233.184817] binder: 16274:16299 ioctl 40046207 0 returned -16 [ 3233.200162] binder: release 16274:16282 transaction 877 out, still active [ 3233.210288] binder: undelivered TRANSACTION_COMPLETE 18:45:55 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x8400, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=@delqdisc={0x1d0, 0x25, 0x400, 0x70bd27, 0x25dfdbfd, {0x0, r2, {0x9, 0x5}, {0x7, 0xfff7}, {0xfff3}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0xff}, @qdisc_kind_options=@q_pfifo_head_drop={{0x14, 0x1, 'pfifo_head_drop\x00'}, {0x8, 0x2, 0x7}}, @TCA_STAB={0x20, 0x8, [@TCA_STAB_BASE={0x1c, 0x1, {0x3ff, 0x6, 0x5, 0x8, 0x0, 0x3e2, 0x5, 0x8}}]}, @TCA_RATE={0x8, 0x5, {0x1, 0x7}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}, @qdisc_kind_options=@q_netem={{0xc, 0x1, 'netem\x00'}, {0x28, 0x2, {{0x0, 0x10000, 0x2, 0x7f, 0xffffffff7fffffff, 0x43b}, [@TCA_NETEM_REORDER={0xc, 0x3, {0x100, 0x5}}]}}}, @TCA_RATE={0x8, 0x5, {0x7, 0x4}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xf749}, @qdisc_kind_options=@q_gred={{0xc, 0x1, 'gred\x00'}, {0x108, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "a9c4861d0663005a306015e5042b586f32901b47de500c0a8fab4872d685a2f23b2e209a83bb7845f3de964d58699dd96f42198a9984892395f4ad3f420ed6096fc15616f546fad3914927d6044e9d6980ff1acfcc064b52f5141925e37945531eda263e385f7b76bc13ab06d259c5ff20679f1a4336355e650fa941f53512c6d51e26557b6b1159bc2be15a243954a1ef1671b5b88ee425949629c95801a6dc47635063ea23ee17fe3fc739cfb4feaaf591552e74e9fba1654ec8fac10052db00ab8fa6019984f6fe5b5000e968aa4f6d42a7a8bdf01f8549c7d095261d1a8b691ca8a358bfd9e6c1546e55d911bb0fba91a7a635b4c8fccc0d3406e71aae2e"}]}}]}, 0x1d0}, 0x1, 0x0, 0x0, 0x40}, 0x40014) accept$alg(r0, 0x0, 0x0) [ 3233.244735] binder: undelivered TRANSACTION_ERROR: 29201 [ 3233.260304] binder: send failed reply for transaction 877, target dead 18:45:56 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xfffffed2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x665) llistxattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)=""/101, 0x65) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x101000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0505510, &(0x7f0000000280)={0x75a8d17d, 0x7, 0x8, 0x4, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}]}) 18:45:56 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000000070a0000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:56 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x8000, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000040)={0xf000, 0x116000, 0x2, 0x9, 0x7}) 18:45:56 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:56 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xffffffffffffff16) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x6, 0x2000) ioctl$DRM_IOCTL_GEM_OPEN(r1, 0xc010640b, &(0x7f00000001c0)={0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000200)={r2, 0x80000}) r4 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f00000000c0)={r3, 0x80000, r4}) 18:45:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3233.477118] Unknown ioctl 1075883685 [ 3233.493139] binder: 16335:16336 got reply transaction with bad transaction stack, transaction 880 has target 16335:0 [ 3233.512313] Unknown ioctl 1075883685 18:45:56 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:56 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) accept$alg(r0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:56 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x9) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) syncfs(r1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3233.619188] binder: 16335:16336 transaction failed 29201/-71, size 0-0 line 2816 [ 3233.717732] binder: BINDER_SET_CONTEXT_MGR already set 18:45:56 executing program 3: openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x80040, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xffffffffffffff5a) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffff9c, 0x29, 0x40, &(0x7f0000000040)={'raw\x00'}, &(0x7f00000000c0)=0x54) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:56 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x800, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x80001, 0x0) fcntl$setlease(r0, 0x400, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x5f) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000240)="5a3af5827e3515b408f321bf196d7de83867a847ff56ac941798eea03b585f4e13402a53773dcc4d94fed1c4827ef5c627ba47f67246997fce30ee30bec726cfd18ed55d083b0fd41f8795c49c3013612138ad783f60d3da4d0041b8f7b00a99e5d51a2bd8d0743053b1c015d0fb8f238074b2dbf36e752e804cb9738e523984edecd32bfb61e4e5b2d8d3db1f05666c44511c29b33157a11b5c80b1cbb58018be911e8e5aeed73f9eac4223f55187da85fcd89b15f4c17919a13ee67812183ad874458ac2a12dc66892900fa43d6c2a03a5a83b0213676d08c13f50ef56dd0b5392fa3546b7d05d7f8c5ddd4a2fb27c6110", 0xf2) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x2, 0x8664f00) r3 = socket$alg(0x26, 0x5, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/fib_triestat\x00F@\x9b\xad\x83\xa6B\xfc\xd8QV}2\x17f\xe2\xab-M\x15\xf0\x1c`0`$\x99') bind$alg(r3, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r5 = accept4$alg(r3, 0x0, 0x0, 0x0) sendfile(r5, r4, 0x0, 0x2f) write$P9_RSTATFS(r2, &(0x7f0000000040)={0x43, 0x9, 0x2, {0x20, 0x7, 0x3, 0x7fff, 0x5, 0x8, 0x5, 0x8, 0x7}}, 0x43) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) 18:45:56 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000017fe0000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3233.811760] binder: 16335:16353 ioctl 40046207 0 returned -16 [ 3233.814102] binder_alloc: 16335: binder_alloc_buf, no vma [ 3233.823724] device bridge_slave_1 left promiscuous mode [ 3233.823816] bridge0: port 2(bridge_slave_1) entered disabled state 18:45:56 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) fadvise64(r0, 0x0, 0x28d, 0x5) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xe05a, 0xa00) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000080)={0x0, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x19}}, {0x2, 0x9, @rand_addr=0x3}, {0x2, 0x4e24, @broadcast}, 0x308, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000040)='gre0\x00', 0x0, 0x2, 0x2}) 18:45:56 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x580, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000001c0)={'veth1_to_bridge\x00', {0x2, 0x4e22, @multicast1}}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') close(r1) sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="a0003119f70000f48920c6e8a05685be62691f1108d88564287b45754b5783d615f0a7338bde1295edc69e9e050524574461a6e39922344fc2672f46e71008fb6bc3f9b44e2fa051ca2605efdda00a0ad3af3695ace438a876415fbff2a474ae83f222d82fdcdb41b16c6405b89d088e702656a705e177e7dc2ff7c4c0a44a83ae21de0f3c123752ab62848fe7bf4c3cf1041d41dd431ea0585fff9d1057d552d34af90ba9352720c9e59ca4018d2594824bee24046fe296669fcb5a9aa13448f13854f5722c01c8ff33d46b17b9175a6c2ed250e1530ace43e73a503f86c2967bad13ac2c96d0cf0b7365f4ff826f6ac665378e091f4031e23666dc3b4b3b9fd93361c6b6b15701308b617eae0629bdcd8fdc047f8d865c0672db4c5f9f2d46b4d93f3cec22233d7b7a81061e9c0c9dd2fc2f1e2abf3d2e46600f14140d6abec2afe17b0ae1f6771fd1374fc3ce0f4280f36d20f9e626ba7ad5da8b9fe14e4dcabc956aaa61e80000000000", @ANYRES16=r2, @ANYBLOB="080027bd7000fddbdf250a0000002800040024000700080002000000000008000400ff0f00000800030008000000080001000e0000001400090008000200040000000800010000000080380002000400040008000200010000000802d86eb61000000800020001000000040004000400040008000200000400000800010000000000180106000400020004001400040002000400020004000200"], 0xa0}, 0x1, 0x0, 0x0, 0x10}, 0x10) accept4$alg(r0, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3233.871194] binder: 16335:16336 got reply transaction with no transaction stack [ 3233.900492] binder: 16335:16360 transaction failed 29189/-3, size 0-0 line 3035 [ 3233.911728] binder: release 16335:16336 transaction 880 out, still active [ 3233.985041] binder: 16335:16336 transaction failed 29201/-71, size 0-0 line 2801 [ 3233.994791] binder: undelivered TRANSACTION_COMPLETE [ 3234.013635] binder: undelivered TRANSACTION_ERROR: 29201 18:45:56 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x1, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3234.049038] binder: send failed reply for transaction 880, target dead [ 3234.106870] device bridge_slave_0 left promiscuous mode [ 3234.112329] bridge0: port 1(bridge_slave_0) entered disabled state 18:45:56 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xfc00, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:56 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) mq_notify(r1, &(0x7f0000000080)={0x0, 0x29, 0x0, @thr={&(0x7f0000000000)="1590a80152ff5c1a964d0f99de277d88b5c7b593a51ad78cdd26b11fb360e23a193d2f8a2038dad8a7037389f399079f4b613c553bf1e6f0b98b6b318e4de960432d059762395b5327a257ff1162ab0603b7a6319f3ec0bc5efb09bf80f18d73906fc575cf8b738aae", &(0x7f00000001c0)="519b288889ba8cfc9f49a7fff49258a5ebabf791c61f5d7bac65df31bac7188e9cf11af118bd6de822fdd0e083fe6be0484707b2fc5bd6f7f4fe043773dab5698a0c50a819513f33a2c65bce164f5542c2e275cf43dd8319d910579e7360a2222c33c604b2e7124ed76d6276485b9fd48bf20a590cb02b5f3c6d9f3e85e08f6e419d077940fb65b39bf959215447bc1f2a6c3a9563ea206c2980b1dd0c26067fe71070cf9943161ad49300e11e5ea8c130713d3336129c0729ceb68531370515b8ae20f7aacc8330c8fa"}}) 18:45:56 executing program 3: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x400, 0x0) getsockopt$inet6_dccp_int(r0, 0x21, 0x6, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = socket$alg(0x26, 0x5, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video1\x00', 0x2, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) 18:45:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:56 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000080)={@remote, @multicast1, 0x0}, &(0x7f00000000c0)=0xc) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000001240)={0x0, @local, @loopback}, &(0x7f0000001280)=0xc) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, &(0x7f00000012c0)={@dev, @initdev, 0x0}, &(0x7f0000001300)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000001340)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@local}}, &(0x7f0000001440)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000001480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000014c0)=0x14) getpeername(r0, &(0x7f0000001500)=@can={0x1d, 0x0}, &(0x7f0000001580)=0x80) r8 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r8, 0x6, 0x15, &(0x7f00000001c0)=0x9, 0x4) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000015c0)={{{@in6, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@broadcast}}, &(0x7f00000016c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001700)={'tunl0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001a00)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20040000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001740)={0x248, r1, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}]}}, {{0x8, 0x1, r5}, {0x15c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xb4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r9}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x100000001}}, {0x8, 0x6, r10}}}]}}]}, 0x248}, 0x1, 0x0, 0x0, 0x4810}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:56 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x40001, 0x0) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000080)={0x3, r1}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x5, 0x0, 0x10) [ 3234.273251] binder: 16399:16402 got reply transaction with bad transaction stack, transaction 885 has target 16399:0 18:45:57 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x501002, 0x0) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000040)=""/243) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="4c83acdfe95a076df31f523364e966bb547851fa21344ec650b0319e55d412a4078a4cc3dfd4c394da0e9e64a38c337552d506026ed44a3af8141d1855bffc74fa614525fb09f195c4fbbdbf9857275a9e68e62c1bc54c96d0042d6a9168472642de389cc958509a1a", 0x69) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f00000001c0)={0x401, 0x8}) 18:45:57 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000007ffffffff0000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:57 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = dup(r0) ioctl$UI_SET_RELBIT(r1, 0x40045566, 0xf) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-aes-aesni\x00'}, 0x58) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000000c0)={r2, 0x1, 0x6, @random="f30478aae1c3"}, 0x10) [ 3234.408058] binder: 16399:16402 transaction failed 29201/-71, size 0-0 line 2816 [ 3234.434073] binder: BINDER_SET_CONTEXT_MGR already set 18:45:57 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) pwrite64(r0, &(0x7f0000000000)="22178d40ed3914e64e5584908a007e68c4a8f7b1cd13936b850b401bd420d7897c03eff16a80ceb96ea00d24c9612484150d666271803dd56637a025641351ee7e21decdd0b0bad65a7882e577535aa0da9e48b88cd97579a9097f3dd33e2cbdc51bb89ff59d705b4c868fb0e797efb5b02c3ceed656070f2b308f91dbd61b09ed0da5bb677fc39c58b365112ed1960e0690411e83b9e806e3e528", 0x9b, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x80200, 0x0) 18:45:57 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = socket(0x0, 0x5, 0x4) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="bceb00002dd6e4bd0ba3632d8e62e242d9d18fbedffd6bb632164a53b3ec23c3ffad3e144df6aa211b15bb30ae6a27c22d9942fb5982dfd2cceb007e72a1e1bb9a0dadd20840d7976148a2e63611be2173045ac8a3b63438e2818de37fd1d907c6cffcd434f4e9e2e16616bdb35657b789c642c88003223d1244388ff9419c99fa706b9b92f9a1d98f08db98e4a576782025792312a173d91860a1e8963bf5982fe0689e2e5dc426ee88d15f338877ca6a7dd3700afbeb2b17c0813c53cec2e8d86ce23fb769ea3ebf1b7d8ff0c8147e59c170244556b976cb24e6d92bd94a43bf1d2a43aa9ce760fc89fe86f52619c4131dd04157c982", @ANYRES16=r2, @ANYBLOB="000726bd7000fedbdf250800000008000600ff01000008000400190000005c000100080001000a0000000c0007000200000009000000080004004e2100000800050003000000080004004e21000008000100020000000800060077727200140003007f000001000000000000000000000000080002002b0000003c00010008000500000000000800060064680000080006007272000008000b007369700008000b007369700008000b00736970000800020032000000"], 0xbc}, 0x1, 0x0, 0x0, 0x4008000}, 0x40001) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="4218117f12276c4542f12f4335eb1b45fc9cd54bbf4c9f93bbcece811c39d4fc4ac2d57f626040ff23154c982341f045fb912340eedab496c3fd538ba4197c4bf91bfa5b18313493ff9b718848e6ce0124d299d62fb28710b57f4e110f20ef8cbed0fffc4c9058fa41e7295f647318cebf76ee03ea66f10b05c0d56a152f9b09cd582d3eb50d87ed7a947d697f008ba000a97474eadb57badbace9bd67e98fe9e8c26fa6269ec372c9a84b4f70551e4a94a4564289a03658ab99fe7a0ed1a436f19e921161c8e5abedb2c83883cf81ccbabfa622a8251df66c1096882d78b6e66dd4bdfda16aea0384bd40189a7331ea5ddf", 0xf2) [ 3234.524884] binder: 16399:16419 ioctl 40046207 0 returned -16 [ 3234.541537] binder_alloc: 16399: binder_alloc_buf, no vma [ 3234.548760] device hsr_slave_1 left promiscuous mode [ 3234.565642] binder: 16399:16402 got reply transaction with no transaction stack [ 3234.599231] device hsr_slave_0 left promiscuous mode [ 3234.608594] binder: 16399:16421 transaction failed 29189/-3, size 0-0 line 3035 [ 3234.627518] binder: release 16399:16402 transaction 885 out, still active [ 3234.635656] binder: 16399:16402 transaction failed 29201/-71, size 0-0 line 2801 18:45:57 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x40000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:57 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f0000000000)) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f0000000040)={0x8, 0x5e3, 0xe08, 0x5}) name_to_handle_at(r1, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0xf, 0x400, "cfd70ee81023b5"}, &(0x7f0000000100), 0x400) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3234.646929] binder: undelivered TRANSACTION_COMPLETE [ 3234.685490] binder_release_work: 2 callbacks suppressed [ 3234.685494] binder: undelivered TRANSACTION_ERROR: 29201 [ 3234.759245] binder: undelivered TRANSACTION_ERROR: 29201 [ 3234.786838] binder: undelivered TRANSACTION_ERROR: 29189 18:45:57 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000080)=""/72, &(0x7f0000000100)=0x48) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x28) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f0000000040)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:57 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xffffffffffffff90) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:57 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x1, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000040)={0x1}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffffb) [ 3234.814627] binder: send failed reply for transaction 885, target dead [ 3234.839102] team0 (unregistering): Port device team_slave_1 removed [ 3234.892003] team0 (unregistering): Port device team_slave_0 removed 18:45:57 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500fffffffffffff0000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:57 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x400000) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3234.949261] binder: 16465:16473 got reply transaction with bad transaction stack, transaction 890 has target 16465:0 [ 3234.960195] bond0 (unregistering): Releasing backup interface bond_slave_1 18:45:57 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffd8b) 18:45:57 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffede) 18:45:57 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf0ffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:57 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x1cf, 0x80002) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f00000001c0), r2, 0x1}}, 0x18) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3235.054921] binder: BINDER_SET_CONTEXT_MGR already set [ 3235.060212] binder: 16465:16483 ioctl 40046207 0 returned -16 [ 3235.081199] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3235.099410] binder_alloc: 16465: binder_alloc_buf, no vma 18:45:57 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000100)=0x0) perf_event_open(&(0x7f00000001c0)={0x5, 0x70, 0x10001, 0x1, 0x10000, 0x4, 0x0, 0x101, 0x400, 0x1, 0x10001, 0x100000001, 0x6, 0x3, 0x6199, 0x9, 0xf9, 0x401, 0x0, 0x5, 0x6, 0x81, 0x7ff, 0x79, 0x80, 0x20, 0x0, 0x4, 0x80000001, 0x0, 0x5, 0x100, 0x7, 0x7, 0x1000, 0x573, 0xf5b1, 0x1, 0x0, 0xb, 0x4, @perf_bp={&(0x7f00000000c0), 0xa}, 0x2020, 0x5, 0x5, 0x7, 0x81, 0x8, 0x2}, r1, 0x8, 0xffffffffffffff9c, 0x3) accept4(r0, &(0x7f0000000000)=@hci, &(0x7f0000000080)=0x80, 0x800) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000240)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000280)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3235.145384] binder: 16465:16473 got reply transaction with no transaction stack 18:45:57 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) write$binfmt_aout(r0, &(0x7f00000001c0)={{0x107, 0x4, 0x7, 0x15, 0xfd, 0x2, 0x1ee, 0x7ff}, "36a7ea3b704f6f", [[], []]}, 0x227) [ 3235.231613] binder: release 16465:16473 transaction 890 out, still active [ 3235.247234] binder: undelivered TRANSACTION_COMPLETE 18:45:58 executing program 3: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8c000, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000040)={'veth0_to_hsr\x00', {0x2, 0x4e22, @broadcast}}) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x3c, 0x7], 0x3, 0x3, 0x3, 0x9, 0x8, 0x670c87f6, {0x6, 0x7f, 0x0, 0x1, 0x90000, 0x4, 0x1, 0xd5, 0x400, 0x9, 0xa7, 0x9, 0x4, 0x1, "69433f2a8afad413b99970a83e992954d64db0658e6481c8302e3e423828af8b"}}) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-aesni\x00'}, 0x2d4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xf3) 18:45:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3235.294942] binder: undelivered TRANSACTION_ERROR: 29201 [ 3235.300549] binder: undelivered TRANSACTION_ERROR: 29201 [ 3235.369954] binder: undelivered TRANSACTION_ERROR: 29189 18:45:58 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_G_SELECTION(r1, 0xc040565e, &(0x7f0000000040)={0xf, 0x103, 0x1, {0x6, 0x45, 0x400, 0x1ff}}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:58 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:58 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000000010000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3235.429411] binder: send failed reply for transaction 890, target dead [ 3235.442801] bond0 (unregistering): Released all slaves [ 3235.454103] binder: 16516:16517 got reply transaction with bad transaction stack, transaction 895 has target 16516:0 18:45:58 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = shmget(0x3, 0x1000, 0x54000000, &(0x7f0000ffe000/0x1000)=nil) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x5, 0x80080) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000001c0)=""/1) shmctl$IPC_STAT(r1, 0x2, &(0x7f0000000080)=""/45) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm-aes-ce\x00'}, 0x58) ioctl$NBD_DISCONNECT(0xffffffffffffffff, 0xab08) setsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000100)=0x7fffffff, 0x2) 18:45:58 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha1_mb\x00'}, 0x58) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = dup(r0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x3, 0x400000) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000040)=r2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3235.554773] binder: BINDER_SET_CONTEXT_MGR already set 18:45:58 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000000020000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3235.604739] binder: 16516:16529 ioctl 40046207 0 returned -16 [ 3235.632305] binder_alloc: 16516: binder_alloc_buf, no vma 18:45:58 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x1000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:58 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = dup2(r0, r0) r2 = getegid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) getgroups(0x5, &(0x7f00000003c0)=[r2, r3, r4, r5, r6]) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x440000, 0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000040)={0x3, r7}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3235.674474] binder: send failed reply for transaction 895 to 16516:16517 [ 3235.690259] binder: undelivered TRANSACTION_COMPLETE 18:45:58 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000040)={0x10000, 0x17006, 0x4, 0x2e9, 0x80000001}) [ 3235.737773] binder: undelivered TRANSACTION_ERROR: 29201 [ 3235.759987] binder: undelivered TRANSACTION_ERROR: 29189 18:45:58 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x539) [ 3235.791617] binder: undelivered TRANSACTION_ERROR: 29189 18:45:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:58 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x100000000, 0x220000) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:45:58 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xffffffffffffff4f) ioctl$sock_ifreq(r0, 0x899d, &(0x7f0000000000)={'syz_tun\x00', @ifru_names='rose0\x00'}) [ 3235.965736] libceph: resolve '.u [ 3235.965736] ' (ret=-3): failed [ 3235.973322] binder: 16571:16573 got reply transaction with bad transaction stack, transaction 899 has target 16571:0 18:45:58 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x2, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f00000000c0)=0x6, 0x4) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xffffff78) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r2, 0x80045300, &(0x7f0000000040)) [ 3236.054231] libceph: parse_ips bad ip '.u [ 3236.054231] :d]:.,[' [ 3236.073383] binder: BINDER_SET_CONTEXT_MGR already set [ 3236.085628] binder: 16571:16582 ioctl 40046207 0 returned -16 18:45:58 executing program 5: r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif-generic\x00'}, 0x58) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x7, 0x5bc, 0x9, 0xb7, 0x3f}, &(0x7f00000001c0)=0x14) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000200)={r2, 0x2880}, &(0x7f0000000240)=0x8) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000000c0)={{0x3, 0x2, 0x5b6a0765, 0x3, 0x4}}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) [ 3236.104958] QAT: Invalid ioctl [ 3236.115735] libceph: resolve '.u [ 3236.115735] ' (ret=-3): failed [ 3236.123962] QAT: Invalid ioctl [ 3236.127636] binder_alloc: 16571: binder_alloc_buf, no vma 18:45:58 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x7ff) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8) 18:45:58 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) ioctl(r0, 0x100000001, &(0x7f0000000080)) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0xf}, 0x1, 0x3, [@multicast1, @dev={0xac, 0x14, 0x14, 0xa}, @multicast2]}, 0x1c) [ 3236.171284] binder: send failed reply for transaction 899 to 16571:16573 [ 3236.186255] binder: undelivered TRANSACTION_COMPLETE [ 3236.194087] binder: undelivered TRANSACTION_ERROR: 29201 [ 3236.207909] libceph: parse_ips bad ip '.u [ 3236.207909] :d]:.,[' 18:45:59 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000007fffffffefff0000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:45:59 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$cec(&(0x7f00000002c0)='/dev/cec#\x00', 0x3, 0x2) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000300)={0x8, 0x0, [{0x0, 0x4, 0xfffffffffffffff7, 0x9, 0x3}, {0x8000001d, 0x6, 0x7ff, 0x3b33, 0x9}, {0xc000000f, 0x40, 0x100000000, 0x9, 0x2}, {0x40000002, 0x200, 0x0, 0x8, 0xed}, {0xa, 0x6, 0x5, 0xed, 0x1}, {0x80000000, 0x3, 0x40, 0x6, 0x8}, {0xf, 0x1f, 0x3, 0x5, 0x5}, {0xc0000000, 0x931c, 0xfffffffffffffe8d, 0x100000001, 0x7b2}]}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r2 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x1, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r2, 0x4010ae74, &(0x7f0000000280)={0x0, 0xffffffffffffffe9, 0x200}) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x40040, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="08002abd7000fcdbdf250100000000000000014100000018001700000020000000097564703a73797a8c895cfed68f38141294d86a40dfce3100000000"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) 18:45:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:45:59 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = getuid() r2 = add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="f4106b4b731190083602af3cf851fbe3e9abf0dd69a2e150c63144a32319370a0c36c744a730ae8bb8900814d64c534e", 0x30, 0xfffffffffffffffb) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f00000000c0)={r0}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x800, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000200)={0x3, 0xffffffffffffff9c}) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f00000001c0)={r0, r4}) keyctl$get_persistent(0x16, r1, r2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:45:59 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x5f) 18:45:59 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x2000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:45:59 executing program 2: openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x101000, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:45:59 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = accept4(r0, &(0x7f0000000080)=@nfc, &(0x7f0000000100)=0x80, 0x80800) accept4$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14, 0x80000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x8, 0x105800) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000040)=0x3, 0x4) 18:45:59 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xe5) [ 3236.936250] binder: 16619:16622 got reply transaction with bad transaction stack, transaction 903 has target 16619:0 [ 3236.961908] libceph: resolve '.u [ 3236.961908] ' (ret=-3): failed [ 3237.002199] libceph: parse_ips bad ip '.u [ 3237.002199] :d]:.,[' [ 3237.055278] binder: BINDER_SET_CONTEXT_MGR already set 18:45:59 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x5, 0x121000) ioctl$CAPI_NCCI_OPENCOUNT(r1, 0x80044326, &(0x7f0000000040)=0x4) sendmsg$alg(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000300)="e3f6cd8b6cb1f63548ac7754f9ed24ba669c706038d0395f8390476be25281da18bde0056ac60887bd24adbfc46385cdd60ad3f0ba4d6122aa3b829c4c52d49e8b2e87fbbde76113ed3a8df4f4c4bcb37364c9c3680a074ed6", 0x59}, {&(0x7f0000000380)="a618b181da701f19c227fe74638b801b80e5c9a4a66dfc30dafe707991923dc73cc083b609800fa1d22d155d2c78f2b6fee88a9b5794dbd94fe3abb51c9630e8b4bfa8d8b5c1b1af98606dfddfd442543a99c0d658007ec579dd5d260d7955b1caac3d5fe60a356d690720522f984c57427fc6f8065e63411b7a21502c2d6bb05298218acfdc425533329f8ad3f012be30bdefa0b6d35294d226b078561c9e0dbbc39451d2901d6756741214f3380a7cf1b3d7ce3a56cfbadaa38b3d95553745392de627000d4c21c494aa001b1077301d6b146435fb0db1799d02a32b1c4a24c19bb9cc10c9f523e3a8f5991d37fb5d9d6fe3b99b010abc9adf829d", 0xfc}, {&(0x7f0000000480)="00032e9e3848097f3a936bb1d4e5e9d6b223365ff6a523ed74c8539185f0e9c60597c7d5f455949428645e25", 0x2c}], 0x3, 0x0, 0x0, 0x80}, 0x4000080) bind$alg(r1, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) openat(r1, &(0x7f00000002c0)='./file0\x00', 0x800, 0x100) r2 = accept$alg(r0, 0x0, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = geteuid() sendmsg$nl_generic(r1, &(0x7f0000001400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xd3408}, 0xc, &(0x7f00000013c0)={&(0x7f0000002700)=ANY=[@ANYBLOB="601100002000080125bd7000fddbdf25150000000c001500707070306800000008003100ed4f36d9475f0d8bcde533f90345a7b0b0635cdac7bb8de7e8b289c1e35ae24fd174333b9ba35e267601d7564742f3ea50f2eda837fb8dbfdb012391e4fc75dc359f229b3b6a34f2720e39da7c95951a71cf03a6cc971352762690464524487d54ae916a877b863b857b46f02bb1ed272b348427bdc3d09ea3105a5dd89bbbaf85d279ac5b26bf8c192cc35ae82d192151fcc7e048f526784b233311dd00ef389d9f", @ANYRES32=r3, @ANYBLOB="4a429780320e0b3929efc902adee6d717aa91240821139ee7b021c11400032bc1e2413cf9c45133e7989fa01bc3cd217afb7c9b39561687c0f17c69fa184258e74534b822d2b9457cc4ce21b6615a3dee1b22e64566b25a1971e080db5ffddcc47ad0345b80cfb94f359f5eec904d3e629ac08f50f13688dea01e1bf082fcf39bdce095f411d5e8f4ced0444cd0f7025291505d72766ff00a3d1d2326299566eb0acd465ecf60a683e8bf4f71a688e3044188de4985260fdb51d6eab0327158c723548c40d486fe7e9e279f1897afa11118b5fa753621d7b085f4e07cf70481baf12337fd51101ba3aacd98503d035172b0fd8ff18d6bbaf10894f3f246fdc72e1654372d4b718cc2219ccacd862b4ace66e8e1c7e663bda06f602ef7247077ab1aae65d8c1095f0b1b59150261db66611b42c5e534f8f142fb39cfaabbd2d2a0d7c90cb7806257cfc70238bda994c559cc7bdfadfe8a51199a14783ad7ad2673d0ecf9b9196920e006c41c9ce30e722c106b22c692b8f61b64e25427c2cc9327ba63756c667782560ca0da89c3bf7bcc46d6471563b980daa71806317a7fcf81d6eda5524636818c3c1c1dac5de47e6a80e945eb88fd64888f064c5ff3e7e6e24fb4ed4bed30e1c08cb4e34088964b9711aa7756e55828325ca7ed972e0b520134cdd51f211b02e74e68971f7b34f884c73e228a628c3de6e7992bdf986c5e341b49ce9e64e3f61ff634d24c08b7d8e9a3ead800433c3a431f87252967e29ccf9fdb9ba364a32a2d712e2898c9d18b00b4e2f312d02a61eafffae554f77051e0e6241498af94b43181a8aa6328402b0261f0204a2baeb40c73e08a4bde8a5867e8b90bfa7ce55168b43b48705bfb4c1e33feabb88e0af4ea11fcb413a00ed0646d4d54e717d6a09eab04fe17e4e4479e9445acdb72fe3883c2669af2dc1c96c100fef929dea93645a8d8de678ba86deab4cd231c14a040036ccce76daa3aa8f93ac534d6ab424c9a17ede2ec9d225a81b2cf15de72661f91de98a5763d8c321877b7ae993cce5cf70290f4be9e305df35182405b8f21254ff4719ec0a4e21003420d8cf1eb09002696271ac2587b70afcce99353c464bf47e6e0e504bd617efc3e302bbc8741bad87abe9fbcc908f3a5758a40c1c53c53b022619b1f9d4b9c7c33fcd05432ebde0ca8984b225858f302ee6615a2046a95ccd675aae160ff7e3156a91d6bcba860d5a93ebe00672958bf40da80e25e3a85b0c8d3326ce0d39656bca9c76cb1ed06004326ff15ff167ffbb7333289e019299bc87abfa9fac7952f57910d3d3ddabe0f95fb2434879176633ce0ace7a43fc2c05a1103b614b22c3ec7ae764c85358056c78959da7c2c56b9546d8bd79fa16db17c7c05a5a9304a04e5283b7c4604cc1c32a9226925a95878eecedd0242cda9041f18c26f3e5dc234d106e4968200ad516c022dfcb5234ca0ec97f915ff4f819f2ce2770eba4f6db054aa257084a6354bfcda217daaf8f89096b5970114bf7407805855cdb82b0a28735aa971dcd813a218c981064485c053ba667732d060c2b5a5c467e38ea68d0e5cad047a860a7a8bf1a8c1b39939d9222c2eb960a805fb806cce5825e2f3f8f88adc7de5858867f6def16bfc4e7bd45b39afcca79723c8060b387bf69640f7561fcbcbe22e944aab4462edd7ea25ca071f87eb28dbf1e721f0103702cedff95f2c38db19ccf598770ba2816fa150c0603d736704577a2fa2438bad09d94c80c406b95493ae303008b66a93fa99f0ceee5a9203be7a8e988e82dd9bfe85cc6a6967d7e8abbb790341dced705e179c4876f204130946d2041a1e436fd8276e2c8766217ea4683be9a98d0fcf142104c1108f6a88a7e6943803e492506ef9dd017048354ed3df61a686987516e40e161e6bbac3a628a302180823b78a35e8649912514758624be08768ecb096c06eff5659e7eff0c8ef4542616cd6bd7f150826175247db30a262de663f0c8b212ed6a96e82cb9e4321e9388a687a010937daf818481a03ff836520709e466ad44f8943e5cc357dd04cb4512120ef544ec7685710b03cf3b6d14cd78050be10ae2c178f3a29ad2b395442a6615a3e1f723337a78d09f4e018e16d8a72c942a19c20493837f7494334bcc7dc088366149eb23f20268f57cf3199289e2e89a702239ffc2f974a04bf8ceb7e496d52d0a3951043db10257840a83ed728db93782debf48e2780f4e1f90e45c5ed562582b578547b09b648bad6debca2b07abd170b76085255f04f154791918865b59f6ae44541c04aef629f6a28394053840a41b44f59350575aa5a5d57b1dd8fa45b53cf410fccbfaaf41d50856f14914f4b9e5468781da8ccdce948efe0266a5ece84da434c390f2cc92c4d7b2b458b5143e970558f082ea27ecf5ce460562ad634f639e98adc87a092c0bff3dac74042c9e2a2ed78a08a734f69adabbccccd345eb8d4039215100a16a792b0c1bc498552c63a5dee1792e13cd69c773cb97385bb454937dd27af5803c32b61d90773207b614e0eb48c364fae6a70ab33705a9e3eb0a9c0f3995b4bd0252e8c7273e5550fe44044e5e0a408838c8ca8126e797c673081f72875423e3a5985a74e85dea3c0c98d5f79136964484c79516d452143485915813272bbbdc827c0f31a94ca32a31fc8fbe18a474ce38598a10a4d6a71c77a19ebad85bc6b9718fec5939b870cb41a77f045c0dd3f058cb53729972875e19bfd5e35799df1022bbd284196bd02c3d578d8595a94b9e06f54e07d434dbf08de2f68ba181a8fe9d73198c4e7cf0796dbb698e8d1266f8083899f492d28bd298751c7f5aeb7eccb1a9a400e8b330c40d9da02da4b8392d5a4fab499fa46b1ff53cf6238d62feafb30c62fdc6d2a11dc162988b1210d6b8d719378262a28941fcfb015671bace67c922151e80af0bb4c5f5ed5e872c374f90b6e82df28e54f931f56738c9d6dbe0d63a56e059cd142cf08dca24050ad49777d8e327f1a9e5219d5584f8e9949e8bc178e0279fb63aafa4a7ca57d621a05c287b4ac6164022d1346b4e93fbc9a6cc5342dd7782328fde9e5560e69c506a14d9017448b70e1ac9f7992cc7b5f7715f9ec6b71e9ea11e59cfd1205a08b79dd0649bd5ea0b75c5c7da82abaa8a44a07494a979e30c0c757f0bd1d889dbf9db4da473ee376549c1a6b561cc655987c2a8ce118e8a3da7c644b7defc9d59e7b84d6140a8a7678ea01911b2d164bd9684ccf132015fa254b8a9b7fa95e6a5778aeba5815368607436f08060fa45548c1902c3d757e3f667ce276b2bd38b5f19eec401a3dde2eb54f4f641052f0fb088cda2c8bbc203f18be3805cd7d349b1f7eaa8499dad21779128c880840b9c9efa8a11ca2ef5739e24b09c357d41ccbc4d8e8533cb2b172d499a26b941b703ec8adfa2af114272056b91211639b9ac9d3b51de941dc4035e1af803e7bec8e83bbf340fad34765ca5a24b2661cc90befd4c3cf52633dc8b70b2d5a3ea27e44786c493204d73cd7f37af9ff7c46a40c34eff12d9ce1fb91db9b429ed21a98bb0e5a2b24ddd90cc27efd515034d356628732d771a74228428fdc505e0038dc1543738f7da0933c5c11337bbdd709f37670e09348bc14039d5947d45468bae8637674e76285ebe0ea2e550eda3ace9ef8758bb85223a5ccbe9b68239669d87aa2e76dde5a06ea6a4c6961c180293e233d3c8e9b628f1740561a85cabd9bd53fa61acb0a79db5ac9b74f418aeea2a18101eac75b3612a02b058162865ad9837d4b2878ab458a748eaabc638fd5f1ca7a03f3024d96f58973e35005964c3167d728383781b2818ebfe1dd07246e991b1e3cef20f57ace8905b68068bc3e87ce5c57a529bd7fd6d065b7c42ab61794bb57fba692621bc9b9839e3bf5a81d46212fe3b8df5cb661bab973b4f4993c7438290280150b68c4f51d98336099f0d9d7afc1c20e48c16e02b4022c91b1ed4b124e7ca0bd5095b76de1ed036d9ff965f1c4ac2abae7dc9343a2346e10afd511864386130439c1a9b4cf573eca7f7a305794f490e1a635333c9e709907dc6f1459a2504152f2a46e0164e0b5536352ab46546f1694db5a85af3d3a8b6610662d45239a0d9369b4c1f0815fbe82a092e4a255e64abc677763982e5a7bfe44fd0d86bc233cc754fb6fc852ad6ffbb2e3f644bb650c8fec7a22b1a9b30c1e4dac19beac6247b6d2165c6c60d76aff93bc66d9c4e82c97c2022dbde04fa8cb628f966bdb282c7e1200bc8991d88c5dcd21bbb03b96c4548c9d0cdde0b3e4e517b970e1cbe9b77dfd46083dfaef555474c7a860b6acbe8366064c0c5ae7e25813000da2e38f9685cdab249bdb6b1d59ebe09fc966b6e8f9ff657cf435d557fd6d0c300a0e099c2be884be9ed58dcfa0af81ffba4141d04e29179ab6773e54901ab45d86ba2c2768635d776b8f1e4cf965dca7f06ee5c3d0c09337aa5d861421014a6c9eccc54fa9ed877e894c86826fba792115a89a1ef4f5ff90b2eaafb4cd6cdb61839acb61f30e8b2d3046b9c29f94bed5883993910b115be5ca04cc0f218bec121981f7e397e27b816317c438d6cbd9714954b73d4220bd612613b018f5de466df7dbafbf77cde4b248b371a23f264c0303a6f390d7c39c753b344e4c0c23beec35b42ea911fb821680c140b98b3149114809f42149307ed4b81fd7f689c31de2c69da5ddb3fe249f41b2db40ae96aace69fa88b94405947b9a439f85d37180abe7c51d595b05b91f009261caf00ab32d5fedc6d8e8d24a3f68029a7258dd23ba18bcc156ebb6ee0cb84ebaaeee80e48bfd588c2a6039d1602b7dabbffed6b0fee66d1fa324668801199750f3a42a674c313af770377680cb20bdaaa73234cbff649bcb9e58b6afa4501a196a2437ad3306783bbd182841c7bba0efc19f0eb90877d87ae683bf8f5d4aaaba1f628427226688989cbef2681acead932a493cf91ea4d3625a96f6f2adf285d242b998c2e8b3de165c16ff217cd0a33f7ff73c33d2cf36e3bae5c33354d7e8944a0ef01a03a79ac0ae858c1e43c033cd5ef7374af7cdba41ab036f8cdb358f7ac79a3629e7a7aeba3dafb61bd28f916ba6b33e3d0699822706cb54b22e0d72dfed42f53d40d78e8971e5e812970fb48756d2a97b94f949a534c62eea783a5767fef720759470c57b44bce1f2fa67903112b1fe9e976f8cef01f80b5e6d3b968b05abef768a55ad56199289e38c36eeef5e60a05a714a3ac71358bc352fa0ae8d4b56b4347630b66c09c76051562b9e6eb984d88533ed229f9420659fbd46d9fdd9376ba6a9776dac4bb726e739bad0ceeb10bce0c5ff3bd8328a4660f157452ff2d4b26e0ec73ef257409697b588a23a9faf950a56838f40096a921c61c39a65cf04b601bc0c52c7fedc41a90d5993f7b5c5eb0233859f8e5891011d715b846c941ad0a8845c84e783dbb0d0b2fef5a870a5d0a411c3575e21fb84786495f1439acd0f3130bd9d22feca57d9ed525bcedc1101d162f506279b6d67fe9358406e02882bcac39eed7afe6544f3a298024de1b205033c2216932f42e17144ad42e0efb96cbcf881f83633079c86f8b0cb1c5e872c8b5e4f72f6a12f5ba8e41e98b9ef6913ddba5f0103bff5a2fbad223b20d6287a7e4d32f21d47b0b57d09a4e64d5d4a7964828c794d0fcdf1c5cb2af289ecbff86a9d169700c0b24f2800c11bd4630577f92200e6ac1fb90b1191bf01fc6237a0b1d29a82dd4b1de04ae7cfa21c5ed75cc800cecf3c6831bc69d812b36bf4cdcdce799477494bae6baef3a803a36a39fd1d78cc1e3c4d508002e00", @ANYRES32=r2, @ANYBLOB="edf8e8ade6ec338c138620968c967ffd9b365212d015907c5613ac700d1f077a15808c20dbca1d5e6a5cdcc3b05890db5a5ad178bbbcec7159f6539d313988dd0987e5df210393212d9d827ebfcbaeaec4432e55ec400d618f9a41de673567ab8fef187b9ba946b80b86f53b46d62acc8e4dc8931f2a8a895ef9c96f40445d9ded02b36048a2a2806ae1eef12ae46ca39b3afe4a9e6090f4bd900d40f7b7b451b2c6ef151a60825dc2672b03a6ca0a35a95cb5effb06a35135fe9335cd80a04dbfe2ab2403c5d43166c26e289069c94bb6f4666862e6ba1375c80b5236e536ccdc169b0a2008ca360747745d730c30072959559d476eeb4172ab31cb49450b693cbfa73214ef180800800018ddce801754f9a965665a8d9e43c004cb40350b409c1a55da9851db139242a11bd3959a53400600a539981c22834cf048e1c23a814ca610591885f625243bf4251559c8b3e9ff96eb319e927e66", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00'], 0x1160}}, 0x40000) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000080)={{0x5, 0x8001, 0x81, 0xc5, 0x2, 0x7fff}}) openat$capi20(0xffffffffffffff9c, &(0x7f0000000240)='/dev/capi20\x00', 0x20000, 0x0) socket$l2tp(0x18, 0x1, 0x1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000280)='syz1\x00') 18:45:59 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)=""/37, &(0x7f0000000040)=0x25) 18:45:59 executing program 2: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0xd0000, 0x0) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f00000001c0)=0xffffffffffffff9c) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r2 = dup(r1) setsockopt$inet6_MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0xb}, 0x5}, {0xa, 0x4e24, 0x200, @ipv4={[], [], @multicast1}, 0x3f}, 0xff, [0x3f, 0x100, 0x6, 0x8, 0xffffffffffffff81, 0x41, 0x5, 0x20]}, 0x5c) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-arm64\x00'}, 0x58) ioctl$KVM_GET_DEBUGREGS(r2, 0x8080aea1, &(0x7f0000000200)) [ 3237.083724] binder: 16619:16626 ioctl 40046207 0 returned -16 [ 3237.104118] binder_alloc: 16619: binder_alloc_buf, no vma [ 3237.120784] libceph: resolve '.u [ 3237.120784] ' (ret=-3): failed [ 3237.180394] libceph: parse_ips bad ip '.u [ 3237.180394] :d]:.,[' [ 3237.190731] binder_alloc: binder_alloc_mmap_handler: 16619 20010000-20014000 already mapped failed -16 [ 3237.204821] binder: release 16619:16622 transaction 903 out, still active [ 3237.249132] IPVS: ftp: loaded support on port[0] = 21 [ 3237.257901] binder: undelivered TRANSACTION_COMPLETE [ 3237.264892] binder: send failed reply for transaction 903, target dead [ 3237.431189] chnl_net:caif_netlink_parms(): no params data found [ 3237.487605] bridge0: port 1(bridge_slave_0) entered blocking state [ 3237.493989] bridge0: port 1(bridge_slave_0) entered disabled state [ 3237.506835] device bridge_slave_0 entered promiscuous mode [ 3237.513924] bridge0: port 2(bridge_slave_1) entered blocking state [ 3237.524881] bridge0: port 2(bridge_slave_1) entered disabled state [ 3237.531963] device bridge_slave_1 entered promiscuous mode [ 3237.558135] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3237.573993] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3237.598770] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3237.606583] team0: Port device team_slave_0 added [ 3237.611970] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3237.619447] team0: Port device team_slave_1 added [ 3237.624984] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3237.632239] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3237.692726] device hsr_slave_0 entered promiscuous mode [ 3237.765001] device hsr_slave_1 entered promiscuous mode [ 3237.836870] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3237.843823] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3237.859248] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3237.892286] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3237.901118] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3237.910183] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3237.917144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3237.923911] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3237.935465] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3237.941522] 8021q: adding VLAN 0 to HW filter on device team0 [ 3237.949996] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3237.957572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3237.965757] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3237.973366] bridge0: port 1(bridge_slave_0) entered blocking state [ 3237.979728] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3237.993959] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3238.001939] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3238.013945] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3238.021674] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3238.029659] bridge0: port 2(bridge_slave_1) entered blocking state [ 3238.036013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3238.045024] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3238.051846] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3238.061490] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3238.069757] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3238.079822] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3238.086995] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3238.095233] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3238.104714] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3238.114497] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3238.121775] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3238.129020] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3238.136788] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3238.144415] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3238.152397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3238.161247] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3238.170647] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3238.181311] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3238.187380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3238.194197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3238.201730] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3238.213358] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3238.224225] 8021q: adding VLAN 0 to HW filter on device batadv0 18:46:00 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000060ffffffffff0000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:00 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x3000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:00 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffe71) 18:46:00 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x10082, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/188, 0xbc, 0x10000, 0x0, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'veth0_to_hsr\x00', 0x7fffffff}) fchdir(r0) 18:46:00 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) r2 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2) r3 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x100000000, 0x402) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, &(0x7f0000000200)=r3) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={r1, @rand_addr=0x7ff, @multicast1}, 0xc) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f0000000000)) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000040)={'bcsh0\x00', {0x2, 0x4e22, @multicast1}}) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) 18:46:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:01 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x18000, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r0, 0xc0385650, &(0x7f0000000080)={{0x3, @addr=0x8}, 0x8, 0x9, 0x101}) r1 = socket$alg(0x26, 0x5, 0x0) pipe(&(0x7f0000000000)) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) 18:46:01 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x400200, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) bind$can_raw(r1, &(0x7f0000000080)={0x1d, r2}, 0x10) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3238.349746] libceph: resolve '.u [ 3238.349746] ' (ret=-3): failed [ 3238.358806] binder: 16680:16686 got reply transaction with bad transaction stack, transaction 907 has target 16680:0 [ 3238.380388] libceph: parse_ips bad ip '.u [ 3238.380388] :d]:.,[' 18:46:01 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x100000179) 18:46:01 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) r1 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x8000) perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0x6, 0x5, 0x8, 0x101, 0x0, 0x7, 0x82, 0xb, 0x7, 0x23e, 0x4, 0x3b, 0x5a93d439, 0xff, 0x0, 0x2, 0xb01, 0xd0, 0x1ff, 0x1ff, 0x0, 0xf07, 0x9, 0x7f, 0x2, 0xfffffffffffffffc, 0x360, 0x7, 0x6, 0x6c9c5d2c, 0x100, 0x5, 0x1, 0x10000000, 0x9bd, 0x0, 0x0, 0x7fff, 0x2, @perf_bp={&(0x7f0000000040), 0x5}, 0x8000, 0xfe, 0x7, 0xf, 0xfffffffffffff801, 0x9, 0x1f}, 0x0, 0xa, r1, 0x8) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3238.424982] binder_transaction: 9 callbacks suppressed [ 3238.424997] binder: 16680:16686 transaction failed 29201/-71, size 0-0 line 2816 [ 3238.449950] binder: BINDER_SET_CONTEXT_MGR already set 18:46:01 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x2c0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x0, 0x400000) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000100)={'raw\x00', 0x2a, "31fd28db3a2cc70c1ce98854bbdc53bf0645651688d2bc2dde293ec7a258dfed0aac17d7677066587dd7"}, &(0x7f0000000040)=0x4e) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3238.489025] binder: 16680:16698 ioctl 40046207 0 returned -16 18:46:01 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3238.574131] binder_alloc: 16680: binder_alloc_buf, no vma [ 3238.601530] binder: send failed reply for transaction 907 to 16680:16686 [ 3238.613160] binder: undelivered TRANSACTION_COMPLETE [ 3238.655043] binder: 16680:16714 transaction failed 29189/-3, size 0-0 line 3035 18:46:01 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000f0ffffffffffff0000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:01 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes192\x00'}, 0xfffffe05) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x11) prctl$PR_SET_FPEXC(0xc, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) 18:46:01 executing program 3: r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x5, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000040)) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) ioctl$RTC_RD_TIME(r0, 0x80247009, &(0x7f0000000080)) 18:46:01 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000000)=0x3) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3238.833029] binder: 16733:16734 got reply transaction with bad transaction stack, transaction 911 has target 16733:0 18:46:01 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) r1 = shmget$private(0x0, 0x3000, 0x300, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000080)=""/137) 18:46:01 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(rfc4309(morus1280-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x8618) [ 3238.889380] binder: 16733:16734 transaction failed 29201/-71, size 0-0 line 2816 18:46:01 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) getresuid(&(0x7f00000001c0)=0x0, &(0x7f0000000200), &(0x7f0000000240)) fstat(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000340)=0xc) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000440)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f0000000540)=0xe8) fstat(r0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r0, r0) r7 = getgid() r8 = getegid() setxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f0000000600)={{}, {0x1, 0x3}, [{0x2, 0x5, r1}, {0x2, 0x4, r2}, {0x2, 0x2, r3}, {0x2, 0x2, r4}, {0x2, 0x1, r5}], {0x4, 0x4}, [{0x8, 0x1, r6}, {0x8, 0x1, r7}, {0x8, 0x4, r8}], {}, {0x20, 0x2}}, 0x64, 0x2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r9 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x9a5, 0x400000) ioctl$sock_inet6_udp_SIOCOUTQ(r9, 0x5411, &(0x7f0000000040)) ioctl$RTC_EPOCH_READ(r9, 0x8008700d, &(0x7f0000000080)) [ 3238.977646] binder: BINDER_SET_CONTEXT_MGR already set [ 3238.983024] binder: 16733:16750 ioctl 40046207 0 returned -16 18:46:01 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) getdents64(r2, &(0x7f0000000040)=""/246, 0xf6) [ 3239.060400] device bridge_slave_1 left promiscuous mode [ 3239.083637] binder_alloc: 16733: binder_alloc_buf, no vma [ 3239.084057] bridge0: port 2(bridge_slave_1) entered disabled state 18:46:01 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) 18:46:01 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000020000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3239.144705] binder: 16733:16734 got reply transaction with no transaction stack [ 3239.188508] binder: release 16733:16734 transaction 911 out, still active [ 3239.196474] device bridge_slave_0 left promiscuous mode [ 3239.201033] binder: 16733:16759 transaction failed 29189/-3, size 0-0 line 3035 [ 3239.201924] bridge0: port 1(bridge_slave_0) entered disabled state [ 3239.209337] binder: undelivered TRANSACTION_COMPLETE [ 3239.250002] binder: 16733:16734 transaction failed 29201/-71, size 0-0 line 2801 [ 3239.259941] binder: send failed reply for transaction 911, target dead [ 3239.582230] device hsr_slave_1 left promiscuous mode [ 3239.664768] device hsr_slave_0 left promiscuous mode [ 3239.712276] team0 (unregistering): Port device team_slave_1 removed [ 3239.770488] team0 (unregistering): Port device team_slave_0 removed [ 3239.812934] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3239.901823] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3240.089998] bond0 (unregistering): Released all slaves 18:46:03 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x5000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:03 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(xtea)\x00'}, 0x39f) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000000)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000e00000/0x200000)=nil, &(0x7f0000e72000/0x2000)=nil, &(0x7f0000eb4000/0x1000)=nil, &(0x7f00000001c0)="fe5332ed65903e847cec732182ed2641bcb38d81607cb6cf46ff25b197f4930a1c1eb0fd4ddfef1c956e4497884de3805bbd008526b2e4f674eaf1737c208288afc4ac2c069e6898b99812bca4cb051bbff15ad99a93e5c643eca18dacd0b833333863b07d903cfab955550c03872ad37b9fc7ce1896f92dfa5b7d74c176c57126cac126865f203f198babb10ca646f4bb455eb0ec0e62889d77ae6ecaa1d4c54e39e9c8bc140b30770066abafb7023cc797df5b82ca0e1df64f0128f1b640d8195db5265a7f0be1f3d37b6e60cf4a057a28f812b0c2e185528f2172779c2429d3aa5befa04ff21e2cdafff995322bbd87db05835660c6a17256fabd0379dc7b31538eb0cef1a3095813154c9a44b345a9d718a27f51537db7e7e150c4ea1a247b9eb1c733d465393b8e4045972663a09e82009d82dea7359ea6dc848f2f7b6ff840a02f8a5097e7da4f2b264459509fa98d0e45c1642ea01313db82165efac3d6961394f63901f33c0c53bd62b83d58cc8f3be92c0fb0f37ce8186200498fe3e52aa275a38f44b4d1fe62e2eee6109e5e3f2b8174399c93f21f7c220f31124cd62962e9a9542f02cb3f82c1235cbbab3cc53f90d3c1f7c7b4552a849c2c22bb441a0a6dd4ae6254c03154a75d80fc47e1d5b25a9b70c40c886f7075352bf404eab35f799740bfd72ece8b177c2a019744bc53c3769ae3dc4d79309a324bebd7d295ca11aa4fa1843b856bb91ef6e9885ad2d7b941d8cdd167e10639648cae3905390ac0b455f055203aae9b2c1d8a50f0db355a8e18b1bdab962de3235082ca740ef8e33378a9e5a625042c9f512334d63496f20c001e6655623ae2f712954ff3db7a73d6ffe8ab8d86345e703da0b77664187310ac0848f261beebb2f5c35a777d8c88c91c2c4661c07fa1afe3caeaa0e5afc9288785b89ec272de02706fc0630b6c321fdcd2552b05dc21ed144dd13d3002fd7c8e1b73ef6ccd2e92db8fefe4a076bd200fbbb11c0a612d0cc7ff9e5a0be82303cedb5db03da5151d22f22312a2fb39babcafde9833207d1c7c1fb04948634c87fac85c4fdd3d55b950f04fd12e840fd781cb5adcb425df513488b36eb1f14ddbb86c97d33dad5d6f5ece02e510f932394dbac1a5e34f6608af912962fe4cbb8395da43e442ad253850465efa4ccbd5aa8136de97ab90c3164e0e09a57a914e44fa191b3ca1e208a67ccc558765e464e3af0976796bafd527ab573f270b7df9c5297d9f936ed7f9488a611b55272c4b4876e644d632a75511169661dc771a0f667051cbec3e450fd02b52c22a41143a19c06f5f07cae9b7385310184d72502d964e7de5690787f27fe8d8246851c5f9367e81577f432a2fe7cf345c7f1f89a2ccd1033799356c61769babe4c8fd818cb24782ac5b121f93fc2ec150623d237073564fa2fd14552fae2ec8f6d9ac320ca0b6fd939cd19e60b175fc2c1511be57d1ce4980b00638c20c73f0cccd791ec6fb3e0d2cc927e50add6ba6afd7986a94a2fd59423015588492fdb37cdcc177e3fb426d09126f592a5039e88b1a4d0f42708d5d8357c845c30f0226e09f708b3c9ee57e55a0a75a01fe8f0427275f1e263db080715880a41461d6e45d7931cb314fb57e9eda410a0316d3db52f78b82ba64f93391db0416caa694e00a70d45a4e870f56f8f0f16be460f35f29f6c033213a3826c4c242ade1cacda203f3c8e6272c7efa0b6c9d65f82f1f9f4f8881c5d5a53fc774b93e2edd25aa29acd90ca852bef91764f818d61c4541864cca78c6a91338ff216fcef122046cee255cce6f434d45ac7ba7d9364344fb000627dba9ae9bbb29ec006900303c4064e0cd8bcede678c7f658b123444890c124ad8b69d2294d69bbd6a6e3c032dcf8fb851d3d2255052dbf17650927500b2adfdc43f0dfeddc39fbce74fc5127a4189bab99f5de6c43be839387da896f897b5959291bd66f40b7d51934d04c960cd91e93720915773f8722654a8e6adc3f3ff465bc5ec4fc72af963e0886742535d31d59ec3612c3b9ad7cb3c6bc72d19b49d858402239f49a02b9399d3f911612d49e78fdb2516d043afa0307217d48c210dca0f71c1ab50aa1e8d794397ae82913bf576b4cd0d4c8b849da7609340f3bb0b0523f41b0fc310c404a33d28a6479803b18ddfb2e06a839707eb5886297515843c97adfb0692cb2b15822fcbb52b1d1f6957ecd4df2d1d13a9302b99e700709ce400562d9bb06ac4189af774abe035f1db4759424f691682f7d08a023931ee20f1f67544457ba0f4d906cc8041a3c9a986a9f74cadb4da573b8e85af7687766d9ecb77f62eb50dbc9840703fb50ae864830eb157b8a5013846797958e235077c6982a2b53355cc3ba33bad2c79ab7770db07d2a8e79234340bd33ab2b87c3ce94b23ad06d1ba981e2f93812fd62f3f953df60f3ec185c7f6cb3bf4d5f8a165547046ae0163c751b50720d58779aa717f86fbdba21161cf48f8cf8446ad815ee33281f96f3107801d5fa1bd2b3ad4d3c67bda7e42a21f1908b4f50e22899aa7c1fa71c000ed1990485a4a993950f7181878047dd428858cd697b3e827fbd5cb6ca8ea1dc27a1ff491cce75e08be922a1d75f0a9a9ec94c7cfbd317114b9ec6681bc530e0356876938f1c6c1ac07a520137dbf66b9918b281b9cb33c0fc53da4cfd06252a6e869dec758a58eb6ecb6ec573a299a565ebb357347aa75b5c8c11c323c3aabd3eb8e41bfa2b5b67c85b2c4bfce3d54c7058631beb1f4ce222d2b5874351b15d086ab31f01b5a984c2cf905f7a2ea8094ca0da2d256ac3c17276ee5d428ceb37632cc0219891940be35c5334f8c91d705745b397709af07834b6da9b7da4be72a6a3b5a32298137c69a0bb33382f5e226aacbdf4c59cb69ea44ef72594a7efd1e8b434aada288ef2083b6e38e51d697d7d131c83178cd616dc67204e227e9c52825d2a31a50db4a96aa8c10c1e35db72a0f06a392382d7b9efc7a9d30406a0bb86cfc58cb72fb5a175c51f0170e9b06ef6dd91f71244a4ceb221c2a5cab2abb6c4b5db73e9dcc7ff23be25d0d27bd3632d3067c87f7833f76b75d53d05891573506c9804e0e3e1e2095fdb3f77a957cfb3d0211398f2cb8efae74d3b6b643819a42a67a0ac57d740fc5f7d5df1d2c67c38561036d7ea10a0ed4a367a3c31ae1af4ad8c93a12c6ebf1210fd268e3d9266c1c34044992027122f33c429cd12e460b5b4197ddb3b6dc812ec2dd85bfacf4cfbc9e6f65066333ef43d7f4fe562ffbb4e042e90edfdafa401a8385af4f5abcbea3533916e8975de7c1e80b54d5ffd7fa9e22e6d0514e54db1837f18bde028cd68af41b9cead421f81808704342dccce83290230333f658b573cf40190abfacaed786050dc1811de3b20313eb89cf9cf408fd2279bbbd849de33b35a26028fee3f1d7334ff186f47ac8064f05f74480b151c898496e568cfe08e17ac9c1013b43c9ce983d807f53d80dfc7f6f4b8999d382a63a030051d9bf95ce8750751cfc13256bc117bd028d3a4c6ac7a54170d2502d64295b130d57f6c5c0fba2cd5d71406a7f4b10e5877cb4b33e420ea28ead11fa5ef3a6ff487ff6d5b8fc10d925f54c918c0048d181d80aad873713a0d57d7a7bee8e8ac09eb060e948ce97e9d7c4c6c1821440bb1cf221aeff58ad7e03d1ee8ba56dc32f285593adf43797e5ac054c56d899f08059d19f48c1efcbd6c52df612e427441d219bbc04cb3cf239250276b411dc7dce9de19da5e5298b9708dd38f12233a895b0a1a19a969265c121a66d25d12f9a461d2a4a0fe81d5c8c265124b695f2842a3c1d9f07d9c83262ae6f8fb7f55ad177e9f48878a611ba33ccb9a84021990b38da97af29fd148d0b517806ada2185e4d4d3dfbdbbf2b337a31894770dda95fe33df5c81daa77ee6378a2a656a9eb21de53840e531891533324927709ebcd5a4f03a811b26635bda41f8aea140c9783d3b7382d6aa86eb2545bbf38f20c97c6c645919e028266543f089803dc7e5c0d2bcaad840450ec92b1cb860e9f8bbd2707a70d143180683b87a46fed238fef00c6a14b49cfef9109c62bb7608dedb54ca65ddbff612647af78ca95ea95824a2da85111de93f9ca932235d9e3b99d20bc57c9ddfb212a9578e654c7808c2b381c3ff3976389a5ea6764991b458f0ca281e89bf842820173fb5f19fddb18d132dc594c3535a7771d0a0e2e97a11fdbf88ec7d09f6757b9c01b7ae07b912e462f5b8d56bd49b33de89e5da7468004cf1cd41bd1ea203610618c5b79147b1fa42c9ae5d8b7bdcf6caf6e33e32af46feef35a776a518cefcee252546f685c45a2284dd9a3dbb50e31d680463df20c914e0f98d5ac76cdfcf2f9e4cf506ee5a3b32355c85480de08c927a8c51258c56705d9701b83c17245fff2b9ef230bf18eeb9ca2af835cc152738f0aca34b66a4b1736ee4946982001cc006b2ebb7749ed8e3686ce7e6888869839e784f54510d8230c0acc58b2fa276290b46ae7fc9b66cededcd84aeb8bfb79d8147bb7435226f9ef684495864557c13dcf136ae5721e29fc22daba3a410472cc4ac18d1010bf401650fdf4083a01e46a563011a54bb3fb58c72ca96d444d8045582357186cb362eec40b2ef757df45a2aabf03156b52336963f1461cfa09546deeb3ac9dca10122856d70277be97979e121da272e1e9c9bf6a436cf2ca330088151f0e17a87ddfad6128705305b222bfe2d2bf449fafaaad5ce512a8528c282674155898dfc24c130792be1c9d887fb78b2168b9af6f5326b7c39f92158bd65326de819a15dc5c45eca657940e288731332a541fca76e39a0aa5817403c96f7f54c6eef469558554fdcc5f1d6a0aeded79f01df8228e353138d579ddb64a14f44280f1f69b2623f6e583e65e1c0c63b55fb8eba566e215fab60a90de5634e9ca03facbca735fd376a280b5b99c684b2144155777a5920a6ebea10ed39c33cb778c8c09f45ee9d3b7b09009a58e6ee2f92bacead7a598ec7e2eb7a39281fdcaad0743db49a578f4b452feea899ffb7c50cd07b187b69c42ee81a20d381f36b4a2ad41b44392bde258873be3d34a83f31c03f59a9f45eead3a3ab8e6ba06439bc01c8a183f486ecb7ec92ecf33de62eeb481ed2ad3b883eee7f8e04a7cec0a37eeea6e4b5c289d63ad9d22142b82e36d29a89546dee0b705aa1e8f820da340ff0877711c61b119857b6fb61c4f70f6c3544ea435d3981d79da1d514c3d25343295b38c49e2602767a54cbc97eb22b63ccee4658ce38486c3c6a568e0a7b1909c6e80946f55f07d190343fca2b1df223454f9bf7215b801965a4421e93e4035a233a53a5a6750c99f143b175308fbffc480e27388a55a2dc7b090fa7c95a00847f675e3ef3dfe9f8854c3c33de8ea433a99c171284d67ce75168f0c392c8d11c7c6115a17c147f7b293ec76ab473903a00bd2bee600f78e15a98430a82721cbc94b405a0e0753a8dd714669af3e9a4ce54580209f84917cd82e6f0f4ac93c33d0dd672e8af5e4cbac45bffb57091383a84a0c8de12d46f25ccdf10915de5e836c8349b6acef5bc06566d28fe288c0c5ffe1db36b5bc105bc6e260825e6edb981c3769a63d1496e531806ddc6eeac5a5ecbdb61b45f852b34e1f68ec4fac77f90963ac6500a1bfe1cbaf6dfdfdeecf39c1cf99d4b33acbd41723a8c470a57b4fa1881ae7b4dc6a3d569327a33f54482d231c24c2327cf686fad8eab4f40a530ff30600d46923cc7e23ad33765998a204bea6af60", 0x1000, r0}, 0x68) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:03 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec\x00', 0x2, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x1b6) 18:46:03 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000f00000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:03 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f00000001c0)=0x1e) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfd97) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x8, 0x101003) ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f00000002c0)) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000080)={'vlan0\x00', 0x600}) prctl$PR_SET_NAME(0xf, &(0x7f0000000040)='system/posix_acl_access+\x00') fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000200)='trusted.overlay.upper\x00', &(0x7f0000000240)={0x0, 0xfb, 0x75, 0x1, 0x40, "1310e82f76be3c2030bb95a20a894a0f", "4a88661eaf44f1c745f9cac241bfcde4966cd224acf3b77e2383a3f4b0c6decc819df57c1dc4765456d86af2ecf9197966a7a7c953707e4bb76d46235113b7ef1b2a0aab013f88dfa1ff8712fd0ef771224ced0e08041e7f23671bf9ceaa2081"}, 0x75, 0x3) 18:46:03 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0xffffffffffffff2e) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000140)={0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x101000, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000200)={0x3, &(0x7f00000001c0)=[{0x0}, {}, {}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000340)={r3, &(0x7f0000000240)=""/200}) perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x3, 0x4, 0x200, 0x4, 0x0, 0xe9, 0xc0, 0x4, 0x9, 0x2, 0x8, 0x40, 0x5, 0x40, 0x6, 0xf680, 0x7fff, 0xfffffffffffffff7, 0x38c4, 0x7, 0x7, 0x1, 0x19, 0x4, 0x1f3, 0x6, 0xa7, 0x90, 0x80, 0x7, 0x9, 0x5, 0x5c, 0x73, 0x5, 0xfffffffffffeffff, 0x0, 0x4, 0x6, @perf_bp={&(0x7f0000000080), 0x9}, 0x8, 0x100, 0x80, 0x0, 0xf317, 0xffff, 0x2}, r1, 0x6, 0xffffffffffffffff, 0x0) 18:46:03 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x200000, 0x48) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f00000000c0)={0x4, 0x7ff, 0x0, 0x1f, 0x88, 0x8}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xfffffffffffffd58) [ 3240.463954] binder: 16783:16784 got reply transaction with bad transaction stack, transaction 916 has target 16783:0 [ 3240.501367] binder: 16783:16784 transaction failed 29201/-71, size 0-0 line 2816 [ 3240.568851] binder: BINDER_SET_CONTEXT_MGR already set [ 3240.574159] binder: 16783:16799 ioctl 40046207 0 returned -16 [ 3240.613297] binder_alloc: 16783: binder_alloc_buf, no vma 18:46:03 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x2a7) 18:46:03 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e20, 0x80, @rand_addr="f90ecdf5024b9a9c7940e4ce838c682f", 0xfffffffffffffffd}}, 0x1, 0x8, 0x8, 0x2, 0xfffffffffffffffa}, &(0x7f0000000540)=0x98) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000580)={r2, 0xa27, 0x9, 0x6, 0x4a4, 0x400}, 0x14) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x40) 18:46:03 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-sse2\x00'}, 0xe04d007073221e1c) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mISDNtimer\x00', 0x2, 0x0) [ 3240.656913] binder: 16783:16807 transaction failed 29189/-3, size 0-0 line 3035 18:46:03 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000004000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3240.744514] binder: 16783:16784 got reply transaction with no transaction stack 18:46:03 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x8, 0x4480) setsockopt$sock_void(r1, 0x1, 0x3f, 0x0, 0x0) io_setup(0x1aa793dc, &(0x7f0000000000)=0x0) io_cancel(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x3, 0x363, r0, &(0x7f0000000040)="9612a0b2de06ad3423eb7bd8bb6b203397e24aadc02ca97ddff178868895a63c09c287e7dac4918641908178ed4422e6d96b1695c31ebd565da7d8a8c9a42457c374bd36a79ee1f7a1e666959e34a31710efd8aaf138c883cda1e502d032f23868ac58dea082a92e566792d83daae8fc0ec8c731c8e290d98255fb08a48ac37b1fe8aba3f9c9a935ba99558d327dee6eb5494bc5d2d61f58f51132836db93e857cb30beb27d343c1924531a06d3d3f8c5065e543acd7be8b34cab1748166a7ff97c718bc46f457b7f22eabf64174b377c1b746c7803474b172905cd2ec1e62ee4c5ddab578bb", 0xe6, 0xef7}, &(0x7f0000000200)) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3240.787432] binder: 16783:16784 transaction failed 29201/-71, size 0-0 line 2801 [ 3240.803023] binder: release 16783:16784 transaction 916 out, still active [ 3240.837621] IPVS: ftp: loaded support on port[0] = 21 [ 3240.841478] binder: undelivered TRANSACTION_COMPLETE [ 3240.869717] binder_release_work: 10 callbacks suppressed [ 3240.869722] binder: undelivered TRANSACTION_ERROR: 29201 [ 3240.908146] binder: undelivered TRANSACTION_ERROR: 29201 [ 3240.925151] binder: undelivered TRANSACTION_ERROR: 29189 [ 3240.959881] binder: send failed reply for transaction 916, target dead [ 3241.010819] chnl_net:caif_netlink_parms(): no params data found [ 3241.048822] bridge0: port 1(bridge_slave_0) entered blocking state [ 3241.055844] bridge0: port 1(bridge_slave_0) entered disabled state [ 3241.062956] device bridge_slave_0 entered promiscuous mode [ 3241.070341] bridge0: port 2(bridge_slave_1) entered blocking state [ 3241.077120] bridge0: port 2(bridge_slave_1) entered disabled state [ 3241.084341] device bridge_slave_1 entered promiscuous mode [ 3241.103179] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3241.113375] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3241.137443] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3241.145357] team0: Port device team_slave_0 added [ 3241.150725] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3241.158169] team0: Port device team_slave_1 added [ 3241.163370] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3241.171557] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3241.256156] device hsr_slave_0 entered promiscuous mode [ 3241.354828] device hsr_slave_1 entered promiscuous mode [ 3241.435147] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3241.442206] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3241.471900] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3241.518695] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3241.532422] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3241.541927] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3241.553113] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3241.562039] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3241.576208] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3241.582357] 8021q: adding VLAN 0 to HW filter on device team0 [ 3241.593853] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3241.600922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3241.609096] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3241.616909] bridge0: port 1(bridge_slave_0) entered blocking state [ 3241.623448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3241.632622] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3241.641209] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3241.648608] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3241.656620] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3241.664234] bridge0: port 2(bridge_slave_1) entered blocking state [ 3241.670623] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3241.686392] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3241.694870] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3241.701737] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3241.709803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3241.719105] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3241.726817] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3241.734423] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3241.742107] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3241.750442] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3241.759865] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3241.766877] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3241.774415] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3241.782713] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3241.796634] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3241.806141] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3241.814012] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3241.830614] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3241.837688] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3241.844436] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3241.852266] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3241.864311] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3241.873005] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3241.913992] libceph: resolve '.u [ 3241.913992] ' (ret=-3): failed [ 3241.921377] libceph: parse_ips bad ip '.u [ 3241.921377] :d]:.,[' [ 3241.965025] libceph: resolve '.u [ 3241.965025] ' (ret=-3): failed [ 3241.971535] libceph: parse_ips bad ip '.u [ 3241.971535] :d]:.,[' 18:46:04 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:04 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x3df) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000040), &(0x7f0000000080)=0x4) 18:46:04 executing program 5: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x257) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000040)="9433e32e170fcaf38a3d6c2e76cf763eb2c61402ed43ea0d0c13ee59814dea5bbfa1aca780d058da42efb2e20c32f4d7bc2c79d4cc332f53329c79b3c7a980ca50557c9257553b46853109434d8b965eae4c1a4ec57bfe83aa9a5f3c8743ec67f33e71fbeeb982b592479b4e560c578a3406fe3b1a002f995bfecbb92e4f", 0x7e) 18:46:04 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000ff6000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:04 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(morus640)\x00'}, 0x58) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x505000, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000280)={0x3, 0x0, [{0x5004, 0x7c, &(0x7f00000000c0)=""/124}, {0x10d000, 0xe, &(0x7f00000001c0)=""/14}, {0x5000, 0x5a, &(0x7f0000000200)=""/90}]}) [ 3242.202298] binder: 16852:16853 got reply transaction with bad transaction stack, transaction 921 has target 16852:0 18:46:04 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-ssse3\x00'}, 0x16) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:04 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000007400000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:04 executing program 3: openat$fuse(0xffffffffffffff9c, &(0x7f0000000500)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x22) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000080)=@broute={'broute\x00', 0x20, 0x3, 0x310, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200001c0], 0x0, &(0x7f0000000040), &(0x7f00000001c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x0, 0x2, [{{{0x9, 0x40, 0x9bef, 'lo\x00', 'ip6gre0\x00', 'veth0\x00', 'irlan0\x00', @dev={[], 0x1b}, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[], 0x24}, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}}, {{{0x1b, 0x1, 0x88f7, 'syz_tun\x00', 'eql\x00', 'rose0\x00', 'veth0_to_team\x00', @dev={[], 0x2b}, [0xff, 0x0, 0x0, 0xff, 0xff], @remote, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], 0x70, 0x70, 0xa0}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x9}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x10, 0x809b, 'veth1_to_team\x00', 'team_slave_1\x00', 'bond_slave_1\x00', 'erspan0\x00', @local, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], @remote, [0xff, 0xff, 0xff], 0xb0, 0xe0, 0x110, [@statistic={'statistic\x00', 0x18, {{0x1, 0x1, 0x100, 0x1, 0x3, 0x6}}}]}, [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0xfffffffffffffffe}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x10000}}}}]}]}, 0x388) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000100)) [ 3242.252080] binder: 16852:16853 transaction failed 29201/-71, size 0-0 line 2816 [ 3242.283136] libceph: resolve '.u [ 3242.283136] ' (ret=-3): failed 18:46:05 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) accept4$alg(r0, 0x0, 0x0, 0x800) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha1\x00'}, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3242.314715] libceph: parse_ips bad ip '.u [ 3242.314715] :d]:.,[' [ 3242.327354] binder: BINDER_SET_CONTEXT_MGR already set 18:46:05 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000001c0)={0xbc8, 0x40000fff, &(0x7f0000000040)="fcd7fe55c53da8ad53a49f4c637b6a5bfcada7dfc1124bb5bffc327cec7d814d873b5a617da1d1b531bc85244fc24954acd29d723584b58e43bf74480892aafedcf04b68bd300dde5c46f606fca0410c5826d4c85fd2f69353e73213b312e9f7ee", &(0x7f00000000c0)="74c26a257703ee3dbec950d80fc05ac9a3f444f3b23fe18ab398ea90ec9aa2e0c4b48a0447520e08df92cfee3f20b53f3d77a63524d0f753ad8b56d52a5b0d1e87c28160296ffd29f87b732d8eb57dac970bfbec74a846eafddd0b7862e72b", 0x61, 0x5f}) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000200)="b9800000c00f3235000400000f30c4e1b171d50b0fc71d6939933ac7442400880e0000c7442402050b0000c7442406000000000f011424f01952a665f083484029660f011a660f32650fc71bf20f01df", 0x50}], 0x1, 0x4, &(0x7f00000002c0), 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x199) [ 3242.390270] binder: 16852:16883 ioctl 40046207 0 returned -16 [ 3242.419921] binder: release 16852:16853 transaction 921 out, still active 18:46:05 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x0) [ 3242.460501] binder: undelivered TRANSACTION_COMPLETE [ 3242.487932] binder: undelivered TRANSACTION_ERROR: 29201 [ 3242.493526] binder: send failed reply for transaction 921, target dead [ 3242.505275] QAT: Invalid ioctl [ 3242.532826] QAT: Invalid ioctl [ 3242.544691] QAT: Invalid ioctl [ 3242.547992] QAT: Invalid ioctl [ 3242.551377] QAT: Invalid ioctl [ 3242.587704] QAT: Invalid ioctl [ 3242.596016] QAT: Invalid ioctl [ 3242.599310] QAT: Invalid ioctl [ 3242.600118] libceph: resolve '.u [ 3242.600118] ' (ret=-3): failed [ 3242.602604] QAT: Invalid ioctl [ 3242.612797] device bridge_slave_1 left promiscuous mode [ 3242.618537] QAT: Invalid ioctl [ 3242.621835] QAT: Invalid ioctl [ 3242.625180] QAT: Invalid ioctl [ 3242.625555] bridge0: port 2(bridge_slave_1) entered disabled state [ 3242.629355] QAT: Invalid ioctl 18:46:05 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:05 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0xfffffffffffffdc9) 18:46:05 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000018200000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:05 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) fsetxattr$security_ima(r0, &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@v1={0x2, "65b17a60c55c6c312a9dc0"}, 0xc, 0x1) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x400, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f00000001c0)={{0x2b, @remote, 0x4e21, 0x0, 'rr\x00', 0xc, 0x8, 0x23}, {@multicast2, 0x4e23, 0x3, 0xae, 0x80000000, 0x80}}, 0x44) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000000)=0x9) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3242.638133] QAT: Invalid ioctl [ 3242.642359] QAT: Invalid ioctl [ 3242.645752] QAT: Invalid ioctl [ 3242.648236] libceph: parse_ips bad ip '.u [ 3242.648236] :d]:.,[' [ 3242.649039] QAT: Invalid ioctl [ 3242.658583] QAT: Invalid ioctl [ 3242.661901] QAT: Invalid ioctl [ 3242.665248] QAT: Invalid ioctl [ 3242.668533] QAT: Invalid ioctl [ 3242.671819] QAT: Invalid ioctl [ 3242.701768] binder: 16910:16918 got reply transaction with bad transaction stack, transaction 924 has target 16910:0 [ 3242.714786] device bridge_slave_0 left promiscuous mode [ 3242.720746] bridge0: port 1(bridge_slave_0) entered disabled state [ 3242.727660] QAT: Invalid ioctl 18:46:05 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) open_by_handle_at(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="c6000000000000004d12afae458c7259e21d77eee26337f71fd939fb9a02621c81d70295715d6a4c1e7ecf817d771af7c62ad25ea971f70a528d49941ab86e5863793251a86e3fc76104387ef58946c276d1235eb43750b56e3708b34459902bfe00d953373cdf0537fefd837db706f8a76e7de9a89f4d07213a314cf2ff7af78112b8388a2badd44ad6dec08b3e28a24ca36dbae24dc0cc4264627fcf71517587379223fcff014291916d3bc5535b58efab8e7aeab09468d0482b1ac210ca75686a5bba275b"], 0x200) accept$alg(r0, 0x0, 0x0) [ 3242.744961] binder: 16910:16918 transaction failed 29201/-71, size 0-0 line 2816 [ 3242.747555] QAT: Invalid ioctl [ 3242.752614] libceph: resolve '.u [ 3242.752614] ' (ret=-3): failed [ 3242.755847] QAT: Invalid ioctl [ 3242.773826] QAT: Invalid ioctl [ 3242.790398] libceph: parse_ips bad ip '.u [ 3242.790398] :d]:.,[' [ 3242.793512] QAT: Invalid ioctl 18:46:05 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:46:05 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x82000, 0x0) getgid() ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x5) [ 3242.820517] QAT: Invalid ioctl [ 3242.831006] binder: BINDER_SET_CONTEXT_MGR already set [ 3242.836427] QAT: Invalid ioctl [ 3242.839607] QAT: Invalid ioctl [ 3242.842787] QAT: Invalid ioctl [ 3242.863047] binder: 16910:16929 ioctl 40046207 0 returned -16 18:46:05 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x10001, 0x20203) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f0000000040)={0x9ba8, 0xa827, 0x2, 0x206}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3242.908803] binder_alloc: 16910: binder_alloc_buf, no vma [ 3242.948890] binder: 16910:16918 got reply transaction with no transaction stack 18:46:05 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x8001, 0x101000) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000040)) 18:46:05 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:05 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes192\x00'}, 0xfe0a) r1 = add_key(&(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f00000001c0)="c5e0c2389a26db39da9a2c109e90225cf91cde981bfd4c67097096bfd2d483bbc3889dbe30a97a0a26d5c62d1ae6c7c64a69837c8c5e2263b349f99042b51d25443833bee2cfec4c25c5ad6efbfe6781e19e81a980504772a22b02c90d6b817f9d56c3642500aacef440f3d6f3dba25e70d87684effdb177bdaa722ac006ca5d0e423eda0e13e7d137ea7613a5d07c138246a268b528ab37ff410b12aa5f72b766b2e48d718a5421a05d2c9bb537de2afa37946e6f04d609303196e547c7472521b394d9403e66a53577c7b36e1a6ee8b1ec5a4a4cbeb0c4dca511c6a0cdbbdf973a582cbb67b3f6440a732521cb1c62162c03b952e172110808d886b61d81fcf1c158a90ac82c3ca1c700d2718ec2759d1c6dc9c13d84769b3d7e1e3578cb38cf7597e910820a0ab51c2044045e46dc9de1ff8ba194e17129ff0fc2c71c48e348226b18ede9c96f8231197a0ebad015ec6e0b916854c6f69eb20e4289b46cbfe55ad1d352ee900ed3a66480be96b21baea53c22195d50603d2c49a61a4c6ccd5c70b1c9bb2cddb7afbca8f6a8770dc3057cc02882ae60eef3711bc205a44a749594fedaf2e1d57f81d620cb9ee9881503091f9e70be4b216404c0ab6a278853b131c9b86b6e06199bc19fd1ab9a22a014cd410ec4f1d2cf767da2e1767fe4e3511c481472a7369f1b50bcad7f337b78ba712b882fe9bda5ecae8d328266bd8f0a354aebc4241c4a3f3880e3e24de7b6024bf86521bbbd30bacbe49cd986d3b4b76c4c66e5dfa300cd53fe08e9031caa749ab487b2bf90b4abfad0b659df88edd9970e67532ee95130cca5eaa465f0dcf2026219063ee7b665ce06508d656e95f6afa7a6b8438da091cac2add3ab1165dbc3f3edd19e569a7f6a653654415275a34b636dcb946776350359638ce212b636dfed3e28de8f9001a84debabc69d52fc383ba3f76efb85b4a1e016c06c262c13173d7e2b3a5378ab849f2d372068256bc76e449e1b8d3f6257dab3870d85f82c28b5b9b51de6c4c40deb5fd875f831e253a75021acc20ab9ed9048b1f2936729f384fd3d1dde36e12763670df2ebe22b9eff9c13840b5d03184a436a6090b8c69fa4b9f09b2e4d7cd51dc7aa2a73086a962538a38861f2a7817f53b7476f85a112b7992495a480a5df1a9fd5a5e2b3e4ccc76fef66b6d5bf1e20f18276429f19dc516048c540f15909525c072661e19e4aac6ce2337a887d66a177de4fda0bb2647869e33cb928de0fe9f8269ee4e1da73ad046fdba90cb79faf6a949b1eef56a3d70501ad05917544c62180d5c65bd9a1f8db28f14d12c21b225ca57bdc89c007caa3f7be659938c2e36aca2d2c0b86e4eb8f6cbc48271e0f045dc4e93b16cba8e988a2ee7bca6bacfef500f3dae169def171e593d595806c0494d7e639fdada27c2aff829ab67bd4af96ecfc6729fb27cd77df129c600c02f201509507eeec4a3c705b5ea56f61c3c4b46af3b342e98f570f28f6b5c90e1ba7c962cdca88d6aca5e92a7657d86f4a62f5d29c2ac0a1e92729405b35c0d0628c9ad3511d9d250f55f659ac0ca2834c51a2583f054cd564c815856510802ad9ed35aaefdd632d96b0cd289f64345362027afeb2049278feca5d48873c877cdc17d3fb4248587b8ffb60c400905406875509491d88f786650b2a33ebfe365d1b2e6a8670b1b85d3bbbff1910a7b3e1c86bb0c11311d33868ad82e7845ff664fa6fb715db9308cf7ad2bc2ec357c7928445599f165fdf622f16b51c0965b0cec4108bd712aa11c1561c1a4f7523d73dcd57af5a74383536e9457499fa084e575ceb700313287a4039a5f9b1338b47e4ab302921b8bb73b65a8fdb8be99d08c63c774bc1f0ece06a9f490d2c0eba79d7fa7b803f5bfeaddc7dfcc695ec8011c5009214e8660354b326e764461f9116e733c99a8cbe33493b25ac687a64090fbbcd8fbc02e9f7cbec791db8b1b3b28c5548a198601df847fa52cf53558a910bb5d2b5bac16d37a6a52f97eff2ed07e266977ced78def52c2543ffeac67ad54f732679d77f8bbca2d4d7c553f074dd5840b0773690e852500309a89e339398251982404a009c1fc337b0d191bfa1ac3d064ef29555fabd6e7b7c7e4298d8cf0e6741efdaf4bd06b58339341762229adbf594e690609e6e83b3ba31450b9d87e6f26029fc2b36fef93d018d3d33fe9440113bc6b59e2f1faf5f2bc912b6fa5aaa57e909f4135dcf861c9fe331ca06b409b4c531773f9cd155be5c102ea002a33be6db8e52667859ac5058a8fc4930a3fce575967f104f8fff7b819dc677e3809d18da351a3094ad1f94789508c620d36bd27f82f9afb62ce15b438845af677dc1a8fd1103662aa5cef39f3cf9caac62015618c88856ec2dd990cd58d84a27add844f3314f3e967c1b3c7b395897d31d599cc5c9d11785d891069ced4ab900f407312de622256d4c7fe7b3d6d13d97c7ec871cfc3efd052f97c2020d1a18fb29291a1d21eed89d5338fd77dd4242282dd696bd4a38f77db58d1a8e6367026159f8f624ff6c011256cbbf6eb94a55b35068ae5e11eb103c093662eb8475c192f5f93b81f2dc913238ee2932e8f8d50dc2ec2e9c42a80a723c31b53255003b2fb782cec550098aeaad93abdb7660a3c4d9e1093d8ae8c79fae8f9696cd41f6517ffa59d1e59a9339cad038217b4ffa022b6548490357d3eb08637a235320f164289aa749cb44e99c969780a451b5536ae054bb237d505f64d7814bf066d2e64abe2801e82db0ee5940e1ff78329ff8db3e940c0d8ebe0e72dfb840e9e3b4bda0e2d8272b82cbbb0f50c40b24549ffe6c8d4a4fd3c6463f1db446d2b7072c5ccfa27dbf3dd6beac35abd4c75af2000720dd90c0970b9acdcdca797bfd61a4bd1878a0fc0f95cac4b4208964e0e253dce0b999a96e5a8f5553625ad5680cecdeeed96aeaefa91187300041e6337c43166ed0fb472e1747d74ea0b36ba87480d0a51b292e1d7637661027bf6ae949b822d60aad17b455b1a7f86e604ddd2082fe2baacb41333ab61ec598ec9123d3003f8a929135208684cab2e92afc0233314954ad824e513d17b4a27124035d551d27a56ddd60d9c10be0bbf155f391d2f1b7f7a5c7304976e3c8b81127daf3ecaf028947a39d98683eff7e58bc629c3fa9837979576e4127be53bb917330d5f1aad4910bb457aa253281e7f0ac08946904067b2d364760d72c70e5eba8e60eb1d1d9bfd0f99687c52cabd90e3ba11f333c28b4f82183f1e74a3049e807f4b555f877da721466c5e1ac4f9c462626522b9b54d1e7ebc78f907ffda1d34a0dac394a83a6db6086e72ea617b6c7c244f44e953f4097eb18691defe52b879e2a48ebb6a9fd7bb1e679566eb51b9d424dce514c197cce01d1162156c4fec42dcf062875354f94592a521e4af227fbfad7159894933483ce1228fd18b602a1125ce4fa093e0b41db1f91fa4789f0d42656585d914ddf283ca2b1e34bf58d4f9d306af176b591d8ae04bb313d827747a7bda834e3018284a0748232fb77ca4e91ddddeb39acaedec2a07298faaa5b1e0b9784f6e20efd2bb3fe22ee0fce187e71505a49bd6ee7d0e859c4b03691486737994ce1971c97e7d1e1c338b485ebba0db3d3bf2b186749042f12b0f5bc100129f0d869129959b29a40e8919cbca061514a7bf22908e21b37be8ed5d09db2e8a50115d8961926239b9e5ca6dadcc28a8f1d36f555b61cd057822403eabdafa4039b8ceda8cf219e78c07b431b22d5a5022330222d2cd21677702ba676aa27589996dbf306640fb97f48d464a57af269e22e5359af02642fcbfc296fd46757b60dbad165caaf59356ff996c96058b1b03f10a0108067588c40f0f8628b4364ee9c7b50ecefa2605d1ae13e7150021b63d9cb90a8746d9313bac0fb07fdad60f54a93110e358d59312d14dd894c9d1c802169eda21e887cdb8c8dbf2dcfcbc06d7202234b01b413ae0032cfa879eea370422b86fbe421633b846a4a013732dea81daaf27d42a591beb84657d103b04e8332fee1823ea3a50e0a44661a1383ac4c6ae5b47ff8a53518639796ba46b5895aceb4b2e7b255e920ba22638851b4eafe2cae50721e0aae3e5449696e3433a6b798b9f18564834136043ea22893b869fbcb554fcc76ff14bede0700aba3177d716645cf2677ac3f6f3f66767b7c5b42b5add77ce998f0994f4834191955ffeff6e155a5870ec82a0a1be950057e7cf6f3fe0d61ed2afc35595e57124f268a0791bda3a3c6223e36b9876dff896378fe163aef64253ca8f16225e2bd14bdff4f73512f8d1b4c40cf3551be0e25123d7143d77ac77ef0feb1b87d3d710b235d1a5d9ddcf49a01928dc2b3bb630d2bf1364b2eea6069fc66a504b0079d457902816f86fa952b2af183535e2bde517b5fce591bb6f5c4903bcf590d2c3376e92b021e9cc42f72ede0751e722848cc4b8f1dc0f41a954a04493cbb017d5b170e3d6ef7b2006d7c8b8553b36d66f95f2a4435cfa77023041fbd35dc77edcf3ee43319ba46474778d4581b4b7c6cddd04956ff23727c1e663f9ed0da0e9c0c50573fe6d1d3e3ccd2a0b4c0f1d26c3704d604a4f3916d434e573066a2cb972c6b285321f8172e308f1afd12adca8afd88f94de3a1289996a92a31f8b5025bd2a50456e1e1458e481427a0d8bc5e4f51927c15b55c2e229458caa6753f2fe7876f7ec3edb053778b47e5488bf1a9769ffd4f874bb7d8eec9e43c61efa7a4f22cb41046550f16bf92d4d790795fc4ac0e9af3daf7cb029709cbb98423b0683cb42bef97dff0c30859134d0c165be7cd5a0341a9997421bf103127018e765042d0c2bbef005fec7a16796b6785c1264c7f934aece58ca1a57eb0211d430bf9c437fd0f79c867ce89f361a8c5cc3f20dd08e3c2917f84a0fbc6401e0a717ee313272486d2b1ced72463d0bb29be8afd71255e04413d12802356ebdc4ef3153a3cdb6c377cbc3cac83f3a7d199676be16ebfbf23914eed4e66faa68e2ebbf0b5ca35a1a077bf4ae6f7bf0e566aa1371c78d64e00460c8eb8c178e004c1f020f07868a6916c0b96b2d3aaa321f4b191287fec06eb74b7ebbeb464b5431ba2e948bbc5c6875719095a7cb5eb23731b7715a47b902c0e5c8fff7be4cf7dc8f29f4282c1cc99424d49fb90b2560b89ba746f7662c76860dab66b8a874912fec5949858d87e605c063750165a12c4b4c44231b44ffbb3f13a2e494ce413df116c35c8c391f895cb5b6b8737d1a9a1a571a237d716b35dded2e41ec34e839d771ed96c5454f10fc4af1b48d06db4209329e3a62bdf73b3a493a5e96d6f6819f8e5c0085889339b7339f013eea0e1703001617b349b06b06c4b64adcf8713650675df59b0aca4f33c4c953495dfcfffa97a385d929b7ef7a09b31c6055effac2644afd429c92e8de618df7285941895c5b2c38d287c3fab355f9d04f52202d487977d2855ea14590d6dcf1aee447eb356c86c734644bf146af841a2f126e01d1b291dd3e74980e70df0a11e478f0c6f558551ef93143de14f9e7b6c8fe97cfc81c8e95cf7e5e18b55112e2ef6d16c929def6e0b38552706ac13df2619fa9673b35c69345e685f41080150eedc21bca3597130e1d75d84d28d975e0390038a2dc556d9dfeb02054b3dce96ec77d79b90b4d305a6c757959ba838d1db590194b6ae0a792577ee9b62b3037f20ffe6dad09eba0b0c87ebd31f8000db95919ec2ffb43cfb26b332ab7f78d419eda0302fd8314696bc61946f3572c1ec90", 0x1000, 0xfffffffffffffffb) keyctl$assume_authority(0x10, r1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3242.984440] binder: release 16910:16918 transaction 924 out, still active [ 3243.023586] binder: undelivered TRANSACTION_COMPLETE 18:46:05 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x311000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f00000003c0)={0x11, 0x9, r2, 0x1, 0x7, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3243.073890] binder: undelivered TRANSACTION_ERROR: 29201 [ 3243.103633] libceph: resolve '.u [ 3243.103633] ' (ret=-3): failed 18:46:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:05 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000009400000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3243.121196] binder: undelivered TRANSACTION_ERROR: 29201 18:46:05 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x40004, 0x0) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000000040)={0x1000, 0x6, 0x2b5}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3243.145563] libceph: parse_ips bad ip '.u [ 3243.145563] :d]:.,[' [ 3243.155435] device hsr_slave_1 left promiscuous mode [ 3243.161816] binder: undelivered TRANSACTION_ERROR: 29189 [ 3243.179685] binder: BINDER_SET_CONTEXT_MGR already set 18:46:05 executing program 2: bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cmac-aes-ce\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) 18:46:05 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000c0ed00000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3243.199493] device hsr_slave_0 left promiscuous mode [ 3243.205150] binder: send failed reply for transaction 924, target dead [ 3243.217606] binder: 16971:16973 ioctl 40046207 0 returned -16 18:46:05 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x8) ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000080)=0x7827) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="a66334f5b16ab7588559c5df0a6b5c24709b8499c547cd3480d35d2d", 0x1c) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3243.267828] binder_alloc: 16971: binder_alloc_buf, no vma [ 3243.307073] team0 (unregistering): Port device team_slave_1 removed [ 3243.308693] binder: 16971:16973 got reply transaction with no transaction stack 18:46:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffe7b) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x200, 0x0) ioctl$VIDIOC_STREAMOFF(r1, 0x40045613, &(0x7f0000000040)) [ 3243.344504] binder: undelivered TRANSACTION_ERROR: 29189 [ 3243.359891] binder: undelivered TRANSACTION_ERROR: 29201 18:46:06 executing program 2: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) pwritev(r0, &(0x7f0000001400)=[{&(0x7f0000000040)="3962ff7c4abf534596aa354ac6f39ca863972894cd5f7676ca583aa6a9ede5504f17330a71ad13f06849fdd1554341d0e393ac15883486382ad0ffdd7e1fb56d5bdb051d0a8f2b710db0ef956e9e9800ccd2ac9e8496f9b3b2a2a4f7c620d692efb5e60e13e73ac54f42b36b6625f33a2074c1e99955496c5e7e46b8f2a2e089e7366bc5497af13b2e7473a18c9ce24dcb0512c6ec3cd483cf9d80819e7bec8713663a4067705673d23c668f89525cf2dd3c24cea7f70ab3ea1153a333e58e0abcfdb0f5910253cf892af76ac6e44e57e0c592ef120f2cb99aaa2d2242a9bb", 0xdf}, {&(0x7f00000001c0)="aae1a069ea56229b6f452107cc20dba80b01fa111a4c29988c084af23d2f5115e4957c27a6a410d228e084d2057be49761aca28f6f276f60d8c231dfd30e2ef7afbd598023039e4697e6dc088aea4571190792082b3b46525e56dec3135bbe27115f6c51a1fa7f6e9014477761585e81bc233933acff585730d6a35e40b7485bdf1bf40ae8e947c7e08646659b4322d932e390dcd096bc35233fc177542230f2e0538689", 0xa4}, {&(0x7f0000000280)="b4a64c64058106a2e1cddf79a5e3259a97d4b5aa8eedd02aedc1b6205e6cb65a2d22530e36daef1716f16805bd49365fd542b2cc58e8496ab4d7b4827afdb17b41a6ee4c6bb66a63be9266a49b7c794677c5591dca636f57c6a0628ecc1b3841857e4da34284519f2566a995dd6410095546eebef521bac10cd7e43341a7d7aebd07c17a0bdfce2b2713bd05a584f128c6f47989f3455ba5bab18b1753d19021f72e488e2b", 0xa5}, {&(0x7f0000000340)="9f681746336e226c33fb534f4f14abe2e265b543858016245b5f04ffd97f497054fabfcdb3cfd8a36752c7e8fc569aba5efe06e28c7943a98ea1f7ca3f07a34e70f0ac7b6a80b241826d89732cb6eb5b55e3a391a3cd38e0ba077982024737b5dd0868870dc1ee24a592256c1a72dde2a8ffd76ea516f1d6892d4353438fb9a3d68b464d19111f58ff24e973e5c8caa4fe25054f3f8399781241a8d7c09209bd2b9e710acbe75c2fc1fa98902cf49da0ce83dbe196d7aaeeba1952f500172f74698c8c9e624fead6c2071dc890c997b7da66ce1aec50374d70e4d0411be7fff6e5da7edb3ef492e801603aa709159ccbdb1da4c059740d1c1f30bb5dd84a252138a9c39a440d6b3b4e1971f14938fe7b81800980318990bedb781c5a1b6fef53eee45fc75dd2a9aeb063a9f73c09d05e54e977e67458dfaacb48d69aed783b321c0aa09552b4e9a38150d2d69e4e359bfe2d492d9e6d1ff9d8694992fe17fc5c755c76abbcdf138b3e11e63c955e065ec73d74b92908415cb5b9da9ccd73d15f9ecc380b1ba46f48075fd0a193fbd71582f27f50350259e639856b4e0f28eaa3d6e1b5e120d640cf9c5102202be2c3fb9e7e25face1f8c10d60e5e9e1233977f6daefd80c4bb7142c36fc4e1e2d0421c3520acea0b18aa17f9151553a37fe1ada9426b8c6422af0d8f22b128296451b3cd9a5cf9d8ef6fd48fefaca65d73795a5d41c2403cd3bb84e2784e85c147a1ecc19b3890b57c4ff1b99bbdb3759ad724e22b15e6e54193e505ca37117cd531fb2bd317a06f358067b572deb5d60a35f77112ef1c6a6580a69f45d1c9e0491df5e3a722f467e2d5e0d2cadefd4e7525d50316747d9bc1da52f42cb899a7aafadec12a9ffc2cd2036eeb4310bfbbdfcf5a58860b288801aba9ae7ca1d6f3682e305da5afc5845e4dfdeafe2910a8374a47052f6de9d0e844db54c3f99804fa833f87797259af59b6fad615d404676398a004070632bcbc4431a2fb7a7911f015407f451ca297b692fa6f06c207709b7318a87c6dc6fc2b71aa3be289fa1b6d24dfd2af92ab0ffd9bc24e38fa71bb33227d523fa528e0341f31ce2880d99bfb1447de39225817e7c1759e346e4e9df0bb0b784e3a9ae09f5311f8d6644d7d0c52b28ab04501361c8e04cad50b52f97bcb16d5a9ae5595011e81c7f019e7ca72d6101416d248907881a0d75ba2a914056a569ea7426602d21d23fa43bb28364df1a7560d96a5072b7fb5cb1187d30896fde8c221f2fdced680b4d2953a4cc98c3d2344cf6c7f8068ac77f185178f4e2e9b4a3afe3b01796d02cf4ebcd5c75eded249754f5c0c57f0e21d459e55f8af0056f89cfd252e38c2e4f50bbc526a636ec15fde79c12f3afd18f9eb7c9848ede24fb40cb850384606fe99593fa7560348b1f50a27cca3c95512ab2fa73198230510fbc08891b3824fcd3714505826547e2fc1fb773973476d45f53f2dc6920c337b82f6dbb9e714882984e56216501fdf0df12b253945b38ab74c270d2907cd5ebafbf4f63ca924e6291e267bfe35b64b2f99b132a3874404d5ad717496775b44cd3452d7570f1b4cfd641925e064f1b6f12cf1d637f7e351c4d7bfb7f630c30e71d3d26bf47ce79b118580022203a9399228bcdac161334e3d3626b04a1157fe83af3533ebd7e5010e4cbcc34ff7d96c237ef25df3a2e44e4ed4992dba243d84b4d65feaccf7cd3142d649fd37fca2a9df18233bf951013c31cf381b7c0d4932c81ae5e9a14a31e6a7c7768d538bb11b13ad5abb7dd5979304e8988350508d4d90b62478119d8c0d31666e293f3592a645977533e1400c394aa44de855bf89ed1f33c902a9f62f8c9fe8f1baa6d7832273fac7137e519da683998aa76a87ec92f7b56d99ec35712535f32eb0084574f13d8caa87a24ca7c0a8785621edb969d9c881d8565a83bc6336a3d6f24d3172708bac6d752f6ef6ddc29b9987747d54acc16a7a2c7118973663bdad2305733d15c0fc84186d2b98769fdb5a8b541b7f755068d26a2f576251d00526409815832e0e98c6087b7c5066a1e6a75f6d64fd43c3c22634c4f675017248175455f1722e2b0ae4f690d4224de70ee7d0d140939f92a2391539c82782f003647368469987550de9526822b2dd5e984c8d1ca2b94c664eac96bdf643996353a56e4bae2f609706058084698d6e2a7605c421ee36e99fe1959a621902f12e56619f53b82e4b4cfdac8a32e4f348858a65890294bad2d680b3184bc4589c40ddd932fe6dcf9d8802dd3a3cb58b83d0649a5f482b4a85ecfe143b3a249c75f8bcc9ae484237989bc4f812caa2f1025975d09c855965eef38288275c43f72061a7fdafd8935c629eed90b37225a34e838acbd62ad2d1f811b5f2c1c29211c294c65759c10b67ae0f029a75f2745c38ff4179bdb7f4595162616f1d1797c94dcbba0c88c45e1aee70b5995e2ca8473ad831000e8518ffe402fe76d872776f34d267110ad47a7925c84e7cfb766c1665b817b3af84c0441d378b40d52a4d23c1291b5c9c84f50fdccb59aba038a145916efc8060938833e437f6f0d278519ad04473743cc0c3981601c21d8fec635634c16772dead9debf76532e64ed563cb9b10fb18b914b3afcd80313c30ede3585c84d96029838cbb6054ac7aeed8c8c2bce93f8ed995dad2901c6131f67c465ee61945a51e6ed12f56cc64c7a208fa2f90ea4a2f7774087bd8e8ba950678faea7bbaec4f6836c42654170b867de9e34bd842b13ad31b9ec40f85bc3c940e6a52b93aebe744122ae52f2fe859f5f9aed892dbd533c7ef2a64e5fdd0d69e8c0e748be964428005190adc59eae10b76c4deaaf786540681c32ec0e08616e4030bed0e0f2df3652653f0ca8d9bb9ac52d9bde76adf584bc408ee53b6fd94bc527ab4c5a8d07bc9008139d29ef18d7096aea3b8d98551d65205b75eee1bed80a69b9f82de2c44457c54632ab83bd8575713e6463726dada24472541044e854e70884129335d89355bcdff161b2cc7f927307dbbaf2a47abd8b3ed52665a2dff586536ed33ee03afc8ccc37171b2fc94107f388c3c7be5f8d79c1d7c5378eef986fc43b41b4fd4320b2fda52599bd3e1cbd0962a58931e4dd50662ae57f446c33274661c3ddc1182fe6624b00d9af877b9aadf4a750499308749c380f328fa2398ebb03208ac71b9205418576785f732e2832fd533e7131a14627ba9c9ea9e533019136135c25d7ed853bc3f75d248d97614cd82d46686b4718d02ffcd2811ab20ae11bd28e49c0f401e5950b4251aac531bc87f80b4583f271a70aa87384fba18dee87be9da94d7ef51e9b95c65f45ff715cf71e9f03718c0f6792c7835374fc36e799e5eead55f9b68645ccd4424af9c94496a448ff90e2b6aaaca6fc7cd009a6cc2ebb8308bdb340b972448562ca651f3367b60a72bc47260e2c5348f41e8f766b3f9f4af599296c29382ae3ac7c35d529753b03308e8e5bbfd5b8395ccc1c4232d1b03b8bca1da9067b75bd2e31e8cf530505bcbb6a65dd0f740123f9074be1791f9901b220802b6a08fe4baca031ec77b9b7c3724e6c19c2d0112fc8c702dccfee9c2824f4adf3ab792b4506787367cf155136f96781d9c6341fcb2665643c9ce086dbcab98df56bc32e7261d0b5af941ed925cab8b3aa40357218ac4a6bac8a7b2e3c2355e5832f7ca946843c67ef789df013ee0169b1d12c9407349f76ae524de9fdd555d6cb0c107c731e189298155e37eb6369a6789bc1a5a6100762a5159f13bbf59f990653d49bcfc3763ae3e249b710a06dde0eb69864036d7d341f07515a8a5eda718d68a9b010de698fcddacea1fce897ed9bc0397d03489374b9e7bcbb03a6964b6e5d118884b8ff3f141dfdc464b649455c7e3cd1189d13b83c3e2633f5e7a7f73214269f30ed3a0f3f6a3ce757514faa41f32f408d3b45100617c97eb516a30159cef869de6de5740c3f6577ce0d0255142e90f87fb149afc9d982e3224f294df424d70dbf4291f002313440c07ec32e2a2d6b05ae24ab6f60b2b499a0415cbdf52fc6bdc18bda62ae99edb99f7dd49c1d3dbc1b533bc73df9259bea25fbdb86a575d889c884cbf0c3868f8452591c7ea6eb08e2fd8dd02383b3e7ec71ac676b8c0da7040750d5492f3d1daa694ff8014010fc5810bb7504196b90e7505e1f52fcaa5c6eb3495cfe910625f05dfbdad9e910203d0385caa07757c0bd5f42d25e63e18d0dcf5e425cc9509c05ba94894cf61b040e0554b2a60b32d980cd126999fecec2c233e2f222eba3f430b6b22eddf56e776f834f7cb06a6ef977dce07aabc38a1e12ecf9711a397b42dcbf43a4feb12f7731c69a7a27b6ddffa0f3882aab5b8f944e16a19a18f2ceef3f9e8cb4f65d68360b06b68e736911ca45f2f0feee98331bb6b25e5687e72a6a881beead7680d540f686988eb7329d2605ee942bc84796690121cbbf3efd1e76c2d38d7db55cd98593a02df9088db41d5b5f1be711da7a198b44de337fb7928d0db73a6001bbc18fbfb041cc81c3aa5b59ddbf357b20bcca32dc4d13647cb76bb4c551b7c134194e53a342c00b40def013c5b3d2a5e5f98c935b1c1852b5c59fbc20c8e95aea3587332dd6b0e7725874480b4a3d9f90caa6c3d18b8f968854f9fa213ae078409722c62fb117013a4cfe8e8f8133ac36af1e883dfcdf3a9b3910e66064ce166c0d07216b707e3b01f6364683458f035bd2b7fbeab5d98e45a4a254674cdd77298850acdb2a69d6571902e5174673f71a83f766e830c5cddda5f91197329b40e1c77398e1f76e5c9fb0991f9ebee00735793f2f546c0c9af69804f402e0e93fe6d88ed8b26b6b791880019911fcdb71da33e734e6422dfb39c1f4ddda224a013f458fb7aff03d94226c3c2d5f13e86531827f513b9ab46b2ba153fac7a24b52b8ecd81d7ea38b1c8a089191a090e85d371ca306e86f339391d063527ce2227990fedc8a213b4fac06ada211588824755881499e83f31fe0248002dd87f34b8da08d12b77f568fa902293c5a48309ded22acf5d61f8cafb817503d4c7a6a5b1ccc56ec220e089d46925bf6603942c331f7f90ac67faddd378b9dfbe0eb1c82851e5fe0cd509d5bd4c11f357f66d0d6dc45ec4a949fdd5d557a4b59b9974614795581f38aa654e1303cd72dc60211ee5ecaffea50925311a7d7e28d585333bda126acaaf5c9ce83b378e649088c3d9c34cf8b16958a4c845e47f7bfa025d6f338ea003eedfb64c5971d0407f7cec910d2444b0c3206067824ce9cf4481bfc8a793a827905e9ca41e70851a7328ee37a92e911edf9d92dd2882b00db751f2e464536ccb04324d167c157af3bc26e63f40cf3aa7a215854aaf74e93bb594bb899e036e84109e04084d38a8fd9d09ccd7e7c4a6acfff0492bafc507dedf1bc0001d20660f09928ef87f0870773f3004d00411658fa474e266b431c22081729129dad778f2c289d30954f900fd6072b28ac234fc513c248e033e429cb0956aa5749276368b27a45b6de879278c9d93acae25b28740a3177859f8c694dbd9e3ad0285a5bd21145d1008e13ae0e29109de2470983eea895bb934cd9681b3aa04559b4c5cd1027f1cfe412db774adcd6e6a9de0dbce167272ec132933d1625af3a6a09f299b7e3ee29745317d567ac82f70bf3bfe269a1cd61e655488f1d45ba237823616b77faa06544a6eb083ca9ed61faa010891e01969552dca1935c7d05e4a875235273521a1195f8dd637ac10a6d342ddb62b6398c949", 0x1000}, {&(0x7f0000001340)="4de8aa182d8102", 0x7}, {&(0x7f0000001380)="83ea28fbf4504f20f8e92a46d48eea967e9086c8319c0fa59e0d522c6a13fe2d31b728dc271f0b", 0x27}, {&(0x7f00000013c0)="f5d97f63eb12db02bb", 0x9}], 0x7, 0x2f) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x5d) 18:46:06 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x3) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3243.393570] team0 (unregistering): Port device team_slave_0 removed [ 3243.396799] binder: undelivered TRANSACTION_ERROR: 29189 [ 3243.403966] libceph: resolve '.u [ 3243.403966] ' (ret=-3): failed [ 3243.422556] libceph: parse_ips bad ip '.u [ 3243.422556] :d]:.,[' [ 3243.466680] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3243.573023] bond0 (unregistering): Releasing backup interface bond_slave_0 18:46:06 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x20000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:06 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000f000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x101000, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:06 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x1b) 18:46:06 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) timer_create(0x1, &(0x7f0000000000)={0x0, 0x1b, 0x6, @tid=0xffffffffffffffff}, &(0x7f0000000040)=0x0) timer_getoverrun(r1) 18:46:06 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x2, 0x880) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000000c0)={0x0, 0x80}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={r2, 0x460}, &(0x7f0000000180)=0x8) 18:46:06 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(aegis128l-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3243.699446] binder: 17023:17025 got reply transaction with bad transaction stack, transaction 933 has target 17023:0 [ 3243.699455] binder_transaction: 5 callbacks suppressed [ 3243.699465] binder: 17023:17025 transaction failed 29201/-71, size 0-0 line 2816 18:46:06 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@window={0x3, 0x0, 0x5b799d33}, @window={0x3, 0x1, 0x8}], 0x2) ppoll(&(0x7f0000000080)=[{r0, 0x4100}, {r0, 0x4000}, {r0, 0x4220}, {r0, 0x22}], 0x4, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000100)={0x4}, 0x8) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000240)={0x40000000, 0x7fffffff}) fcntl$setown(r0, 0x8, r1) 18:46:06 executing program 3: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x3, 0x2) accept4$tipc(r0, &(0x7f00000000c0)=@name, &(0x7f0000000100)=0x10, 0x80000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x8, 0x111000) ioctl$SG_GET_VERSION_NUM(r2, 0x2282, &(0x7f0000000040)) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) ioctl$SG_SET_TIMEOUT(r2, 0x2201, &(0x7f00000001c0)=0x60a) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000200)=""/245, &(0x7f0000000300)=0xf5) [ 3243.778432] libceph: resolve '.u [ 3243.778432] ' (ret=-3): failed [ 3243.791952] bond0 (unregistering): Released all slaves [ 3243.814660] binder: BINDER_SET_CONTEXT_MGR already set [ 3243.870032] binder: 17023:17028 ioctl 40046207 0 returned -16 [ 3243.894819] libceph: parse_ips bad ip '.u [ 3243.894819] :d]:.,[' [ 3243.908855] binder: release 17023:17025 transaction 933 out, still active [ 3243.954762] binder: undelivered TRANSACTION_COMPLETE 18:46:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:06 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-ssse3\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) [ 3243.999196] binder: send failed reply for transaction 933, target dead [ 3244.102036] binder: 17070:17071 got reply transaction with bad transaction stack, transaction 936 has target 17070:0 [ 3244.176671] libceph: resolve '.u [ 3244.176671] ' (ret=-3): failed [ 3244.184092] libceph: parse_ips bad ip '.u [ 3244.184092] :d]:.,[' [ 3244.190938] binder: 17070:17071 transaction failed 29201/-71, size 0-0 line 2816 [ 3244.234877] binder: BINDER_SET_CONTEXT_MGR already set [ 3244.240275] binder: 17070:17081 ioctl 40046207 0 returned -16 [ 3244.246525] binder: release 17070:17071 transaction 936 out, still active [ 3244.254235] binder: undelivered TRANSACTION_COMPLETE [ 3244.265127] binder: release 17070:17081 transaction 938 out, still active [ 3244.275840] binder: undelivered TRANSACTION_COMPLETE 18:46:07 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x20100000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:07 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) accept4(r0, &(0x7f0000000000)=@nfc, &(0x7f0000000080)=0x80, 0x80000) 18:46:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)={0x0, @aes256}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:46:07 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000007130000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3244.284291] binder: send failed reply for transaction 936, target dead [ 3244.292338] binder: send failed reply for transaction 938, target dead [ 3244.360358] binder: 17093:17094 got reply transaction with bad transaction stack, transaction 940 has target 17093:0 18:46:07 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfdc9) 18:46:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:46:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x40, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000080)={0xfff, 0x5, 0x40, 0x0, 0x2, 0x3, 0x6, 0xeb74, 0x40, 0x8001}) ioctl$CAPI_NCCI_OPENCOUNT(r1, 0x80044326, &(0x7f0000000040)=0x8) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f00000000c0)={0x400, 0x132c93a5, 0x80000000000000, 0xf834, 0x1ff}) [ 3244.442931] binder: 17093:17094 transaction failed 29201/-71, size 0-0 line 2816 [ 3244.530182] binder: BINDER_SET_CONTEXT_MGR already set [ 3244.574955] binder: 17093:17115 ioctl 40046207 0 returned -16 18:46:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001800)='/dev/rtc0\x00', 0x181040, 0x0) sendto$isdn(r1, &(0x7f0000001840)={0x80000000, 0x80, "ae0c922241133bc277340b0cec110824fbe764c2896129bf152b251012bc7519287c2b640af7836d26f6bf886dd970076fb37452b30afb1e94567945c51fef8ecb0a622b8b3db9378c57b668f1419ce80f68a40b339abd38634768d25629003289da06628b2ae35cae4bc27d8789c8ede35f36b97e039437be55c3dc4b107171eb02a2a1288164d5"}, 0x90, 0x1, &(0x7f0000001900)={0x22, 0x3ff, 0x2, 0xa7, 0x8c56}, 0x6) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f00000003c0)=""/33) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000040)={0x0, 0xb8, "b93196ad2194603cde013f1fd006b71c9e768ce620bae963d6858eda9af17ac07ac4ebcfce75229cb445b8442c2feb5cc5b76094e756c1d6e6af1001f4bfc343abfc77ec13ebfa6e85a8739d55a2973cae1d1e5dee8a41e38a9d0cb067c7a7e8aa7750cdcd06e7e45b540896a0117a167cbe5d2f4ed3ad993d8ee4d9eb0185470f8d28fec22c925709fe9cd9f24093cd0aea20bacaf32db96583d4c053cdf5cbc460bc02947641bd8ab88623f5548226edb69551f05954e3"}, &(0x7f0000000100)=0xc0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000240)={r3, @in6={{0xa, 0x4e23, 0x9, @loopback, 0x2f}}, [0xb52d, 0x1, 0x3, 0x101, 0x7, 0x2, 0x162, 0x3, 0x6, 0x7, 0x8, 0xffff, 0x20, 0x0, 0x6e]}, &(0x7f0000000340)=0x100) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00000001c0)=@assoc_id=r3, &(0x7f0000000200)=0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x22c) ioctl$sock_TIOCOUTQ(r2, 0x5411, &(0x7f0000000380)) 18:46:07 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000000)=""/148, &(0x7f00000000c0)=0x94) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:46:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x3, 0x8, 0xfffffffffffffff3}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x1a1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x4640, 0x14) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f00000001c0)='aegis128-generic\x00') ioctl$PPPIOCCONNECT(r1, 0x4004743a, &(0x7f0000000200)) r2 = fcntl$dupfd(r0, 0x0, r0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000000100), 0x0, r2}, 0x68) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f00000000c0)) [ 3244.615264] binder_alloc: 17093: binder_alloc_buf, no vma [ 3244.660390] binder: send failed reply for transaction 940 to 17093:17094 [ 3244.687162] binder: undelivered TRANSACTION_COMPLETE [ 3244.694921] binder: 17093:17115 transaction failed 29189/-3, size 0-0 line 3035 18:46:07 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x40000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = accept(r0, &(0x7f0000000000)=@hci, &(0x7f0000000080)=0x80) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f00000000c0)=0x8) 18:46:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x20040, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x5}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000000c0)=@assoc_id=r2, &(0x7f0000000100)=0x4) 18:46:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3244.926538] binder: 17142:17143 got reply transaction with bad transaction stack, transaction 944 has target 17142:0 [ 3244.969137] libceph: resolve '.u [ 3244.969137] ' (ret=-3): failed [ 3244.995226] binder: 17142:17143 transaction failed 29201/-71, size 0-0 line 2816 [ 3245.050439] binder: BINDER_SET_CONTEXT_MGR already set [ 3245.054660] libceph: parse_ips bad ip '.u [ 3245.054660] :d]:.,[' [ 3245.130834] binder: 17142:17149 ioctl 40046207 0 returned -16 [ 3245.140357] binder: release 17142:17143 transaction 944 out, still active [ 3245.151347] binder: undelivered TRANSACTION_COMPLETE 18:46:07 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000040000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:07 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x37, 0x2, @thr={&(0x7f0000000000)="b99e13f4fa926672c4ef9514fdeef8a0f7a2bdd9a6f30d10106a61f1f6f7fbef87fdc3ec55f16165b41621847a350f23d482154202247a", &(0x7f0000000040)}}, &(0x7f00000000c0)=0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000040)) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-generic\x00'}, 0x58) timer_settime(r1, 0x0, &(0x7f0000000100)={{}, {0x0, 0x1c9c380}}, &(0x7f00000001c0)) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:46:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x9, 0x10000) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000200)) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000080)={0xa0000, 0x0, [0xffffffff80000001, 0x9, 0x3ff, 0x1, 0x810000000, 0x40, 0x0, 0x6a85]}) ioctl$RTC_UIE_OFF(r1, 0x7004) 18:46:07 executing program 2: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) ftruncate(r0, 0xfffffffffffffff7) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-clmulni\x00'}, 0x58) r2 = syz_open_dev$radio(&(0x7f00000001c0)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000200)={0x0, 0x1, 0x0, 0x100, 0x3}, &(0x7f0000000240)=0x18) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000280)={r3, 0x90, "fb52a39cf9ec3899262d07b87ef2ace3dfe270fcb4a7ea5d8f81461524cdeec73a1802f26eab9d8faa79fb20fa92df9ac2f1ad147d64481b85ee67133f7619613702016ffcdd9196d0972a2072581ff9711c12735f29170b9fc824dadc435b178fae88bd6a684b34704a09507fc5fa2bc510579c44ae6524b905bf33faf0410e528d9ebc379fa75ced1f8e444ae0ad43"}, &(0x7f0000000340)=0x98) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x200000, 0x0) ioctl$BLKSECDISCARD(r4, 0x127d, &(0x7f00000000c0)=0x7) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) [ 3245.188390] binder: send failed reply for transaction 944, target dead 18:46:07 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = fcntl$getown(r0, 0x9) ptrace$poke(0x5, r1, &(0x7f0000000000), 0xffc) 18:46:07 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x200, 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000040)={0x46b}, 0x4) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:46:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=0x0) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000040)=r1) [ 3245.356796] Unknown ioctl 21531 [ 3245.390318] Unknown ioctl 21531 [ 3245.433112] binder: 17175:17176 got reply transaction with bad transaction stack, transaction 947 has target 17175:0 [ 3245.465532] libceph: resolve '.u [ 3245.465532] ' (ret=-3): failed 18:46:08 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x40010000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:08 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = getegid() getresgid(&(0x7f0000000000), &(0x7f0000000040)=0x0, &(0x7f0000000080)) getgroups(0x4, &(0x7f00000000c0)=[0xee00, 0xee00, 0xee00, 0x0]) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f0000000240)=[0xee01, 0xffffffffffffffff, 0xffffffffffffffff]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x7, &(0x7f00000003c0)=[r1, r2, r3, r4, r5, r6, r7]) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:08 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x401, 0x200000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:46:08 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x20000, 0x0) ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000080)={0x3d6f, 0x2, 0x200, 0x1, 0x9, 0x680}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'bond_slave_0\x00', 0x200}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0xffc7) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffe28) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) [ 3245.517825] libceph: parse_ips bad ip '.u [ 3245.517825] :d]:.,[' [ 3245.544661] binder: 17175:17176 transaction failed 29201/-71, size 0-0 line 2816 [ 3245.601107] binder: BINDER_SET_CONTEXT_MGR already set [ 3245.677934] libceph: resolve '.u [ 3245.677934] ' (ret=-3): failed [ 3245.678764] binder: 17175:17193 ioctl 40046207 0 returned -16 [ 3245.684872] binder_alloc: 17175: binder_alloc_buf, no vma [ 3245.724397] binder: 17175:17176 got reply transaction with no transaction stack [ 3245.775454] binder: release 17175:17176 transaction 947 out, still active [ 3245.780135] libceph: parse_ips bad ip '.u [ 3245.780135] :d]:.,[' [ 3245.782380] binder: undelivered TRANSACTION_COMPLETE [ 3245.782750] binder: 17175:17176 transaction failed 29201/-71, size 0-0 line 2801 [ 3245.789006] binder: 17175:17200 transaction failed 29189/-3, size 0-0 line 3035 [ 3245.804673] binder: send failed reply for transaction 947, target dead [ 3245.823161] libceph: resolve '.u [ 3245.823161] ' (ret=-3): failed [ 3245.843460] libceph: parse_ips bad ip '.u [ 3245.843460] :d]:.,[' [ 3245.878230] binder_release_work: 7 callbacks suppressed [ 3245.878235] binder: undelivered TRANSACTION_ERROR: 29201 [ 3245.921861] binder: undelivered TRANSACTION_ERROR: 29189 18:46:09 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) mq_notify(r1, &(0x7f0000000100)={0x0, 0x3f, 0x0, @tid=r2}) r3 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x7f, 0x142) ioctl$TIOCMBIC(r3, 0x5417, &(0x7f0000000040)=0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:09 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000a050000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:09 executing program 3: r0 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r1 = fcntl$getown(0xffffffffffffffff, 0x9) fcntl$lock(r0, 0x27, &(0x7f0000000040)={0x1, 0x4, 0x6ca0, 0xffffffffffffff00, r1}) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x20000, 0x0) ioctl$VIDIOC_QUERYSTD(r2, 0x8008563f, &(0x7f00000000c0)) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x5, 0x0, 0x0) 18:46:09 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x18000) accept$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000000c0)=0x14) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000240)={{{@in=@remote, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4e21, 0x0, 0x4e21, 0x0, 0x2, 0xa0, 0x20, 0x1d, r2, r3}, {0x8, 0x80000001, 0x3, 0x0, 0x1, 0x100, 0x100000000, 0x7}, {0x1ff, 0x1000, 0x81, 0x7264}, 0x200, 0x6e6bb0, 0x0, 0x1, 0x2, 0x3}, {{@in=@multicast2, 0x4d6, 0xff}, 0xa, @in=@rand_addr=0x7, 0x0, 0x3, 0x3, 0x0, 0x1, 0xffff}}, 0xe8) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000040)={0x6, 0x8, 0x6}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 18:46:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:09 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x48000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:09 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x8}) [ 3246.590406] binder: 17212:17215 got reply transaction with bad transaction stack, transaction 952 has target 17212:0 [ 3246.618634] libceph: resolve '.u [ 3246.618634] ' (ret=-3): failed 18:46:09 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539esp(ecb(cast5),sha384)\x00'}, 0x21f42245095a9cfa) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x40, 0x101) ioctl$RTC_PIE_OFF(r1, 0x7006) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00002cbd70001c00e9ff0000106bb270119eb362e73dff0f000008000100ff000000080001003f0000001400070008000100010099451194416330f100080002003f0000001800070008000100f31500000c00030005000000000000001008000000000000"], 0x6c}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) 18:46:09 executing program 2: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x40000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2a) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0xce}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 3246.658412] binder: 17212:17215 transaction failed 29201/-71, size 0-0 line 2816 [ 3246.693635] libceph: parse_ips bad ip '.u [ 3246.693635] :d]:.,[' 18:46:09 executing program 2: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000000)="fc00000048007f0000000900000007000a060040030000000000369321000100ff0100000005d00000000000000398996c92773411419da79bb94b46fe000000bc000200000358c4076c6c256f1a272f2e117c22ebc205214000000000008934d07302ad0317010000800000000080772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf590201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48f6f0000080548de873cf1587c3b41000000000000000000000000", 0xfc) 18:46:09 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) creat(&(0x7f0000000000)='./file0\x00', 0x6) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3246.735491] ptrace attach of "/root/syz-executor2"[17232] was attempted by "/root/syz-executor2"[17234] [ 3246.760140] binder: BINDER_SET_CONTEXT_MGR already set 18:46:09 executing program 5: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x12a) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000080)={{0x2, 0x3, 0x56b180a, 0x1, 0xa0}}) r1 = socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_dccp_int(r0, 0x21, 0x0, &(0x7f0000000240), &(0x7f0000000280)=0x4) getsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f00000001c0), &(0x7f0000000200)=0x4) bind$alg(r1, &(0x7f00000002c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x200c41, 0x0) ioctl$NBD_SET_TIMEOUT(r2, 0xab09, 0x3f) ioctl$CAPI_INSTALLED(r2, 0x80024322) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000140)={0xdd}, 0x1) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f00000000c0)=""/83) [ 3246.824682] binder: 17212:17237 ioctl 40046207 0 returned -16 [ 3246.852474] binder: send failed reply for transaction 952 to 17212:17215 [ 3246.865877] binder: undelivered TRANSACTION_COMPLETE [ 3246.870906] libceph: resolve '.u [ 3246.870906] ' (ret=-3): failed 18:46:09 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x4, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x2c) socket$kcm(0x29, 0x5, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4000000000005, 0x0, 0x0, 0x4}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x0, 0x8, 0x8584, 0x0, 0x0, r0, 0xca}, 0x2c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) bpf$MAP_CREATE(0x2, 0x0, 0x0) [ 3246.898198] binder: undelivered TRANSACTION_ERROR: 29201 [ 3246.910035] binder: undelivered TRANSACTION_ERROR: 29189 [ 3246.948553] libceph: parse_ips bad ip '.u [ 3246.948553] :d]:.,[' [ 3247.050533] IPVS: ftp: loaded support on port[0] = 21 [ 3247.183359] chnl_net:caif_netlink_parms(): no params data found [ 3247.253140] bridge0: port 1(bridge_slave_0) entered blocking state [ 3247.290118] bridge0: port 1(bridge_slave_0) entered disabled state [ 3247.297324] device bridge_slave_0 entered promiscuous mode [ 3247.316127] bridge0: port 2(bridge_slave_1) entered blocking state [ 3247.322511] bridge0: port 2(bridge_slave_1) entered disabled state [ 3247.336448] device bridge_slave_1 entered promiscuous mode [ 3247.372189] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3247.381503] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3247.399470] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3247.406965] team0: Port device team_slave_0 added [ 3247.412326] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3247.419583] team0: Port device team_slave_1 added [ 3247.425109] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3247.432371] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3247.507084] device hsr_slave_0 entered promiscuous mode [ 3247.534823] device hsr_slave_1 entered promiscuous mode [ 3247.585183] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3247.592011] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3247.604082] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3247.629216] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3247.637047] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3247.644733] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3247.651292] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3247.659139] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3247.668301] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3247.674354] 8021q: adding VLAN 0 to HW filter on device team0 [ 3247.691114] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3247.698431] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3247.706550] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3247.714033] bridge0: port 1(bridge_slave_0) entered blocking state [ 3247.720502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3247.727755] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3247.739773] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3247.746964] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3247.754660] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3247.762147] bridge0: port 2(bridge_slave_1) entered blocking state [ 3247.768494] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3247.777814] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3247.786883] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3247.800360] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3247.807778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3247.817872] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3247.825021] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3247.833605] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3247.841524] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3247.853549] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3247.860423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3247.868359] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3247.880413] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 3247.890283] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3247.900465] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3247.907571] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3247.915517] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3247.922851] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3247.927877] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3247.942625] 8021q: adding VLAN 0 to HW filter on device batadv0 18:46:10 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000a070000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:10 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e21, 0x4, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x50000000000}, 0x1c) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 18:46:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = dup2(r0, r0) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x10400, 0x0) write$9p(r2, &(0x7f00000001c0)="ae5ba960e8f629c88e8c66836afdfcd1e648692118c8fe413ff2c3cbacf52249c49900776da92a7a6261910377a4c4aa046bb8a07766339fbeabee15bb1c75e076b0d7ce27a829492b96aa49a4c5785d954d", 0x52) 18:46:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:10 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000440)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x200}], 0x30}, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000000)=""/84, 0x54}, {&(0x7f0000000200)=""/98, 0x62}, {&(0x7f0000000280)=""/112, 0x7fffef4a}, {&(0x7f0000000340)=""/249, 0xf9}], 0x4}}], 0xb000, 0x0, 0x0) 18:46:10 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x48010000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:10 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = socket$inet(0x2, 0x2, 0xd963) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000001280)=ANY=[@ANYRES32=0x0, @ANYBLOB="00100000285c7654edade58f59b955d018c7a21a71898a0039262a3562e6100aed701af8b32d615b68261a25eba4a5acd200a7253a0a832c31d4a4eede85173ff2a7a41e22b0bbdb3f2533eb6d806b2b66223b21ec99ad4d0ecff61ca76293d5bc44ac7e9ee0ab9d25a1852c4e40be7454a971cf7c4f179f46d617400f8c636f3f0e219d0d8509318d98c512409b7b999dcd2a032ec5b586ead7a307dbfbd147c3eccbc382f6ce75a01e2f872f2c9b89b22ebecac4a37b988b586add0d99c4ce51d444d172fdbf6f7d5cb213e26ab31d6bf2ad0388488779fa8b60bfb6575823be1cde113e8d6bf0b92f51819e42edb09edd0dde24c5b9abdf46eb5493a97f6c2db4d8975be073d8774027bf37479e0e3740eb74a6827095cc7177ad9243d069e5b1a058fc2f089cf5111c7102b2b1d1f457a6234b5803a09ed0af073f8533d14432ce26536d78f8f85ff1372f07891fb9d2f71387ec7261589dfb07720bacaa5dd67a3dd388d0df8a40de310930a8ee75e192373aea01110f65e6223604a8f8821fa188e460ddbe170af250a118d373daf27e323cc1e8f16f498722091934c1aa310f8e115b5aea5afd5cca56364e9969f4fa6cfca5e77c07cac605b68a4eadada4e997ff838bea635eb36372076a4b859d110777a87362272c0dd16f30b3538ab11c056fce355eb1baf18ea069ab895db297adf1bd8a743d4b10e6c0b3df1d714518097ea8e3639aee068a225ee5424d88f8c33f69bc3b8d8a4093954a07f83695297edf87cf88c13cdbec99abb4e26ba285770469d0b2421431fe2ba9d23f5c0c46da29f33db904ec744117fa8278e279293a688ef7a6f9e7fcb605fe3c59068310e60db42070fd41600f3d2c55c0c7dcc47100f0ecc65e880a06b47641171a3a965f8fd946659c466a38298ad2c7dcb17bf82945dc92678c0e93bcf9d0d5b858c51a7f10a1e3f89c2716a334f5a275459be4e652fc27bea869b95019032dea0b0ade1672994da7420c1e8df6144674fea2561e7366e71623d1c17a9fc2efd576aa59a63b1e8c81da00fbed3f456debca5021b4b44aca24551f3554c2cd8a71b06f75287519a4bf332a936cd23f125c3c914b2f10dcacfa416ebc04cc1424e62d361691596bc0fed939983f9e22fe496873ebe498b2c76601c91322fc9144f18f60a25515a75d1e32ce604fad47142c0daa24e808180373afcbba2c6b8d2cf84fa7dd13ffe9d81ad25f3dddc43583f714ba51d2825aa2e0920dd186eabe999030c1761159ed1bcffa7e1c222678f4c9eb2eed05b2249e683ce43be731ca57fbaef5adc75098490b60856e85f428d85fd711971292978e5559f4c412aaa6014f1fa2715f232584f89d33aa98822333d5d880ec704dac844fb9517204b02d18ef6d80c2f8a757c7c4d53bdcb3cb40dac248509cd8d978e07472494a830f485fa2ad74823042c5a6250eaf1d921f1803d80a1963709572be8b3c3af5597289c96109e93635c70f6038e5a4cd6f683f1c8e32b3d42798d113346101669c110e53b19cf22407e90780fdc4b28305b09cfaef7bec1339030665e892701970366dfbf44a7ef03cf187c1e6d64abac1b78dec113a9c30d6d63e53945560e97e715a7f8af04a507a5161e27268544aac73832a3b16a8c6dfe20b2f3000f9aac5f466d50010c658e1436c298add7efb356aaaadd124e85e3bbff6923107168b6cc14d2f5c6fbe1f4b320294cfb56932f1686b6edd1390a2624be9840d02a4e820d99a3d6e6c380fc6b7b248cab9f17afcd77709ca6a65aa07d439bf53d369f7d584a1f8338763cfac79bd707d9b89ec7e78b2bea43d915bd42d6a834f8ec8ff36954c020fe3e830d609e21a01975ac8ec6db9fec8036007a99cae25830aa61f6c31581492388b5a10462452ed355ceea5e27ef91d01bda6d852b42cd51dfa0646d23a0dab5ff0158853a7c6981326ddecaf48ca378696ae00189d810255934f87d6db741948512d8941963d2dceeda088a070a3e7fddb2ee82c18c8e33b7c76473db775b99cb8fedb87402a62fe6049570d0993e3aa34ae60fa46dfd95697ab67c296a2fc7902fc5e259710649045f44fa145454317c090a2a6d5e327dd86f01cb001fb9f9f8aa2fb4f66b97e8b1ec70f99ce63299d5a3dc2eb551b85aff4d9abc72e72b7c0172dfba01e4520d941eeecfe5c00d0451f7562430712ca72609c97257a01dd47aff07efab162218238608159c922db8fd0597d838e32d352095f781a86a86b49c658af016372fabee659eaac0c1a5ce3d56334882799c5377fe0fdee4120a69284eee99ef8d93b843a8c255ed61318c5c361aafb123202d3087f507579a9d420bccb751078d666a72303b7c6f26aa6cd1d79c65b55ca9f2e348ab196f42140d922e318f0ad158d95bf8126e338a7f0a6aff201e2ec28bdd218d17fc508fedd629b70a0fcbb2db623115963f5afa7dd99a9d8d29c792c66c57ac365aa21d0368e673be20488474c7b283364a0da3c1247656a85077f97b97736e4bb756fce74eff53b802f15e0f804aa2a4355740097a01e53ecf1324f4c3664adb03a2db8708e656aa865d8d7c733a45204029358146ee9123c687fbe65c56b593a1c97388f139f961130cc58ebc5cd0636ef245012d1f4ce2de8c1b74664b6bcde8ba540a2c0b381ddf1f8a4344f24fd58aface55e38ed591c53214768048470227261e5f601f5996a8d1513ca5c9bf4ed097442ad342866682435fce00cc68f340fdb85a332272dbfeaae43fffc1cda6c308f1123fe80fb36cc1c8332879c055461f1e307e1bb3845a8a9843be3b00481c78f408473109b893e69be834973992f3e69c9f02ec7331a69daa6fa53650364d54e09ce12bd4f68fbcc6c83c8f26f701c1694d9cb4541f1c531e1951ac08df1c5085279a89e5636c60eee368faf12eddaf87079999c7c79830297e0922ab44ff57f71d0311f07117d48ffb44e24c10205fe32f79f11e562a221fd4a848c7af2087fc0d5e9516182664b5208e09e79cd6462dc1129feef6e4c2de1908752a2ba3a8c7585c23515c4e403c31695ebbb23d3b08a2c0d286b53cdb643caa16506caeb953d74c65b721df8bfe966d3bb130e73b1df8b748dd767cb9630bac666b03c412a3869786b5bb6e783737a7edc1ac8ae5036a3a7ed69992fa658086d13c2642a750aa8ca42653457dbab574462007afb716460413f86ab0214cf65a64d2a5f22a910960da78d8e6f3379d52fde169958f78ee2f0f5d64015105902434a1952a9c4063b88bd4623deeeeeb4aeeb3f52fac3e6b414193e3df1f4c51248e912079c82d50a23716f19f2af695c5b55905e70c6b5ff376c020c9ac5947bdc828861dd42107a5d0996ede13ada75806848ef61d7f3afcb24d19197464356b30be1cf4265f97c2f7deae1a19c7a17f53502dce7f3fc04ea2cde7b9cbbcbf6bbe7efbdb62bc5f9161f64d4d28c1c0835fa9f2261232451145d6ca2e951abae33daf10333c4c3b08042bbc02883dc957083443ce181cdf81cf9724caf8bb8c29e7c35ca7594ae6e900009bdbb770f5c8cdd3535c6106c0b9d64adf3496ba508f3394f09ee3d1f9989a7a7abe1fef4dc2b36813a3aa74d42bd3b67783cb23375f2094a46296a1b8d63eb2ca25d9843e09e489e7a438ccbe8f6c102efcc632ad264b36d07e23a4859c5b0a27ca6af770f85e1185170657204d1568bd8f399aabcc15eb965ac7994c8bd87d4fdd806485d6d4bf3a577721bdbbf9efb5b1fc3d0f5350e5a0ef8b4509c4d215b98a0857dd306c5f8bcc8b2de9219acf66ee4387d0d42a984f85c59c32d24f23d5bc39c701a1b7ceaf5bce923640afc8107f5d0d7a095b0eda8a222f90da276e0d3ee3b598c4cada856650fd5edaf6fb007ee091464e7133d7fc857078f2e32be575072a24ead5a9f087b00c0bc97fc54d774fe41b0c193a821cb038432671081a6b332d179c40648c3bacec99327610e734112b9bb42dc72c3657210c5d819f14efbb02db2510cd2f997600dc37bcd855b49b5a0b0f460adc9f04d35962a5cf55aca78ba6e34642d6879479b89994c5ca59076151d5cb0413bfb81fc7fac5fe5fb0c6d6ed99bd8f8125d3b5c85bd93c7ea0e32088ba7869e9c697eada49906c2d94a0e777ee0756155d1de6865b58c5e4c8d6598c5bc19cc953e9dbd010489c5e91e4d94d862d308f5bf1259fb9a26fed82157174c9ca4dec737cc63806ea0e96342d0455709dea04f8096d1c4327407771a31920d972e7ceabc5f8b056a9a5151a469210999eaef2573c55cf2bc0cad5b131b695e369d17563440fad7dcfcd02764910777ab61b50a45ef559990d4b36bf85ee10554b60a7b887e7e49d6040000000000000087185444326b2dbf4b65a0dab472cc2f87d7488d46ce9ec3858b40d258122d8e2a9573d95c59d3fad74f3fc67081aea8846e1ca599e0253041f73ea485524054deeb7be248c3baba14d722ae40e360e3e51f227c78c9c070e93624835213a6d44601e1293466a3669bf68f3c74e0dc314d7d449019382d15580805fc04741ea7d56b3dfbb0a28f588f62b983c90a56371c39b46f53da16826f24d7de69b484978f49563952a8231f69fc092612c57b6664ec9803d1331fe58d0da7fd980498d290ea449d9af1a5b26108358a217664b31ee34c7f36f380e4fa6770f7833584db2092d34057a504d45e04c6f83b329c28980a582c3efdf80f70a7a1a652eb2db2fc0d6f8a5e6c2eb986ea10400a838f3d7c06e1ac4cc2995f7ea2b5137d022026cf8f52494e03669b185cff3e1409d3c0374c60775e8fc1e47b7e027297ea46b4f04829eb6f2d07873eb439505e40951cc6a150eef30e9bd3ac62d3d2dbf2356db6dfb6828a3b448df54580da23030807820ff12f5eca91ff5bf6c108f7e315405fb5f68b2ba3d17971fe997c1122d1cee81066bef7304eee3d8b6e27f1a3a52f302e96f0ccd897aa49593209e7f55c0b352bb2d4e6f7412ae14246179d90a6f0c7b9bd776b36e8ab44da9a0c955dc1b29e2628e25a9cf52f774a27821ffad937bb14a25ed8328ea7e3d288c80fcfd229b9e7caa0a4d814a5bdc146973d923c7ac8e78aeefe02306c16e8c2d3395f835c2ee7c9ce1664d7c80ad88f7a62141d7a2da279a7083e7ea50cd9b5d17cdb38be3e25c3934325df626c40c191458cb43576419150cdf71f9597e77661539c3efcbe6bd1a76ab803eaa976ab57f8887f1c351be6835920cee6394d3d8745a721bc44ff6cfd5029ffc9183517d9ec5191329cf6e94d8932c5684f9bbc3189a58c99af7b5b8f6b51d31270afa21ece5276afb963f3af81b1eb62c65f39ae0a52868b4e52ab0fb98c4981e06edc841d8dcaa20c1754e73b8a5ddd20717fbbf779c2f46e0b49d7af994b41b34ad79e81b405961ddb21d985eaf5859131cef08c7531f5706f84f638efb4fdcbbbb0f27d9467617210211c49c7f87da1c7e7585db9f9a06661eb5b211de8be7abde55ad8d1311446738464c0bb1638d03f62b0f1c6c73c5d7921b09a8822790d7dd1380701b6595112661b3847f93d663238fcc3e1b44d8c03bee5032177bcc3fb053cd63fce6dcf4ec506903d398ec84d804e3a0a2ef52f1398718ad5bab6b5db88c6fc2217c73245f2804c89ef60ba8a66cef14b9648ba00b6c4182618742ce2bf12c97efd6e48dc4a1641e7520d541ccf5a7ce2d867cabd73d812c7a900005f636f3d510a52e6be1d85d01619dd98c5993114a13fc03d6a04d4354afd1a3fc66148008725954cb2fd47b3b2cc8ab8d4e279769f0cba21aa6497757a8113bc3f4dc6e9c130064b9645e108d92a6f401bb30af44dedb7ffadca768fff5c7d35cabd6bd27f311d78ff0cc727d0dc7d22d3fd0c94ea607c62643419c9f802f49e9cbecf70c4988c263fc0dd95c3240c160f298be0df193159e7a9b9b897f4880a104e3b3fc73275de3a3452195732439b4bd1e57835d9549014021c2ba6699d06f403c74e94846ce26b943b37023c519a341bcaf6379f924aae6312"], &(0x7f0000000000)=0x1008) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000040)={0x1, 0x6, 0x0, 0xffffffffffffffff, 0x800, 0x3, 0x1, 0x1, r2}, &(0x7f0000000080)=0x20) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r3 = dup3(r0, r0, 0x0) recvfrom(r3, &(0x7f0000000240)=""/246, 0xf6, 0x40000000, &(0x7f0000000340)=@ipx={0x4, 0x401, 0x8, "ca8e7ee60627", 0xff26}, 0x80) fsetxattr(r1, &(0x7f00000001c0)=@known='system.posix_acl_access\x00', &(0x7f0000000200)='/dev/swradio#\x00', 0xe, 0x3) r4 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$DRM_IOCTL_FREE_BUFS(r4, 0x4010641a, &(0x7f0000001200)={0x9, &(0x7f0000000100)=[0x401, 0x8, 0x8, 0x5, 0x5fd6, 0x7fffffff, 0x5, 0x3, 0x7]}) [ 3248.021247] libceph: resolve '.u [ 3248.021247] ' (ret=-3): failed [ 3248.040038] binder: 17277:17278 got reply transaction with bad transaction stack, transaction 955 has target 17277:0 [ 3248.061235] libceph: parse_ips bad ip '.u [ 3248.061235] :d]:.,[' 18:46:10 executing program 5: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x8101, 0x0) getsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000040)={@broadcast}, &(0x7f0000000080)=0x8) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) [ 3248.072854] binder: 17277:17278 transaction failed 29201/-71, size 0-0 line 2816 18:46:10 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x64b327bc5c0b0266) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x6) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x20, 0x70bd27, 0x25dfdbfb, {{}, 0x0, 0x4109, 0x0, {0x14, 0x18, {0x11d9, @bearer=@udp='udp:syz2\x00'}}}, ["", "", "", "", ""]}, 0x30}}, 0x1) ioctl$PPPIOCDISCONN(r1, 0x7439) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1e9) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x0, 0x200) [ 3248.158664] device bridge_slave_1 left promiscuous mode [ 3248.164408] bridge0: port 2(bridge_slave_1) entered disabled state [ 3248.190346] binder: BINDER_SET_CONTEXT_MGR already set 18:46:10 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000003071000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:10 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) socket$bt_cmtp(0x1f, 0x3, 0x5) [ 3248.218890] binder: 17277:17303 ioctl 40046207 0 returned -16 [ 3248.236905] binder: release 17277:17308 transaction 957 out, still active [ 3248.261645] binder: undelivered TRANSACTION_COMPLETE 18:46:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:11 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4c000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:11 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x2, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x3, 0x7f, 0xbb}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000240)='/dev/video1\x00', 0x2, 0x0) ioctl$PPPIOCSDEBUG(r2, 0x40047440, &(0x7f0000000040)=0x101) 18:46:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001b80)=[{{&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000080)=""/252, 0xfc}], 0x1}, 0x8000}, {{&(0x7f00000001c0)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000240)=""/100, 0x64}, {&(0x7f00000002c0)=""/10, 0xa}, {&(0x7f0000000300)=""/139, 0x8b}], 0x3, &(0x7f0000000400)=""/116, 0x74}, 0x7}, {{&(0x7f0000000480)=@nl=@proc, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000500)=""/123, 0x7b}, {&(0x7f0000000580)=""/124, 0x7c}, {&(0x7f0000000600)=""/62, 0x3e}, {&(0x7f0000000640)=""/82, 0x52}], 0x4}}, {{&(0x7f0000000700)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000780)=""/201, 0xc9}], 0x1, &(0x7f00000008c0)=""/76, 0x4c}, 0x2}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000940)=""/218, 0xda}], 0x1}, 0xeb10}, {{&(0x7f0000000a80)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000b00)=""/30, 0x1e}], 0x1, &(0x7f0000000b80)=""/4096, 0x1000}, 0x8000}], 0x6, 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000001d00)={{0x8, 0x1, 0xdf, 0x50, 0xd290, 0x1}, 0xff, 0x180e04d, 0x5}) [ 3248.306500] binder: release 17277:17278 transaction 955 out, still active [ 3248.328389] binder: undelivered TRANSACTION_COMPLETE [ 3248.346300] binder: undelivered TRANSACTION_ERROR: 29201 [ 3248.377736] binder: send failed reply for transaction 955, target dead [ 3248.404420] binder: send failed reply for transaction 957, target dead 18:46:11 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x60000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3248.424218] device bridge_slave_0 left promiscuous mode [ 3248.430089] bridge0: port 1(bridge_slave_0) entered disabled state [ 3248.430576] binder: 17332:17336 got reply transaction with bad transaction stack, transaction 959 has target 17332:0 [ 3248.513540] binder: BINDER_SET_CONTEXT_MGR already set [ 3248.531611] binder: 17332:17342 ioctl 40046207 0 returned -16 [ 3248.585864] binder_alloc: 17332: binder_alloc_buf, no vma [ 3248.627176] binder: 17332:17336 got reply transaction with no transaction stack [ 3248.660943] binder: release 17332:17336 transaction 959 out, still active [ 3248.680035] binder: undelivered TRANSACTION_COMPLETE [ 3248.720733] binder: undelivered TRANSACTION_ERROR: 29201 [ 3248.748978] binder: undelivered TRANSACTION_ERROR: 29201 [ 3248.776106] binder: undelivered TRANSACTION_ERROR: 29189 [ 3248.799445] binder: send failed reply for transaction 959, target dead 18:46:11 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) unshare(0x8000400) r1 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, 0x0) mq_notify(r1, 0x0) 18:46:11 executing program 3: io_setup(0xd893, &(0x7f00000001c0)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000200)='wlan1\x00', 0xffffffffffffffff}, 0x30) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x40000, 0x0) io_cancel(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x7, 0x7, r1, &(0x7f0000000280)="973e8ff3b58c6b05df33fc01b27c69b92419c0c1abcf85fbbeefd512cb1c336b9b24f316", 0x24, 0x1, 0x0, 0x2, r2}, &(0x7f0000000340)) r3 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0xfffffffffffffff7, 0x2) ioctl$VHOST_GET_FEATURES(r3, 0x8008af00, &(0x7f0000000100)) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$RTC_PLL_GET(r3, 0x80207011, &(0x7f00000000c0)) setsockopt$ALG_SET_KEY(r4, 0x117, 0x5, 0x0, 0x0) r5 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x0, 0x200) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000040)=@req={0x9, 0x0, 0x3ccc, 0x3f}, 0x10) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000380)="845b85c4124ff0dda63bbfcace590c7a4f1003335539fb0cbbc83a23f46d6d59de3f6376d716a6b7e2ae5de201b121a1fa2e73ae9638820ae4b1398bd2476fd5dc1df84436029f8c77b6488228e44aff75b84eb9613f30991d4465c61aed6ab1199098a0e2a3141f76d66e1e553f49bc0a5b28f60ce8bc851b0cecf7a7ef1059c9bcb9bd0718a6c7e774188efc8b880ecc75b80232deeb07361cf4ad1bea76f13e22dfb238994a", 0xa7) 18:46:11 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xb0, 0x400) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="340000005eac52ee46c6951a4fec6b53a8000efd2646fd36233320e3e252466b63212e8ebab4822f2522206260cf2d4f2c93b6e93f4fa756e5d7f342c8e79312e954cb895215f72543ec5ac4a2b101cf711063214ddb5e2482288faacbee"], &(0x7f0000000080)=0x3c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={r2, 0x2}, 0x8) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:11 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000074000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3248.973882] binder: 17355:17358 got reply transaction with bad transaction stack, transaction 964 has target 17355:0 18:46:11 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) accept$alg(r0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3249.029229] binder_transaction: 3 callbacks suppressed [ 3249.029243] binder: 17355:17358 transaction failed 29201/-71, size 0-0 line 2816 [ 3249.059136] binder: BINDER_SET_CONTEXT_MGR already set [ 3249.064508] binder: 17355:17363 ioctl 40046207 0 returned -16 [ 3249.075683] binder_alloc: 17355: binder_alloc_buf, no vma [ 3249.091355] binder: 17355:17363 transaction failed 29189/-3, size 0-0 line 3035 [ 3249.158399] binder: 17355:17358 got reply transaction with no transaction stack 18:46:11 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x244) 18:46:11 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000094000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3249.260210] binder: 17355:17358 transaction failed 29201/-71, size 0-0 line 2801 [ 3249.268159] binder: send failed reply for transaction 964 to 17355:17358 [ 3249.312639] binder: undelivered TRANSACTION_COMPLETE 18:46:12 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000050a0000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3249.348235] binder: undelivered TRANSACTION_ERROR: 29201 18:46:12 executing program 3: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x2) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000200), &(0x7f0000000240)=0x8) r1 = socket$alg(0x26, 0x5, 0x0) restart_syscall() bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r2 = syz_open_dev$vbi(&(0x7f00000003c0)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000400)={0x2b, 0xfff, 0x8001}) r3 = openat$cgroup(r2, &(0x7f0000000440)='syz0\x00', 0x200002, 0x0) r4 = syz_open_dev$amidi(&(0x7f0000000380)='/dev/amidi#\x00', 0x1, 0x40000) perf_event_open$cgroup(&(0x7f00000002c0)={0x3, 0x70, 0x6, 0x1, 0x9, 0x4, 0x0, 0xc25, 0x8018, 0x4, 0x7, 0x3f, 0x7fff, 0x2, 0x0, 0x5, 0x5, 0x5d7a, 0xfffffffffffff5f0, 0xff, 0x9, 0x20, 0x8, 0x6, 0x7, 0x4, 0x6, 0x7ff, 0x1eb, 0x100, 0xffffffff, 0x9, 0x80000001, 0x5, 0xf37, 0x100, 0xfff, 0x9, 0x0, 0x81, 0x3, @perf_bp={&(0x7f0000000100), 0x2}, 0x15020, 0x6, 0x3, 0x7, 0x3, 0x1, 0x1}, r3, 0x7, r4, 0xf) getpeername$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @initdev}, &(0x7f00000000c0)=0x1c) r5 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x200000, 0x0) r6 = semget$private(0x0, 0x4, 0x100) semctl$GETNCNT(r6, 0x0, 0xe, &(0x7f0000000480)=""/174) ioctl$KVM_GET_DIRTY_LOG(r5, 0x4010ae42, &(0x7f0000000040)={0x1, 0x0, &(0x7f0000ffd000/0x3000)=nil}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) [ 3249.394917] binder: undelivered TRANSACTION_ERROR: 29189 18:46:12 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80001, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000080), &(0x7f00000000c0)=0x4) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) [ 3249.497817] device hsr_slave_1 left promiscuous mode [ 3249.558408] device hsr_slave_0 left promiscuous mode [ 3249.619980] team0 (unregistering): Port device team_slave_1 removed [ 3249.714496] team0 (unregistering): Port device team_slave_0 removed [ 3249.773726] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3249.861091] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3250.053739] bond0 (unregistering): Released all slaves 18:46:13 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x68000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:13 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = open(&(0x7f0000000040)='./file0\x00', 0x4602, 0x4) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xffffffffffffff4b) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0xc0400, 0x0) sync() setsockopt$TIPC_MCAST_REPLICAST(r2, 0x10f, 0x86) 18:46:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:13 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) rmdir(&(0x7f0000000000)='./file0\x00') r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) getpeername$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) vmsplice(r0, &(0x7f0000000580)=[{&(0x7f0000000440)="c55b447aed16c3e390afda05eceeeed3e879b8c58fbb9cb32a7214c27f2a67a07ed5910607f3d010e5c0645b80eac0a5e2d33a3c30198c2bd1b804862a500407", 0x40}, {&(0x7f0000000480)="ab5e03f8e21a2dcfb11f2aaa6c5606d0f135b2916e7e45b4abdaa6782b9ce4f47b8cb79f236820512e153a3247f331ce7fd34aff47043187e392263fe264828249fc7c69149b914afe0afd37c7637a0d52d71d7f83cbf4c342cd8a5d6e9f4f2c494410493963a29d004b360120b1fc7ff0acd449b54f4f17e80837ef431ef5327c61f5237ee4b56cddd0249fe2052b3c2b1730404bac369e5e402bc7d18b7b750ed542c84624db6bafee5690ddef7e7dfac917fa54065ccb064bbbdd6959801892e76670aa6a77a51f515c56", 0xcc}], 0x2, 0xf) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@remote}}, &(0x7f00000002c0)=0xe8) sendmsg$nl_xfrm(r1, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)=@newpolicy={0xb8, 0x13, 0x0, 0x70bd29, 0x25dfdbfb, {{@in6=@remote, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4e22, 0x0, 0x4e23, 0x9, 0xa, 0x0, 0xa0, 0x21, r2, r3}, {0x8, 0x47, 0x8, 0x4, 0x5, 0x1, 0x0, 0x4}, {0x3, 0xd6be, 0x3ff, 0x90}, 0x2, 0x6e6bc0, 0x2, 0x1, 0x1, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000080}, 0x50) 18:46:13 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000070a0000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:13 executing program 2: socketpair$unix(0x1, 0x0, 0x0, 0x0) getpeername(0xffffffffffffffff, 0x0, 0x0) r0 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) dup(0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)) tkill(r0, 0x1000000000016) [ 3250.693452] binder: 17405:17406 got reply transaction with bad transaction stack, transaction 969 has target 17405:0 [ 3250.715011] binder: 17405:17406 transaction failed 29201/-71, size 0-0 line 2816 18:46:13 executing program 2: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x5000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3250.790650] binder: BINDER_SET_CONTEXT_MGR already set [ 3250.806124] binder: 17405:17417 ioctl 40046207 0 returned -16 18:46:13 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20000, 0x1c) fstat(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getegid() getresuid(&(0x7f00000000c0)=0x0, &(0x7f0000000100), &(0x7f00000001c0)) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = geteuid() r7 = getegid() r8 = geteuid() r9 = getgid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@initdev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f00000003c0)=0xe8) openat$cgroup_ro(r1, &(0x7f0000000bc0)='cpuacct.usage_all\x00', 0x0, 0x0) r11 = getgid() stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000640), &(0x7f0000000680)=0x0, &(0x7f00000006c0)) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000700)={0x490, 0x0, 0x3, [{{0x1, 0x1f, 0x1, 0x9800, 0x4, 0x7, {0x2, 0x2, 0x9, 0x0, 0xfffffffffffffbff, 0x2, 0x800, 0x0, 0x0, 0x4, 0x7, r2, r3, 0x2, 0x2}}, {0x2, 0x3, 0x10, 0x2, 'aegis128l-aesni\x00'}}, {{0x1, 0xfffffffffffffffd, 0x8, 0x0, 0x400, 0x7, {0x3, 0x7fffffff, 0x3, 0x7, 0x8776, 0x7, 0x6, 0x800, 0x10000, 0x4a, 0x7, r4, r5, 0x100000001, 0x6}}, {0x0, 0x6, 0xd, 0x8, 'em0$self#em0\x93'}}, {{0x4, 0x3, 0x76, 0x100000001, 0x100000000, 0x100000001, {0x4, 0x7, 0x6, 0x1, 0x5fc5, 0x4, 0x0, 0x6, 0x7fffffff, 0x80000001, 0x2, r6, r7, 0xffff, 0x9}}, {0x6, 0x2, 0x10, 0x6, 'aegis128l-aesni\x00'}}, {{0x5, 0x1, 0x4, 0x39, 0x3, 0x5, {0x3, 0x8, 0x80000000, 0x8000000, 0x5, 0xfffffffffffffffa, 0x6, 0xe417, 0x6000000000000000, 0x4, 0x3e, r8, r9, 0x7, 0x6a}}, {0x6, 0x7ff, 0x10, 0x8000, 'aegis128l-aesni\x00'}}, {{0x6, 0x0, 0x1, 0x30, 0x100000001, 0x1, {0x3, 0x4000000000000000, 0x7fffffff, 0x4, 0x9, 0xfff, 0xffffffff80000001, 0x7, 0x2, 0x5, 0xfffffffffffffff8, r10, r11, 0x8}}, {0x2, 0x6, 0x0, 0x5}}, {{0x6, 0x1, 0xffffffff, 0x2, 0x1, 0x7ff, {0x2, 0xe7b, 0x3, 0x1000, 0x127, 0x6859, 0x5b, 0x3, 0x10000, 0xfa5, 0x0, r12, r13, 0x5, 0x101}}, {0x1, 0x9, 0x8, 0x3, 'vboxnet1'}}, {{0x5, 0x3, 0x8, 0x6, 0x7, 0x5, {0x5, 0x1, 0x0, 0x8, 0x8001, 0x3, 0x3f, 0x1, 0x80000001, 0x1, 0x7, r14, r15, 0xff, 0x2}}, {0x0, 0x3, 0x9, 0x1f2, 'mime_type'}}]}, 0x490) [ 3250.832736] binder_alloc: 17405: binder_alloc_buf, no vma [ 3250.853207] binder: 17405:17417 transaction failed 29189/-3, size 0-0 line 3035 [ 3250.873856] IPVS: ftp: loaded support on port[0] = 21 18:46:13 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x414100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x1, 0xf80000000000, {"4c50433c496a98affa10243b93bd4d1e"}, 0x4db, 0x3, 0x9}}}, 0x90) [ 3250.925053] binder: 17405:17406 got reply transaction with no transaction stack [ 3250.932633] binder: 17405:17406 transaction failed 29201/-71, size 0-0 line 2801 [ 3250.952579] libceph: resolve '.u [ 3250.952579] ' (ret=-3): failed 18:46:13 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x4000, 0x0) recvfrom$unix(r1, &(0x7f0000000040)=""/150, 0x96, 0x2000, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) [ 3250.999105] binder: release 17405:17406 transaction 969 out, still active [ 3251.024159] binder: undelivered TRANSACTION_COMPLETE [ 3251.027953] libceph: parse_ips bad ip '.u [ 3251.027953] :d]:.,[' [ 3251.033899] binder_release_work: 2 callbacks suppressed [ 3251.033904] binder: undelivered TRANSACTION_ERROR: 29201 18:46:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:13 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$VIDIOC_QUERY_EXT_CTRL(r1, 0xc0e85667, &(0x7f0000000000)={0x80000000, 0x102, "eec2348b7592c94b6df8bdac7bc9c003ba519795d743383d30998856ef837d8f", 0x7, 0x3, 0x1, 0x1, 0x5, 0x3, 0x8001, 0xffff, [0x6, 0x4, 0x5, 0x5]}) [ 3251.107994] binder: undelivered TRANSACTION_ERROR: 29201 [ 3251.133128] binder: undelivered TRANSACTION_ERROR: 29189 [ 3251.163077] binder: send failed reply for transaction 969, target dead [ 3251.199925] binder: 17445:17448 got reply transaction with bad transaction stack, transaction 974 has target 17445:0 [ 3251.278863] binder: 17445:17448 transaction failed 29201/-71, size 0-0 line 2816 [ 3251.335489] binder: BINDER_SET_CONTEXT_MGR already set [ 3251.366051] binder: 17445:17454 ioctl 40046207 0 returned -16 [ 3251.401735] chnl_net:caif_netlink_parms(): no params data found [ 3251.408197] binder_alloc: 17445: binder_alloc_buf, no vma [ 3251.413748] binder: 17445:17456 transaction failed 29189/-3, size 0-0 line 3035 [ 3251.449793] binder: send failed reply for transaction 974 to 17445:17448 [ 3251.459089] binder: undelivered TRANSACTION_COMPLETE [ 3251.480330] binder: undelivered TRANSACTION_ERROR: 29201 [ 3251.504243] binder: undelivered TRANSACTION_ERROR: 29189 [ 3251.542270] binder: undelivered TRANSACTION_ERROR: 29189 [ 3251.545880] bridge0: port 1(bridge_slave_0) entered blocking state [ 3251.562870] bridge0: port 1(bridge_slave_0) entered disabled state [ 3251.579228] device bridge_slave_0 entered promiscuous mode [ 3251.594818] bridge0: port 2(bridge_slave_1) entered blocking state [ 3251.601201] bridge0: port 2(bridge_slave_1) entered disabled state [ 3251.621916] device bridge_slave_1 entered promiscuous mode [ 3251.651867] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3251.661190] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3251.689913] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3251.698182] team0: Port device team_slave_0 added [ 3251.703587] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3251.716535] team0: Port device team_slave_1 added [ 3251.721775] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3251.733329] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3251.798677] device hsr_slave_0 entered promiscuous mode [ 3251.847200] device hsr_slave_1 entered promiscuous mode [ 3251.905194] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3251.912126] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3251.926961] bridge0: port 2(bridge_slave_1) entered blocking state [ 3251.933332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3251.939960] bridge0: port 1(bridge_slave_0) entered blocking state [ 3251.946312] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3251.981104] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 3251.987869] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3251.995670] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3252.003434] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3252.012077] bridge0: port 1(bridge_slave_0) entered disabled state [ 3252.019132] bridge0: port 2(bridge_slave_1) entered disabled state [ 3252.026891] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 3252.038092] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3252.044149] 8021q: adding VLAN 0 to HW filter on device team0 [ 3252.053358] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3252.061250] bridge0: port 1(bridge_slave_0) entered blocking state [ 3252.067621] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3252.085646] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3252.093228] bridge0: port 2(bridge_slave_1) entered blocking state [ 3252.099597] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3252.107756] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3252.117156] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3252.124074] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3252.133899] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3252.143909] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 3252.156683] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3252.162736] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3252.170078] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3252.184026] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3252.196222] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3252.237452] libceph: resolve '.u [ 3252.237452] ' (ret=-3): failed [ 3252.243993] libceph: parse_ips bad ip '.u [ 3252.243993] :d]:.,[' [ 3252.281862] libceph: resolve '.u [ 3252.281862] ' (ret=-3): failed [ 3252.292158] libceph: parse_ips bad ip '.u [ 3252.292158] :d]:.,[' 18:46:15 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6c000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:15 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffff9c, 0xc010640b, &(0x7f00000001c0)={0x0}) fcntl$dupfd(r0, 0x406, r0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x1, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x60082, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000040)={0x0, 0x80000, r2}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) sched_getparam(r5, &(0x7f0000000100)) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000080)={r1, r4, 0x5f8}) 18:46:15 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) r1 = shmget$private(0x0, 0x3000, 0x300, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000080)=""/137) 18:46:15 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000017fe0000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:15 executing program 2: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x5000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:15 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) r1 = shmget$private(0x0, 0x3000, 0x300, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000080)=""/137) [ 3252.360291] binder: 17474:17475 got reply transaction with bad transaction stack, transaction 978 has target 17474:0 [ 3252.392930] libceph: resolve '.u [ 3252.392930] ' (ret=-3): failed 18:46:15 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x400000) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='cdg\x00', 0x4) [ 3252.459089] binder: 17474:17475 transaction failed 29201/-71, size 0-0 line 2816 [ 3252.464916] libceph: parse_ips bad ip '.u [ 3252.464916] :d]:.,[' [ 3252.505560] libceph: resolve '.u [ 3252.505560] ' (ret=-3): failed 18:46:15 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) r1 = shmget$private(0x0, 0x3000, 0x300, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000080)=""/137) [ 3252.553286] binder: BINDER_SET_CONTEXT_MGR already set [ 3252.572228] binder: 17474:17492 ioctl 40046207 0 returned -16 18:46:15 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x235) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:15 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000fffff0000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:15 executing program 2: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3252.621744] libceph: parse_ips bad ip '.u [ 3252.621744] :d]:.,[' [ 3252.640814] binder_alloc: 17474: binder_alloc_buf, no vma [ 3252.646998] binder: send failed reply for transaction 978 to 17474:17475 [ 3252.653848] binder: undelivered TRANSACTION_COMPLETE [ 3252.653859] binder: undelivered TRANSACTION_ERROR: 29201 [ 3252.714409] binder: 17474:17495 transaction failed 29189/-3, size 0-0 line 3035 [ 3252.716788] binder: undelivered TRANSACTION_ERROR: 29189 [ 3252.780122] binder: undelivered TRANSACTION_ERROR: 29189 [ 3252.856821] libceph: resolve '.u [ 3252.856821] ' (ret=-3): failed [ 3252.878721] libceph: parse_ips bad ip '.u [ 3252.878721] :d]:.,[' [ 3252.926093] device bridge_slave_1 left promiscuous mode [ 3252.931558] bridge0: port 2(bridge_slave_1) entered disabled state [ 3253.042949] device bridge_slave_0 left promiscuous mode [ 3253.077981] bridge0: port 1(bridge_slave_0) entered disabled state 18:46:16 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x6e030000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:16 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) shmget$private(0x0, 0x3000, 0x300, &(0x7f0000ffc000/0x3000)=nil) 18:46:16 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000000)=0xffffffffffff5400, 0x4) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xffffffffffffff86) 18:46:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:16 executing program 2: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:16 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000010000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3253.350330] binder: 17535:17536 got reply transaction with bad transaction stack, transaction 982 has target 17535:0 [ 3253.378641] device hsr_slave_1 left promiscuous mode 18:46:16 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000e07f010000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:16 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000040)={0x30, 0x5, 0x0, {0x0, 0x0, 0x6, 0x6}}, 0x30) [ 3253.402293] binder: BINDER_SET_CONTEXT_MGR already set 18:46:16 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) [ 3253.439279] device hsr_slave_0 left promiscuous mode 18:46:16 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000082010000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3253.485331] binder: 17535:17543 ioctl 40046207 0 returned -16 [ 3253.485885] binder_alloc: 17535: binder_alloc_buf, no vma 18:46:16 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r1, 0xc0305616, &(0x7f0000000100)={0x0, {0x5, 0x2}}) r2 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)="decf0b4ad3bb7e55362db9dae24402a03e847f1a61c8694c3069cbfe968d1477a8235f1ecac4545504d60d5b025fb01ae6d468d4bd41c060f0d6d89ca09e430996c6d2e7615618e3646c8c24dd08f1c86edb8f5c22c8d39ec485298a82b0f3f84ffa8bcbd5e2ac184fc275ed03db34dc804f5cfd688c4e05718de4d4d96e023164dbfd671274547082c325db89dca8a47137e9704f99f9d1c291e9bfd8ff06c7d544e68ed9a30bddac4885119cc4926b8907a870f8777ab760ca2475863a9f392951fc87087f91af2758d60e4632c36c3b12d80152e3b687799e3dc1f1ce989e0798529d3aacbdf172dd56f2f24cb86fe2b820accdc9648b880c79e6e467f4806ef6723e0d586008b7b8ee17dc5569141528859284243c8fccf858c8d13c528dff9cd8f2d6eb1ce8cf49d1159ddbf8ac67a541f94dd0a9f99ebadcf42b1bca1520a12730998aaa59a56b2292dfc8e2335bcef2369d6b60c4d8edba3cf8b4345ce23da562afdeed89c2745641cf050d0f9f479a44e22d5088464495eb54f4ffcd1941bd5dbc665708249257cc8c3248f33325f64e2aaba3f536952b6b7c18ecb5c05b44ef1373104d3f07da55cb9cc52600efea71a0af1afba6e503dec74ecf9b0f19e22ccf23a408ea340fd1cf5183a9f5ca6211847e354a641b04090d7b00db35ec4e4cf3540996f10145f56e04b3f5293d6e3df935ccdf534d97da34e759bbb016db0be80dd6bf46282159cbec521cfc4247ba8167508f61a047799471254e987f01579c01c18503279cd61d32fa8148ecdd748b8bca3cf1a3783084800cbe08f9536064ede6f1bf344b41007d5cc624f249ca2a30ece6a6c83965ea1aacc1026619c5f21bc096f192c89c81fa5572e16257062a192b1df38d72edcee47cb632fe6665093783545f549f974a050ee6a182167b9e7cc647dffd2ef76acf3cdeba050d57a4438e0862c2ba09746de15b9150b766b8e712d5d269925d06bf9414208cbbc0544dc76abe1cd306bafc2a50eb6b164ab91e281696ce09e93fd183e885f2317485d9efb70d8af78ee5b51f72131f5c9de6ec25cb28dac01ef474cb893a10cc48e104137928d85f349fc753e3c25986d48263c4378a6a9da7946a267c6ef9ca4f3a131777e838af8eac57dd60607081543a53883a2441e88da4b5d002199a891821497c3d1948966a7c3df0ee7729a62129c8786efe391b30a8f5fdcabc963057228b39a49f94e016bb532fc1e988f99de92fab8d8e495a99d9d388540fb9542df24601fa67c4a310c8c690e35b74f8b335b230210f3b48cab2151a2e87c9b3af0549d56bb302900ec04d0398adac3cabc2050767f51cffb2bda8cac39936b26745a671d44929ab616214ce345cbad19deea4d50eae530827fbbac94491a8c9d2b110274da9ed9a961c88c5b60e7b405c1f29ce254d39f673a6d26be0cd570f7011f63965d202308cbab99acc7925816df7fb00ba5e2bb726826e6362fca58656f7276caf6b9a3b6df917141b46d00a4ece705e7b93ed41bc0aad32134dafbd74a843e97a3c6936569158abfa4088d8834ded28d08bb122cb52d6f8a10452348e2e0088be971f92e61cfb11fa0c0351b2be731b9a45e70e7487e0a1c741ebdf969eabb4afb42a2077ccd454d041ec2ee0b9bd83f39ee0f52890d58499ddafd45ca01ca3f0565b7c49480edb3e21d093dee0f2307c34ec677a286c0e06ffc6722fc7839bf9f9beb980ad131bab25f03ddd8071c46462bb167946dfcb0132c220dad471f934624dea522c0aa06ac7a723684f7757064ad8e5056559667fbc1bd2e5a0ad3131e707436ae1872efc3085bec85723cb0ccf645f374b4fcebb5834e6d5babf66bed632327223adbe4ece13f03f751f3d027d75837b3e7c00990e78449028bd286b068a7b2772291f4532aa4da361ce0f1254fd872bcb5ce1e60b0dd0b987616651a8eae5c192a6b9bbfa8b27b7f2f337122934c72651437780f4d7538bc5d5eb03d3f575bacc65410238c33f1ae927e6d9f09cb7c42d9dd76e6bcb05502936fa9c3b354b716580c3fcc283d0fe25188aa229718b253e46d998d45127b6691997cf11140323cd582ef78ef8645b5e72112a435358935435672a657a1e3024826c2b2905ccdf40d7c326752b75558c05930870ab189c68473928337a5729b125e30a08dae6a55269f1132cf9c795eaa715274de7ba0012ab4bc733e3ec046ec8f714357ac6c24b19832b7629d1d47990cd1411de592e2cecf250f797e6a14f9c6ce7f0180ba00303330f144ed563b9f6e275a5fcfe22f9dd0aed9d421a5e9a9b33e114858942e566295a0b8c7ac8b5871bc57c60116830f609b66080e11ede5ea2a3ad65a2c13e655ebd50ff2621fc23517ef114b27f67fe788fb1f538e85dd3a1224227f3491cd89717f7434e533e5206854d5d009d485d21c74ef612fffeaed721c2bc57a8205041e69b2604e62a85b4ddb71f898b046f2070e26e8e02071321c55563cb2467a906a917935bd8eda7750b0b1e2d5cb4c570a0d54987167130f5e964edf461ab44855af8c758371be2a117f770550f12606ff0da9e298e1886a00ee6066767142e5671b870c06d76322d59d04cf30da1161ab6ed9604a64573c53062fc318638cd57b9f71aff3519a6a3b7bfd61d71f96a83f02be7347511eb28ca7de866dfa927da3b725b0a728166a8024674bcd492b421818ff16135871b46f1f7afd23416ef44d7ca50bf573e1c61201831e1e03d3fff6c36958f4ede248f57096c3b24a98744ab39fe9999b66ce5f61fca53bea5febfa324c7fdd6b4a5a3af70321f934401191b5276ae04f335c1015689e3a9eb97d036bdeeb1c9bb158987d22cda56f0467259332288782aedec12620d27f8c23e1771741ce4840ee843b040569092dd78c13224a647ad2efcd31f5aef1333a784dc5aac207dc251b2b1b22cfb9323674058fee83efa870029b1e4613e99bb9d7c58bbebd7a0e4efe25e565e9d2b33e4653d8fe163ec90abd97c36db7b989acd71f58a344f43b15bfcb1ab92a57c6fdaea7eafeaf27c1e1d261375b138e9798bf5ee0d1e5f5f793b797add7d0d3708ee16df97ab60c5dbc6553057d051ddfe21083f3b6fb0f20ef3ab03523824d1e5e4714e14bb0bf94944c19a3553078e3502b474e1ed545c3435e94ef97ba80d3824cf59ca2f9f90b25dcf6a2010819b508a4db8799c34948c6396d96e67f84a210e4a552135e30faeed0c947a9c84ac425469d5234e6b0ae64bcb0f2f39565644d15a560eb5c27022d7156e900e41f4d8f0fe3f102937a6465b061e95dbb2973383e96b7880b006a747068f68d2b686979288b03b6c7741019b22ef06472d630165a325704f46af8e8b64ee69758cf9e0f8540613d969795dc1a1c2e023d0dc44de53ccee528c865f93fc13a91be7b48ed049db584e138095a5be35f97c199ffda7e266a77edeccd6ab69d34b29701ad91f08cccc2eaf070b4f8b85925302d816cc78c137566fe60bb59662c2285595ca50686279fbf0800b356d8c181ebae7385dddefe73cf7c7de9addec956e387d9fed4650e8bb91d417cda4c162cfe2b6b13fcf2582ca5b8bd2a9c5b6f29f48d988610eb68cb6c531eed37d639de6d8a955c999150e22e805c15230c22ff98c15fc4390fd7ad6b29824c77ac5dec32ed538da091a9286d73b997b1d08751ebe5b83cb541f2866327ac2bdd08d6295ac0c77dd04e1e45ef5ef6bee883452136f2625407c15998d33cbbe76ce142fbf051ed658b9872aba2117a85a94c11dcf360383c9bbad780ecf4fd81245af40a4af0a1ccf2947c497489b81bf56a2973715d53d7a009e527e1fc2bbb909bf32e855a4fe3e5d98ae301a40b3e4cbc1600dec9ca588c103f6869a2041076742f568a5c56fb5ce174c6c780f9d3248e23d500834722e4ceb0d469c70025815bb69a2a5406bb5ccdefc49816d9a6cfefb91b4ade1d7b97e0b9533bd6a7f7eac17ee16712ebefaaf227297af0e76af6db3b7a5750dac093d7a02637f1c3baba12a3ed807c53acb9c5b2c196764f6f3329bd5605e7e5f869283b7c61a649f2f558b6f6e69e06acd2175550b76e067ce514b2ae741ef61e0b328304f69db3a37feb76da86ab3f87f968bcb5cfd55a3d3e55f2371b4de0ed598c9b062606773ae792a9ccf676a876d34332d28157797dea2ae81f62a479da48065b43bd84936a3ae5ce9c49a173ae09f71ed992dae4e1fa77335bee2359d5344707217a9780154a7abe530ea307bf854af55820dfab43e1b105edc1d3396b99027655fed0eb45b67415e57f006dc5495f369ec13731c6b2c61e4dabd7f607482990cab508dbc26f1914f938cc3ad507bb661041ac82016e06f4044ab3b7e265c291e6218ba44e33c86d1718cae6a8af925b7fa2a5eb7189736987656a6b2801c8417bded7e329ab4956ab7170fbd2eab154d1252ed0d64e5472bb747f2417884ad2c1a3d65b3e532ef32029197b8faf6c24a18552a2e6af92db1fabe67f6897c10627df4211d1d98c3225146ecb817f02a50889dfae390b6ee485b2bea36dc8c5c9a60a2d835676c04442e02a125a28564c3aa2b4337bed8007058ebc058b7f638fe2165eb241c34d6323bdcb98d57da6f2a932f51d29615c47b1c346df936a6cdbe25d2e50cfaed5bb40de73903bf0154beaefb6ecd0afefe79742c2d80dcf3e77189afcf2c262b5e49397fbbbdbd0d31c927eb037287e7529e3c30314c6e54713cfc255cd08759d6d7e5091bf14c3da8969772b6ec8cc57ad6daa6ffdcb775066c546b2db6ccd301d83eb7c25c7f5f18cd992a88eb319646491899eec93c3941490b7dd16bba7cd45e9ce605ecf19bf645db29b3152199e995a70f3ea1f674f925c93590d5cf953806b8c0f83293e4a92ac9e2eb154fb96d2481d0a6734b9aa7f16bec3d29381c265cb23c95b75752e26811410aa687b396eb861d6382d8cbb5b32c86667b367645a9db0ce33fee43c195fc7708bf0a7c5847e619eb8e26218bd18bfba2004cc0b293e287bcdb2d6ad3f6d49d69c3aea96f52df5584de8325b69096f731127b67e7c3148b670e1f4ee0819f37fdefd399611d2c6f1c0f012d8048739fed581933cd83886cab2aa11ea9f44af6da9aec98b7b3f519a0d48174a30883a5261254ce24d1c6e0825471aadff27fc78899e22db8dc96bd1836df196cc41e26e7aeddc2e6dad5dc473f44f29b4563d49de84c29bc180ad8642b491bb9595e966d9751a76a5b22567ac89a1b2cf35027eca86d062daf5c5f73794e18fb6618481586c9e423253b908dd41e61e8ba4358faa10f8047dea4a57d0e3b057efca576f4f0d977e5987d1ed65e799a15ce0856b4d0756327406742036cbbffa63f8a1e942658ce9ea98ed3d2027e5071136f85de32b73a090ebfcdbd98688a053498acd3d130b2ed9e55817a2764e7e860bbda2ff0ea7cd840aed4e41e04584d02e78a5c1a24aacc9cf9e5fd73e971581478c572846eddaeeab8f666e2d06edccfc62f02d488484cc59a2f1c60d6d6325203f1723110524898fef4605f47591c68a14ff3afc54177f25b517bd54410e393af21986e962f61220a0728b693b62f986abfa425412301a22225c9b169f1b151cb1583fa5dcb7e45012133323da188805f7ddeb97c6fde6c671ebcf2d867e59491a034461c102e3cbf2a5aca0e60aaf33715c4b41de3dfe3c4aa916fa9324b5a26598c1689c30c8da8bbbfcdd272bfdf04992c8465ad6ae0005f749751642970217533e4dfc6f21f7934461e9d2642dc", 0x1000, 0xfffffffffffffffb) keyctl$get_security(0x11, r2, &(0x7f00000011c0)=""/4096, 0x1000) prctl$PR_SET_FP_MODE(0x2d, 0x1) ioctl$TCSBRK(r1, 0x5409, 0xfffffffffffffffc) open(&(0x7f0000000000)='./file0\x00', 0xc0, 0x40) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3253.556572] team0 (unregistering): Port device team_slave_1 removed [ 3253.562559] binder: 17535:17536 got reply transaction with no transaction stack 18:46:16 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3253.639826] team0 (unregistering): Port device team_slave_0 removed [ 3253.678877] binder: release 17535:17536 transaction 982 out, still active [ 3253.700949] binder: undelivered TRANSACTION_COMPLETE 18:46:16 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x74000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:16 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3253.764355] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3253.770292] binder: undelivered TRANSACTION_ERROR: 29201 18:46:16 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x58) socket$pppoe(0x18, 0x1, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400000, 0x0) write$selinux_attr(r1, &(0x7f0000000040)='system_u:object_r:tmpfs_t:s0\x00', 0x1d) [ 3253.837264] binder: send failed reply for transaction 982, target dead [ 3253.866769] libceph: resolve '.u [ 3253.866769] ' (ret=-3): failed 18:46:16 executing program 2: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3253.900059] binder: 17576:17579 got reply transaction with bad transaction stack, transaction 987 has target 17576:0 [ 3253.912446] bond0 (unregistering): Releasing backup interface bond_slave_0 18:46:16 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3253.981129] libceph: parse_ips bad ip '.u [ 3253.981129] :d]:.,[' 18:46:16 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r1, 0xc008551b, &(0x7f0000000040)=ANY=[@ANYBLOB="4000000018000000080000009a1500000100000000a49ead7244f4f6b0000000"]) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) ioctl$SIOCGETNODEID(r1, 0x89e1, &(0x7f0000000080)={0x1}) 18:46:16 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3254.052456] binder_alloc: 17576: binder_alloc_buf, no vma [ 3254.113030] binder_transaction: 4 callbacks suppressed [ 3254.113042] binder: 17576:17594 transaction failed 29189/-3, size 0-0 line 3035 [ 3254.151538] binder: send failed reply for transaction 987 to 17576:17579 18:46:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3254.189616] libceph: resolve '.u [ 3254.189616] ' (ret=-3): failed [ 3254.210605] binder: undelivered TRANSACTION_COMPLETE [ 3254.242692] libceph: parse_ips bad ip '.u [ 3254.242692] :d]:.,[' [ 3254.293072] binder: 17609:17610 got reply transaction with bad transaction stack, transaction 991 has target 17609:0 [ 3254.401097] binder: 17609:17610 transaction failed 29201/-71, size 0-0 line 2816 [ 3254.418606] bond0 (unregistering): Released all slaves 18:46:17 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000020000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:17 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x83b0, 0x0) write$capi20_data(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="10000400ff0003000400000000000000af004ccb41b836fcfdc903eb2eb00709658085e08635fa4ebd9896bb0800c863c01b6947988d6a932cd1695f1b9292177dec08e9a36b9bf2cbc98e708ef651fecfd2080577670e16a2343426808788e8f3740588b168ee4d7df94f2f305e2f0d3a1f52d8fd5d400123636b96efae944672866dec21a47926ee6b7239c330088407d9fa2ac346fcb9627115c258895feb4bed5cd9d11ba521e88f4f4e6be0f5980338b10c76a99119e3da0abe7026d822d0"], 0xc1) r2 = add_key(&(0x7f0000000240)='logon\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="c58de6aabe0969ffc4e5fb67b12b95e15de2ec7d190df83faa580ad218c52a79189cf9af6ca1777a80e5f3370df366c36df219801cefddf607d6515feaeface7ed3d981f5879336f71ee6be84f34fc7827ed9bf3f5682754a0b4cda78519b6e1895e17069c5a900b7a85e345f88412684ea0b09a85ea02df52a8b2e6388c21", 0x7f, 0xfffffffffffffffd) add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, r2) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) 18:46:17 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3254.478142] binder: BINDER_SET_CONTEXT_MGR already set [ 3254.483424] binder: 17609:17614 ioctl 40046207 0 returned -16 [ 3254.507472] binder_alloc: 17609: binder_alloc_buf, no vma [ 3254.513293] binder: 17609:17614 transaction failed 29189/-3, size 0-0 line 3035 [ 3254.559021] binder: 17609:17610 got reply transaction with no transaction stack [ 3254.584076] binder: release 17609:17610 transaction 991 out, still active [ 3254.593575] binder: 17609:17610 transaction failed 29201/-71, size 0-0 line 2801 18:46:17 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7a000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:17 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="47dcb8bf8e1739afc6cb6be22cff7cf759feb838a50c709b41675190c36c598b71ec70f573a9849234a2956ed870f5a3e368342d335f42508b2889c3b55cdf1780899f515f758dafdcc8899870c8c09c99dee783c0e4814d6d5d3c7adff307af680a1a83d37fa4877024b53776c366bd3fb87269c047a7b6a69d711c76aba8b9", 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x242}, 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="88030000", @ANYRES16=r2, @ANYBLOB="01002abd7000fbdbdf250f0000004c0004002c000700080004008100000008000400fbffffff080001000d00000008000400010000000800020080080000f81f070008000300010400000800030008000000080001000000000014000500080001007564700008000100756470002001010008000300060000001800010069623a76657468305f746f5f7465616d00000000180001006574683a76657468315f746f5f6272696467650038000400200001000a004e230000000900000000000000000000000000000000070000001400020002004e217f00000100000000000000000c000200080002000400000044000400200001000a004e2300000004ff01000000000000000000000000000103000000200002000a004e2100000e3eff020000000000000000000000000001030000000c0002000800030002000000080003000600000004000a0044000400200001000a004e2000000005ff02000000000000000000000000000100000000200002000a004e2400000004fe8000000000000000000000000000bbf8ffffff38000100100001007564703a73797a3200000000240002000800020006000000080003000300000008000300ffffff7f08000300fffbffff90000500140002000800040002000000080001001c0000000800010069620000540002000800040000000080080003004300000008000100070000000800030007000000080003000400000008000100190000000800040000020000080004000300000008000200090000000800030069050000080001006962000008000100756470000c00020008000300040000002c0009000800010002000000080001000500000008000200030000000800010005000000080001000700000048000100100001007564703a73797a32000000002400020008000400ff00000008000400e0040000080003002700000008000400ff010000100001006574683a73797a5f74756e00300007000c0003002a0000000000000008000200050000000c00040000000000000000000c0003002a0182030000000058000100100001007564703a73797a300000000044000400200001000a004e23000000ff0000000000000000000000000000000100000000200002000a004e2300000001fe88000000000000000000000000000104000000300007000c000400090000000000000008000100000000000c00040001040000000000000c0004000500000000000000606a50f5b3756bf6770afe777a137fad2813b847"], 0x388}, 0x1, 0x0, 0x0, 0x40844}, 0x4048880) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:17 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x200080, 0x0) ioctl$VIDIOC_RESERVED(r1, 0x5601, 0x0) 18:46:17 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3254.605891] binder: undelivered TRANSACTION_COMPLETE 18:46:17 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="47dcb8bf8e1739afc6cb6be22cff7cf759feb838a50c709b41675190c36c598b71ec70f573a9849234a2956ed870f5a3e368342d335f42508b2889c3b55cdf1780899f515f758dafdcc8899870c8c09c99dee783c0e4814d6d5d3c7adff307af680a1a83d37fa4877024b53776c366bd3fb87269c047a7b6a69d711c76aba8b9", 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x242}, 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="88030000", @ANYRES16=r2, @ANYBLOB="01002abd7000fbdbdf250f0000004c0004002c000700080004008100000008000400fbffffff080001000d00000008000400010000000800020080080000f81f070008000300010400000800030008000000080001000000000014000500080001007564700008000100756470002001010008000300060000001800010069623a76657468305f746f5f7465616d00000000180001006574683a76657468315f746f5f6272696467650038000400200001000a004e230000000900000000000000000000000000000000070000001400020002004e217f00000100000000000000000c000200080002000400000044000400200001000a004e2300000004ff01000000000000000000000000000103000000200002000a004e2100000e3eff020000000000000000000000000001030000000c0002000800030002000000080003000600000004000a0044000400200001000a004e2000000005ff02000000000000000000000000000100000000200002000a004e2400000004fe8000000000000000000000000000bbf8ffffff38000100100001007564703a73797a3200000000240002000800020006000000080003000300000008000300ffffff7f08000300fffbffff90000500140002000800040002000000080001001c0000000800010069620000540002000800040000000080080003004300000008000100070000000800030007000000080003000400000008000100190000000800040000020000080004000300000008000200090000000800030069050000080001006962000008000100756470000c00020008000300040000002c0009000800010002000000080001000500000008000200030000000800010005000000080001000700000048000100100001007564703a73797a32000000002400020008000400ff00000008000400e0040000080003002700000008000400ff010000100001006574683a73797a5f74756e00300007000c0003002a0000000000000008000200050000000c00040000000000000000000c0003002a0182030000000058000100100001007564703a73797a300000000044000400200001000a004e23000000ff0000000000000000000000000000000100000000200002000a004e2300000001fe88000000000000000000000000000104000000300007000c000400090000000000000008000100000000000c00040001040000000000000c0004000500000000000000606a50f5b3756bf6770afe777a137fad2813b847"], 0x388}, 0x1, 0x0, 0x0, 0x40844}, 0x4048880) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:17 executing program 3: bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3254.691808] binder: send failed reply for transaction 991, target dead [ 3254.698071] libceph: resolve '.u [ 3254.698071] ' (ret=-3): failed 18:46:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:17 executing program 5: openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mISDNtimer\x00', 0x4fd90b6727bc517e, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = open(&(0x7f0000000040)='./file0\x00', 0x4000, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r1, 0xc0485661, &(0x7f0000000080)={0x0, 0x1, @stop_pts=0x3}) [ 3254.764313] libceph: parse_ips bad ip '.u [ 3254.764313] :d]:.,[' 18:46:17 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="47dcb8bf8e1739afc6cb6be22cff7cf759feb838a50c709b41675190c36c598b71ec70f573a9849234a2956ed870f5a3e368342d335f42508b2889c3b55cdf1780899f515f758dafdcc8899870c8c09c99dee783c0e4814d6d5d3c7adff307af680a1a83d37fa4877024b53776c366bd3fb87269c047a7b6a69d711c76aba8b9", 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000600)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x242}, 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="88030000", @ANYRES16=r2, @ANYBLOB="01002abd7000fbdbdf250f0000004c0004002c000700080004008100000008000400fbffffff080001000d00000008000400010000000800020080080000f81f070008000300010400000800030008000000080001000000000014000500080001007564700008000100756470002001010008000300060000001800010069623a76657468305f746f5f7465616d00000000180001006574683a76657468315f746f5f6272696467650038000400200001000a004e230000000900000000000000000000000000000000070000001400020002004e217f00000100000000000000000c000200080002000400000044000400200001000a004e2300000004ff01000000000000000000000000000103000000200002000a004e2100000e3eff020000000000000000000000000001030000000c0002000800030002000000080003000600000004000a0044000400200001000a004e2000000005ff02000000000000000000000000000100000000200002000a004e2400000004fe8000000000000000000000000000bbf8ffffff38000100100001007564703a73797a3200000000240002000800020006000000080003000300000008000300ffffff7f08000300fffbffff90000500140002000800040002000000080001001c0000000800010069620000540002000800040000000080080003004300000008000100070000000800030007000000080003000400000008000100190000000800040000020000080004000300000008000200090000000800030069050000080001006962000008000100756470000c00020008000300040000002c0009000800010002000000080001000500000008000200030000000800010005000000080001000700000048000100100001007564703a73797a32000000002400020008000400ff00000008000400e0040000080003002700000008000400ff010000100001006574683a73797a5f74756e00300007000c0003002a0000000000000008000200050000000c00040000000000000000000c0003002a0182030000000058000100100001007564703a73797a300000000044000400200001000a004e23000000ff0000000000000000000000000000000100000000200002000a004e2300000001fe88000000000000000000000000000104000000300007000c000400090000000000000008000100000000000c00040001040000000000000c0004000500000000000000606a50f5b3756bf6770afe777a137fad2813b847"], 0x388}, 0x1, 0x0, 0x0, 0x40844}, 0x4048880) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3254.852233] binder: 17644:17646 got reply transaction with bad transaction stack, transaction 996 has target 17644:0 [ 3254.971913] binder: 17644:17646 transaction failed 29201/-71, size 0-0 line 2816 [ 3254.990955] libceph: resolve '.u [ 3254.990955] ' (ret=-3): failed [ 3255.024221] binder: BINDER_SET_CONTEXT_MGR already set [ 3255.027499] libceph: parse_ips bad ip '.u [ 3255.027499] :d]:.,[' [ 3255.078280] binder: 17644:17660 ioctl 40046207 0 returned -16 [ 3255.103299] binder_alloc: 17644: binder_alloc_buf, no vma [ 3255.116161] binder: release 17644:17646 transaction 996 out, still active [ 3255.149281] binder: 17644:17663 transaction failed 29189/-3, size 0-0 line 3035 [ 3255.155696] binder: undelivered TRANSACTION_COMPLETE [ 3255.172969] binder: send failed reply for transaction 996, target dead 18:46:17 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000edc00000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:17 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:17 executing program 5: r0 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x7, 0x100) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f0000000280)={0x6, &(0x7f0000000200)="de29433a9773f556999dd630fe851cf7fc57b0c2a98fc26b3941ee9a0b8d469d6036a9bccec1718011b400e4f73f100e0cda2b5aac48e955bcefde7f32aaecd6faaee6c72f979cff3d315ee998bdf9545505a8bd"}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) readlinkat(r0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=""/233, 0xe9) r2 = add_key(&(0x7f0000000080)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="903b0066d15528feb839", 0xa, 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r2) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) 18:46:18 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x8cffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:18 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="47dcb8bf8e1739afc6cb6be22cff7cf759feb838a50c709b41675190c36c598b71ec70f573a9849234a2956ed870f5a3e368342d335f42508b2889c3b55cdf1780899f515f758dafdcc8899870c8c09c99dee783c0e4814d6d5d3c7adff307af680a1a83d37fa4877024b53776c366bd3fb87269c047a7b6a69d711c76aba8b9", 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:18 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000080)=0x8004) ioctl$VIDIOC_S_CTRL(r1, 0xc008561c, &(0x7f0000000040)={0xa3, 0x80000001}) userfaultfd(0x80000) 18:46:18 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3255.533720] binder: 17677:17678 got reply transaction with bad transaction stack, transaction 1000 has target 17677:0 18:46:18 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:18 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="47dcb8bf8e1739afc6cb6be22cff7cf759feb838a50c709b41675190c36c598b71ec70f573a9849234a2956ed870f5a3e368342d335f42508b2889c3b55cdf1780899f515f758dafdcc8899870c8c09c99dee783c0e4814d6d5d3c7adff307af680a1a83d37fa4877024b53776c366bd3fb87269c047a7b6a69d711c76aba8b9", 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:18 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x101080, 0x0) write$UHID_CREATE(r0, &(0x7f0000000340)={0x0, 'syz1\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000180), 0x0, 0xfff, 0x9, 0x0, 0x800, 0x100000000}, 0x120) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x8000, 0x0) ioctl$VIDIOC_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000040)={0x6db, 0x0, [], {0x0, @reserved}}) sendmsg$nl_crypto(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8380000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001200000126bd7000fedbdf25647262675f70725f7368613338340000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000002000000000000000000000080001000200000008000100000000800800010007000000"], 0xf8}, 0x1, 0x0, 0x0, 0x80}, 0x4000) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) [ 3255.618188] binder: 17677:17678 transaction failed 29201/-71, size 0-0 line 2816 [ 3255.677362] binder: BINDER_SET_CONTEXT_MGR already set [ 3255.682761] binder: 17677:17692 ioctl 40046207 0 returned -16 18:46:18 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3255.721562] binder_alloc: 17677: binder_alloc_buf, no vma [ 3255.744683] binder: 17677:17696 transaction failed 29189/-3, size 0-0 line 3035 [ 3255.811786] binder: 17677:17678 got reply transaction with no transaction stack [ 3255.880830] binder: release 17677:17678 transaction 1000 out, still active [ 3255.891067] binder: 17677:17678 transaction failed 29201/-71, size 0-0 line 2801 [ 3255.902671] binder: undelivered TRANSACTION_COMPLETE [ 3255.915666] binder: send failed reply for transaction 1000, target dead 18:46:19 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) set_tid_address(&(0x7f0000000000)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/icmp6\x00') setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e23, @empty}], 0x10) 18:46:19 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000060ff0000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:19 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="47dcb8bf8e1739afc6cb6be22cff7cf759feb838a50c709b41675190c36c598b71ec70f573a9849234a2956ed870f5a3e368342d335f42508b2889c3b55cdf1780899f515f758dafdcc8899870c8c09c99dee783c0e4814d6d5d3c7adff307af680a1a83d37fa4877024b53776c366bd3fb87269c047a7b6a69d711c76aba8b9", 0x80) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:19 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x9d030000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:19 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3256.456857] binder: 17716:17718 got reply transaction with bad transaction stack, transaction 1005 has target 17716:0 18:46:19 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:19 executing program 5: r0 = syz_open_dev$usb(&(0x7f0000000280)='/dev/bus/usb/00#/00#\x00', 0x200, 0x200000) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000002c0)=0xb4) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x80000001, 0x80) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000000200)={{&(0x7f0000000040)=""/237, 0xed}, &(0x7f0000000240), 0x41}, 0x20) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f00000001c0)=0x7) bind$alg(r2, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x5, 0x0, 0x10) [ 3256.504376] binder: 17716:17718 transaction failed 29201/-71, size 0-0 line 2816 18:46:19 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3256.546059] binder: BINDER_SET_CONTEXT_MGR already set 18:46:19 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3256.592390] binder: 17716:17729 ioctl 40046207 0 returned -16 [ 3256.592742] binder_alloc: 17716: binder_alloc_buf, no vma 18:46:19 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000040)={@in={{0x2, 0x4e21, @local}}, 0x0, 0x401, 0x0, "176996df8a9b650424830af1a51acdf1f0344aa9d8aa5ef8465e3442f59746a3fdfbffe3d7d12faca1144a43fb9a7a8d834a626cd223b875e503e5fea9d321adb3f9383230c8ef7d1a3290f216dd1a42"}, 0xd8) 18:46:19 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) socket$alg(0x26, 0x5, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3256.662069] binder: 17716:17718 got reply transaction with no transaction stack 18:46:19 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3256.745573] binder: release 17716:17718 transaction 1005 out, still active [ 3256.774646] binder: undelivered TRANSACTION_COMPLETE [ 3256.787945] binder_release_work: 13 callbacks suppressed [ 3256.787949] binder: undelivered TRANSACTION_ERROR: 29201 [ 3256.870170] binder: undelivered TRANSACTION_ERROR: 29201 [ 3256.912262] IPVS: ftp: loaded support on port[0] = 21 [ 3256.924675] binder: undelivered TRANSACTION_ERROR: 29189 [ 3256.930205] binder: send failed reply for transaction 1005, target dead [ 3257.114175] chnl_net:caif_netlink_parms(): no params data found [ 3257.157715] bridge0: port 1(bridge_slave_0) entered blocking state [ 3257.172989] bridge0: port 1(bridge_slave_0) entered disabled state [ 3257.186758] device bridge_slave_0 entered promiscuous mode [ 3257.201706] bridge0: port 2(bridge_slave_1) entered blocking state [ 3257.218377] bridge0: port 2(bridge_slave_1) entered disabled state [ 3257.225849] device bridge_slave_1 entered promiscuous mode [ 3257.246622] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3257.256082] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3257.291145] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3257.310388] team0: Port device team_slave_0 added [ 3257.316949] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3257.324129] team0: Port device team_slave_1 added [ 3257.329550] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3257.336854] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3257.386272] device hsr_slave_0 entered promiscuous mode [ 3257.435168] device hsr_slave_1 entered promiscuous mode [ 3257.485101] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3257.491954] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3257.506796] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3257.540213] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3257.549039] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3257.557821] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3257.567217] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3257.574112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3257.582850] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3257.589271] 8021q: adding VLAN 0 to HW filter on device team0 [ 3257.596959] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3257.603935] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3257.611721] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3257.619308] bridge0: port 1(bridge_slave_0) entered blocking state [ 3257.625652] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3257.633561] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3257.641360] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3257.648660] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3257.656523] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3257.663964] bridge0: port 2(bridge_slave_1) entered blocking state [ 3257.670316] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3257.679785] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3257.686828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3257.696737] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3257.705537] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3257.712388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3257.720340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3257.730981] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3257.746225] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3257.754984] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3257.761906] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3257.769668] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3257.777285] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3257.790250] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3257.799596] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3257.805919] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3257.821297] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3257.832066] 8021q: adding VLAN 0 to HW filter on device batadv0 18:46:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000f0ffff0000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:20 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000000c0)={0xd000, 0x0, 0x9, 0x6e, 0x401}) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:20 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(ccm(xeta-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:20 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) 18:46:20 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xb9020000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000040000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3257.943848] binder: 17778:17781 got reply transaction with bad transaction stack, transaction 1010 has target 17778:0 [ 3257.979258] binder: BINDER_SET_CONTEXT_MGR already set 18:46:20 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x8080, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:20 executing program 3: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x7a000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3257.997448] binder: 17778:17790 ioctl 40046207 0 returned -16 18:46:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000ffffffffff60000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3258.039008] binder_alloc: 17778: binder_alloc_buf, no vma [ 3258.096762] binder: 17778:17781 got reply transaction with no transaction stack [ 3258.118009] libceph: resolve '.u [ 3258.118009] ' (ret=-3): failed [ 3258.140204] binder: release 17778:17781 transaction 1010 out, still active [ 3258.151217] binder: undelivered TRANSACTION_COMPLETE 18:46:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000074000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:20 executing program 2: read$FUSE(0xffffffffffffffff, &(0x7f0000000a00), 0x1000) [ 3258.176735] binder: undelivered TRANSACTION_ERROR: 29201 [ 3258.205615] device bridge_slave_1 left promiscuous mode [ 3258.212296] bridge0: port 2(bridge_slave_1) entered disabled state 18:46:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3258.222490] binder: undelivered TRANSACTION_ERROR: 29201 18:46:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000ffefffffff7f000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3258.260600] libceph: parse_ips bad ip '.u [ 3258.260600] :d]:.,[' [ 3258.273143] binder: undelivered TRANSACTION_ERROR: 29189 [ 3258.286485] device bridge_slave_0 left promiscuous mode [ 3258.293610] binder: BINDER_SET_CONTEXT_MGR already set [ 3258.294267] bridge0: port 1(bridge_slave_0) entered disabled state 18:46:21 executing program 3: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000082010000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3258.332636] binder: send failed reply for transaction 1010, target dead [ 3258.341987] binder: 17831:17832 ioctl 40046207 0 returned -16 18:46:21 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = open(&(0x7f0000000000)='./file0\x00', 0x400000, 0x100) ioctl$KDSETMODE(r1, 0x4b3a, 0xa47) 18:46:21 executing program 2: read$FUSE(0xffffffffffffffff, &(0x7f0000000a00), 0x1000) [ 3258.415419] binder: 17831:17832 got reply transaction with no transaction stack [ 3258.499342] binder_alloc: binder_alloc_mmap_handler: 17831 20010000-20014000 already mapped failed -16 [ 3258.531160] binder_alloc: 17831: binder_alloc_buf, no vma [ 3258.541782] binder: undelivered TRANSACTION_ERROR: 29201 [ 3258.553451] binder: undelivered TRANSACTION_ERROR: 29189 [ 3258.582058] binder: undelivered TRANSACTION_ERROR: 29189 18:46:21 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xc0ed0000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:21 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000f0ffffff7f000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:21 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x200, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000040)={0x2, 0x0, [0xffffffffa96cc585, 0x3, 0x0, 0x200, 0x8000, 0x792, 0x100000001, 0x8]}) pwritev(r1, &(0x7f0000001640)=[{&(0x7f00000001c0)="472ed4df616a7a637cb66c4c0b59b2de3ce2d687be8023417951d9315abeba7172653ccca37a34d9ad2a5d771949c37d8e234001a46c210b8945e78e1ff594769fdb88e73f4371f33a413b84630bc6400c9d547fdcf72702e891daec4cefc5ba8e5ba569de5efe02330d70260a4e8b97e576ee86233ce3840df1665c4f608bb9291d31b8879ee09274e94f5c2d22cee7a0c36aca388ef0a902c8b5a6f5ab0ab2b1fe6a1846fc8f88edcbbff34d66b1b5e5344e1283bda507b733198519f0eec2eec72b4a233b18c58f88050c94b4676a8e6e97605d6b7506a7c1be190cfd45bc19ed78e6a8790be90a1ab0c7848fc984f989503e7bc3df12c210", 0xfa}, {&(0x7f00000002c0)="3c81502be9c78611764d625dd8d15b5f797d801d7c14459b0239b5d2d2df16f6ef1ec07590f209a7559d10027a381186b0b0135496d14d73722f85633308354ed787ba07faad7341988ee54e9d467826da4cd55dd40571c7e305859fe14922d25cdad17194468bf8564e1ec255bd2da3201aa6b27b730effbee99a683832f431fbf4a564d66622d1cc148ee20538c59091552200cd1b2db76a76b2c2208a63a6701e69612d47b42ca461146277adb98bf354ded45fb16450782d58776ae6f2833f7c8fcf27f5bcc348d8d958d3943824ca819e33a7d2c4afae021839", 0xdc}, {&(0x7f00000003c0)="210b98a7d8bdaaff793644af88ae3a1ff463bdc20b897a0b5ae5914d6bc2542ade5acab159b1e08f86635c3828a1749048f11bcfa57db97e8cfdf5a34ff256d92c18a77221e5115a83039ac0241e94f70abd44c78f3cb743b18ed929328a233bd8fc217ac1", 0x65}, {&(0x7f0000000100)="3259ed999f20506c1107e5c7d7825dbcef633589e1f00ffe42efd4930431b367db4246823b0b2e557b853a17b4", 0x2d}, {&(0x7f0000000440)="0c1c98c76f9b8618ec5d918c0cee481688349796c4c6af4b3df57982c9a5d70b8ff3d79ed4ca9458ba2508f4fe88b45a70285db1f4fda5ee6e6db12b07b6ac23ab54a649a53c64f9a951aee33979c890c34f7b6066e791f0400fd66105beae18f9a7cde5cbbf30e498af84aabc656059639041760289077588f0f3386a4288e28d6adf46773e552fcbff156fc076a1c008ea6d7f192bb5a1918f10afe6a8c3644d2c6b146c42278d8137b30997d1c8dcbaa4c2842b55ffea8d938336e1b8466fc6f9094182e338a1f44f795db507225fbcbd77e444e352a7cba2801b031188e3f0126bafa978792da9935711b09e096e333dc69261b34c6f78bf70f10f18774f6914f819551b2224449946b0a7a651c35aaa2c9a41a7ac0dc89c71e523de3cbb88b8b9fbc9cdfbfe22c4af807d771918a31ed8253b1b42ba3207fb65c903fa7c3e76adfc923d1f774b493f22c04d42a57afa73699e63690719c3f8605eac87c84eaceae39898dcc3ec34b53b376be17fe40e36b0eb0384c075eed18478d79217c3da4203978dedaee6a7595565b2f7b587ef7e41be25f8e0231fdeeace71daf2393543e5eaff1d39e00d1ee0d6db6586ac2606c4e8007a4b5802d6e7b16996788bbdbdfc3074bb21f6263a5bf48bb7bfa50aa892efbc032c04b11184e730137d454e0ae2a6990e30029553dacce4a10f464d4b93511d08c21ec463fd8e6a1d966b28e01685b88c7887203291d72173fb5303d51c38e9122ce18861d5ec5ee9035133d45e2464e3850aea1732308b0b6f147651581c1a390d05088c8703da34087cd8a7ba164b1985aa079bff977c6ad5be85f9e908c0929bfd8660f36adc524fc112c1e305257b5665ab50044fa6c310fce642aea948e319b865b77fe00e767172bbac0a7a7f5c3fe67de2d00d2c310340208b36013d7c5c1b97d2600b12d5a3092e38237d221ea132d102176397029d42b495a9cd7cf05e49b76f239e85f45e2e7a0cd18318e513fbdcad924d11c2fa08cc34c08538e94311e95ea59e7c6e4529845020d144ecce2c1a20d1fa88f01b67b2ce240d5c3a9fbf134439828f48ee3cb161b7d679aa8afad2cefacf5746d83a2ead0c6c85a21a0b0a5613491e9139f45d4557ff708a067c5ae617dc0ebea6c0c9171942760caf278b051a44b86efc828026fbd19548e2a05c193c250d496746426b096d62ba92451af8ab170fccd4eab69e4e052ae5d6354336079abb9facf9edad028bb13343f2d69173e38c624bc9b6e10c7ca44606de68e534f6f9271a8f4be1e725bc398f46e1e3acd407a97079ee1d1e7420b5c7a55ab992ae4eb7509d7c97d786e72938642a3261c4eb5f514a2c972e41a93fdc92fef2a78f8005d86c652af7d508d95a01cd612569df2986d54bd0cb4d72e7d0ea6b3fc4579631f534a7c60f45c9250fed0a04ef43d57b2a51ab98b9232b961badddf31b15e816f514427549b850c5028cd0ba7f6465cfd295f82ade8027a6984146664b9e01de36439cef3414029d8fb88edfcd47f08b03f5cbacbeb250a70e447b65d2ffe6c8b449cd147718d95866a7045aa8a743a3b5902659f0c1fada42b277acd0cd8a0a1fd8bfd2d7381757c65f9718236684bef1e0ce4cd2666e373e2d0a09c1ffeefc77c11b0ffd27b6b14b0e6aefe90e2b02a3f33706f7333f42e496e1e17b283fdd67f573d825df06bbb24e064e236e019d78635e5f9cfd013d8fe3b42f820887fb5c378cdb407624c2f8414a7ed3b505f17894186fa4763147bfd8e49d6e529be26aa76182d109cace0267bccc4bd62d393a236ccb4431636a58e1f02268864673bedee75465361389dfd21c0192a10946456f2013f8629d64c0df396307912760d79fc9b8b0166a6bb782a0eb05c80d4708bb94bdc07900d0c9aad960da56380cf3b6c4efb91aedef662289b5e86247d40466ab85eaf1c364523975fe29ffed1bdde33d32c5756415e64c098bf6ef5ec3fe7c1d17d248c31ed32146aef531252a7fbbf8e88e48731d5fc933244e7a6deb7ef7e716e0936f9952a728a715f6589249e65e41735aeed187fe8f8df88bf513c71e94c1dd50c4ddf1f6850ee8df0eae97661061ea4e304530657528120e6bd3c512189958e5bc2ba160277e74cddd2081c376009561b0c18ea1bc907175fb0b5c59c47ff6f2be92745d214e7a998d7dd6b7bb43522b5b9bcf831351e753e697bdeb7515950e75f01cddc4c39013a6e2b3aa9918e9013bf8658d405fcce6bbad352370950622fd3a5522c164439bf9027bb081a4028a9e0fbed4afc8a4b0d2625d9f4e7d13e5b0089d4416a4cad0783ce947dbf53e3bb6c5f023f3f4638fcfc0b1d50e1bb3ed1bfd562db35429f7cd95079b6c522bd4e552d6610114f6e6bd28204a67b69adff08262da2f0523344322344c0c5f2ebaebd5405601d04e58990d236f3f4e026e353083ffaa605a839514ec87f16bf9f5a78b3d880ea8756c9eff8e65b2e2c759866e723a6f3627010ae295e02115c00e97073a0b50108d9fcf8113b9c96e34d5a39457708338b9b0536201cf31ea5efdae71e07bac45bd7c3606e0341658405469ea7f83b2955a6e4f42ce4ac6b68bbad16e31665b987996051e77cb1a3d8e1b48fbd1492aafb168c9265496a5419ed0f100a112ee0d3b70d43426e87bc6d566f5f7f0aef6174fea24904145f3b4b3276e90dab946a845d317beac0a5bd457dc9f77a52a87fa868aefa65f7a8ebe321d58d380f618b81c373ed6509c582dcc2ba5aefdafc2db6b2ff2b1dfe43921d188ce57a4eb8f17676b094788e0d2f651f11e3e0eb5552bd03c7477f161a204c467841b7c8d8aa04fb84694900a9ec3b3bc137bac843604d99a971dbb874e412b3a76e538a55fbdb194ed88da7df602a82fa7e9af62b36507e532186771fa3dc822a62b93e7fd7bc3aec41a8195910f3a23db9f6765899424cb2acd6cf19500a671999a50f4abc5a3c5421554e6e31e9c48e673ce59e4d06557b686e2edccb09f3fdcd79d8eda9c25ac73257f19169b345c63665ec36169a6c8eeaaebe12ccef13102c47a0400dd6b3581e27bb75a89c329178a6d9f7dd6bcecb5ca69452344d593d50404e68a54e0413725cacf0f94e13057aef6425b5c531639ba86d2405bb76b3b6383ac78668c3d9250502e614d0681906c9cba8f59e8e0a7f28f64d5103107b70f6202aab8ba9ffc254dff7c55f1e064da4930e1b4981d4d4e2ffc5dca98990fe9ddad982dea97c2b767223de9201bbcd9c067ab83f2f4b722d5e7dd25bc9405e740b13301bea1f35588a6c0fcacfe522a2a3d4757ff58c2b1a172018a04e2ae1827760efe00c2cbb9331fd35d592ce00cd5c02bd2c7aea8d7f576fca32d3350207e1e6a717035d8c93fac5c008542d4344720c6934d780f75f4b1037599e2ce43e10a081ee6dccfcfdf01396d225b1c82472d995a4cbb77502c426ee644949749f1c937f76cc10b2d958383b15f1e8fa64e2f953bbca9678cbc6f11ae65d230f9c0e54f96cd284a60a3029816c1ac622c1179c4c750b0ced39544e2157475116a26e263d52dff9f53fdea382decd07f5c3ae9fc3142aa465ca0dbbdaf734ab3e4d161e8feebd7f39eea882a29f63d480d999f89045ddd48a29ba1430e71ef7261c44f7e13eefb3c3f02a7dd2e16dad3149d95dc043d3318e5b62bab8463301acfb7b5de961045ed53bb4035b547185d5a9c5e7ae79898df86408261fe98d01218b2357edc67b4378354eb78a5d3d41dff8331847157a34e3f3b39ea25232b6d671b449c89421293900b85c03d99748235a96b9e2cea10aa3cc07502e0debcf66d76f3f33d1f8ed0cc3710610a2e2a0766a2d59a9d4e2347ed1a623322f13cf52c3429ccbbe830cfe7a5d30b450bc8398ebc224ef55fbbd33642cfd08a47c370dc31115730fdd1924a8befcda53e8b007f09a3b91fc1e3c90899202e0ec0c1d58443c43edd727ad0102caf709fdfcaf8a9262cbe3c15259279702be3e19431a0cbb912051541ef2d99d0fdee4a90015b0e1b54a967f496eecba4d8b70f36ceea3516484e96a33a5866e433819d65c80b63ff996977b45e941c50190acd4f57023a08358c657f5b4f47a97e6b821955aad27f5eb870d11ed70c6a31113539d8bc5db1b73342124bf9d7e6fb369723755698a5629b9be105c334020c10c520478da9abb76a9feeb5cade5c93d35c0dbfc9cb2da2c6baecc866c54333b48e3d7e4b86850d470bd226ec879a7663b865c5713c4dfabd1933f8a5c398a849a528d90c1b99c54134d22e8bb3387c3df3e66446b809cb6ca3eb7422bf8df9d5113ad6d5f149419b26e0cd105f8b1dd28e2d506824b3d800fa86da068c803d5ed67110c4b98e75c38b646085357b0941a58ef65eb2447dda55c510c3c2ddb31262bfa26c81f17f29d76693eaecb5dd05a4dfb52b241f12799141ea96f842a2e3f4e819acddc5e898554ea7fc7fa57a42010a97649cda9239e942c8fdebe8ec8cdc718cb76e22fe71a76c0e5ed9b4476027100cec5af38ebb70752b30af0292809ac83d450d4d84f9ace1ce587f7538c258dd7da22a08259f0338ce3b0b60bd926c2d20d87b00ac7f2d6f234bbbb1bcd887635a7eceb8097f9fae206627c1859b86e4d22d8c81ea83ff2bc689b04959e6e219aa0eb68638f12b457d6b4b283a5c1cb0dcd1bcacfc088c32bc4159cfee03043c423c78c6e4dee94928bb2bc2bf40c4cb227d9c4d8094e92b56c1ac608c83699eab9e81dbdd6a22473896c7054b938969ffd38fc49baed727585a4eb2ab5851eebf217625aa9eebbb309b840ce4ebc666b5396ee95defeb0c11fbc2a8b241c2bfe0c2d30a8324ad7be0216daa885cd732ab621eaedfa77bd87061cee9d6371ddecd9bd3c2cc66653d5ad902b16c5796f5fa4202a242245fabce9115e38430e563d4a045a7b7fbad0a75eba998800511b0dfb8ab60948b1f5f8715e489cc3facc2d7f257dab91d504b4630b5edc2f1125f20b82f86eb4c91eaa7f74c23f81cbffc3a6bd2ef1d866504effb8cbd5a1f0629a654b96df1d7e0e0105cc7dffc976adb79a8ff5e72b7f5549882848c837d418287c8c1850eefb11035af55a22577a58a3c5fcb970a9ac7e1d11a5a55a931ac42aac638461d123d51d2ebce44423f79eeafb8dd5a303f994c4a17e74888bd9227c4b06bb7c0d07fb8cb9027a1df731916cfd9ed47ea5876c6139e7b000688b3d283995148cd0e890d00159c76eb2eeace915ea79c89356d8c9c333f81fc39f6bf4a4e8c52eca3cdf928468fe0b710374b201f61151bd3664942c7d3b7c67818fe0fb1652d3f0d495507f49023db8110a9147b923d997dcee75d73fdd116a9b138794514564b60895faa20e4fd4dea021f4c7aabbd415cc1bd1a57fadfa393e4fc4148b957e8c968345c6e71c480b2fc84ccd15cdf0df40faf1c1bbd857169c48ab3f5a8acde9f2718a0543441650ae19b005681cb04ae9ed1765d71db3eab5c78b7c8e0b51b09c68e6b8163b33c8b4b5750604d70374858babc1d1409a05eef55bf6b64da63bc71568da3e6d64b8cf9d5643c774f96aa19a773f752e6e1a33e3b936c266ddbd383cc88bffe088470275f7104752fb3f055c1a4c81be80a7597eaa12123434a605dc6e6eae5eada4d28b5e1c07437f0d85efd95ac5374cb7d77ec858f09bf0407e07744057086f98938f8c1e3bbe851ed882a76749f1980b2b4bc0b322a71e415563e492b5cd40833877ed44c08e0bcb19ee338add15055e3e0fc614f1dede2a107904e303b7e", 0x1000}, {&(0x7f0000001440)="b89c86ef715296d3dd1f0507f1ca9262dc3c7731f16b2c5397c401a489c51d2b9b7c0bcf62c92feb6e495541f733776a015430dc6c17969846c9c3806af7fda896e38ab8fd3b800db58af73fbed343b5f2ac0ace3f481829681684fc11a00b3a68febfcad69258110ad812306a538d0e809d26c2863f47ba4f57c999775e862e7a9b5e033008a3b554e6e315a83931b2d225a94b9342f14128ad730c5d28846346a27f7b5382e3ada7ddce336da86d75ed664d7835076f912a8ebd4d33e7e49447c572d6f3177bcef315c005760fac5cbb92132c89f7dbfb894013eb8a476b81451bb3cfb3a752a1f27188ad580efff3d1cd609ff584", 0xf6}, {&(0x7f0000001540)="2ac88d89618c2f011cc26438c148ea495722e702f72787066a02b42f7e9cecdbd2b029e373db3b7758ceb4cb6f3914b10bc2d3bb327656a5e191621bc3528e968e2d538ee13597b77cffee1dc9d953b39ec4a223fddcf9e9de9ce1a1c6a3b46a24fbbbbf70d0c781c308eadc3357c74684d3096e7a6595ed5ea66ba975b971b15e0c54957535290fd61ff1c634de1931adc9a4d823bafee5437b141e3ace3120d64a97513384880333731983dc9babfd45c17dadbc17da23b20659df10f4393b4ac4a57efaa1", 0xc6}], 0x7, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x3, 0x400) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffdec) 18:46:21 executing program 2: read$FUSE(0xffffffffffffffff, &(0x7f0000000a00), 0x1000) 18:46:21 executing program 3 (fault-call:2 fault-nth:0): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3258.723162] device hsr_slave_1 left promiscuous mode 18:46:21 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:21 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000182000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3258.805812] device hsr_slave_0 left promiscuous mode [ 3258.817962] binder: 17873:17878 got reply transaction with bad transaction stack, transaction 1019 has target 17873:0 [ 3258.834459] libceph: resolve '.u [ 3258.834459] ' (ret=-3): failed 18:46:21 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0xffffffffffffff55) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = shmget$private(0x0, 0x3000, 0x78000000, &(0x7f0000ffc000/0x3000)=nil) shmctl$SHM_INFO(r1, 0xe, &(0x7f0000000000)=""/192) 18:46:21 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x8080, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3258.873581] team0 (unregistering): Port device team_slave_1 removed [ 3258.894772] libceph: parse_ips bad ip '.u [ 3258.894772] :d]:.,[' 18:46:21 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x7) [ 3258.925944] binder: BINDER_SET_CONTEXT_MGR already set [ 3258.933977] team0 (unregistering): Port device team_slave_0 removed [ 3258.947547] binder: 17873:17894 ioctl 40046207 0 returned -16 [ 3258.961909] binder_alloc: 17873: binder_alloc_buf, no vma 18:46:21 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xd7010000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:21 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x8080, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3258.978103] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3258.993717] binder: release 17873:17878 transaction 1019 out, still active [ 3259.010854] binder: undelivered TRANSACTION_COMPLETE 18:46:21 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x18) socketpair(0x5, 0x7, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e20, 0x6, @loopback, 0x7}}, 0x0, 0x8, 0x0, "ef8b47295dce8ba60112f92d0935d86128ba079f03870de0377d40b28b095dcd24e3f52d339cd5cb51e26ffc79509f4884bb1815086a95e876340d02b2619b0504c28142d31eb8f680d8e27ddcec3822"}, 0xfffffffffffffdda) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) prctl$PR_SET_DUMPABLE(0x4, 0xffffffffffffffff) 18:46:21 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000094000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:21 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x404400, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$VIDIOC_ENUMAUDIO(r0, 0xc0345641, &(0x7f0000000040)={0xeea, "7d1d8a74fd8cd83eedf7de42b1dfb23ed7412323e6bb42342721a4eb0778c042", 0x2, 0x1}) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0xffffffffffffffa1) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0xfffffffffffffed7) [ 3259.040442] binder: undelivered TRANSACTION_ERROR: 29201 18:46:21 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xe4010000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3259.090090] binder: send failed reply for transaction 1019, target dead 18:46:21 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x8080, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3259.133443] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3259.140847] binder: 17917:17925 got reply transaction with bad transaction stack, transaction 1023 has target 17917:0 18:46:21 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000000000c0ed000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:21 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x10000, 0x0) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000040)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:21 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000071300000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:21 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = msgget$private(0x0, 0x400) msgctl$IPC_RMID(r1, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3259.246771] binder_transaction: 10 callbacks suppressed [ 3259.246785] binder: 17917:17925 transaction failed 29201/-71, size 0-0 line 2816 18:46:22 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3259.333723] binder: BINDER_SET_CONTEXT_MGR already set [ 3259.353935] bond0 (unregistering): Released all slaves 18:46:22 executing program 5: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) getsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000000)={@empty, @local}, &(0x7f0000000040)=0x8) socket$rxrpc(0x21, 0x2, 0xb) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) connect$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x3, {0x40, 0x1, 0x3}}, 0x10) connect$tipc(r0, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x1, {{0x40, 0x3}}}, 0x10) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x10) [ 3259.382632] binder: 17917:17951 ioctl 40046207 0 returned -16 [ 3259.390320] binder_alloc: 17917: binder_alloc_buf, no vma [ 3259.411644] binder: 17917:17958 transaction failed 29189/-3, size 0-0 line 3035 18:46:22 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000a00), 0x1000) 18:46:22 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x2000, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040)=0x10001, 0x4) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) [ 3259.436711] binder: 17917:17925 got reply transaction with no transaction stack [ 3259.452883] binder: release 17917:17925 transaction 1023 out, still active [ 3259.472249] binder: 17917:17925 transaction failed 29201/-71, size 0-0 line 2801 [ 3259.482160] binder: undelivered TRANSACTION_COMPLETE [ 3259.505216] binder: send failed reply for transaction 1023, target dead 18:46:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:22 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x8002, 0x0) setsockopt$CAIFSO_LINK_SELECT(r1, 0x116, 0x7f, &(0x7f0000000040)=0x2, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) socket$alg(0x26, 0x5, 0x0) [ 3259.692031] binder: 17979:17982 got reply transaction with bad transaction stack, transaction 1028 has target 17979:0 [ 3259.713557] binder: 17979:17982 transaction failed 29201/-71, size 0-0 line 2816 [ 3259.774678] binder: BINDER_SET_CONTEXT_MGR already set [ 3259.780088] binder: 17979:17984 ioctl 40046207 0 returned -16 [ 3259.786568] binder_alloc: 17979: binder_alloc_buf, no vma [ 3259.792217] binder: 17979:17984 transaction failed 29189/-3, size 0-0 line 3035 [ 3259.800088] binder: 17979:17982 got reply transaction with no transaction stack [ 3259.807937] binder: release 17979:17982 transaction 1028 out, still active [ 3259.815402] binder: 17979:17982 transaction failed 29201/-71, size 0-0 line 2801 [ 3259.823001] binder: undelivered TRANSACTION_COMPLETE [ 3259.828750] binder: send failed reply for transaction 1028, target dead 18:46:22 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf6ffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:22 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000a00), 0x1000) 18:46:22 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000050a00000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:22 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x1, 0x70bd2c, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008850) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:22 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) fadvise64(r0, 0x0, 0x109, 0x4) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x4, 0x0) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000000100)={{&(0x7f0000000040)=""/112, 0x70}, &(0x7f00000000c0)}, 0x20) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:22 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000070a00000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3259.924370] binder: 17989:17992 got reply transaction with bad transaction stack, transaction 1033 has target 17989:0 18:46:22 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x1a575207b14cf) 18:46:22 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha224-ni,xts(serpent))\x00'}, 0x16) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3259.989921] binder: 17989:17992 transaction failed 29201/-71, size 0-0 line 2816 [ 3260.017201] binder: BINDER_SET_CONTEXT_MGR already set [ 3260.023869] binder: 17989:18003 ioctl 40046207 0 returned -16 18:46:22 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000a00), 0x1000) 18:46:22 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000000000017fe00000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3260.113312] binder_alloc: 17989: binder_alloc_buf, no vma 18:46:22 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) [ 3260.162006] binder: 17989:17992 got reply transaction with no transaction stack [ 3260.164741] binder: 17989:18014 transaction failed 29189/-3, size 0-0 line 3035 [ 3260.272929] binder: 17989:17992 transaction failed 29201/-71, size 0-0 line 2801 [ 3260.280693] binder: send failed reply for transaction 1033 to 17989:17992 [ 3260.326381] binder: undelivered TRANSACTION_COMPLETE 18:46:25 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffffffffffe1c) 18:46:25 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xfc000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:25 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x3900125c71d8adbb, 0x0) dup(r0) r1 = socket$alg(0x26, 0x5, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x400, 0x100) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) prctl$PR_SVE_SET_VL(0x32, 0x2ea88) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x9, 0x2) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000040)=0x6, 0x4) 18:46:25 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) 18:46:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:25 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000007ffffffff00000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:25 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) [ 3262.424217] binder: 18031:18032 got reply transaction with bad transaction stack, transaction 1038 has target 18031:0 18:46:25 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = gettid() process_vm_writev(r2, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x2034cf24}], 0x5, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000000)={0x0, 0x3, 0x200, 0x1}) close(r1) 18:46:25 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x21) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3262.485552] binder: 18031:18032 transaction failed 29201/-71, size 0-0 line 2816 18:46:25 executing program 2 (fault-call:1 fault-nth:0): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3262.568742] binder: BINDER_SET_CONTEXT_MGR already set [ 3262.580963] binder: 18031:18042 ioctl 40046207 0 returned -16 [ 3262.606036] binder_alloc: 18031: binder_alloc_buf, no vma 18:46:25 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}}}, &(0x7f0000000080)=0xe8) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f00000002c0)) fchownat(r1, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1400) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getcwd(&(0x7f00000003c0)=""/96, 0x60) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000000380)={{&(0x7f0000000300)=""/56, 0x38}, &(0x7f0000000340), 0x40}, 0x20) 18:46:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3262.635378] binder: 18031:18032 got reply transaction with no transaction stack [ 3262.650042] binder: release 18031:18032 transaction 1038 out, still active [ 3262.659679] binder: undelivered TRANSACTION_COMPLETE [ 3262.672890] binder_release_work: 11 callbacks suppressed [ 3262.672895] binder: undelivered TRANSACTION_ERROR: 29201 18:46:25 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3262.730378] IPVS: ftp: loaded support on port[0] = 21 [ 3262.744295] IPVS: ftp: loaded support on port[0] = 21 [ 3262.753285] binder: BINDER_SET_CONTEXT_MGR already set [ 3262.793798] binder: 18056:18059 ioctl 40046207 0 returned -16 [ 3262.799917] binder: undelivered TRANSACTION_ERROR: 29201 [ 3262.800735] binder_alloc: 18031: binder_alloc_buf, no vma [ 3262.811657] binder: undelivered TRANSACTION_ERROR: 29189 [ 3262.819950] binder: send failed reply for transaction 1038, target dead [ 3262.856949] binder: 18056:18059 got reply transaction with no transaction stack [ 3262.867372] binder_alloc: binder_alloc_mmap_handler: 18056 20010000-20014000 already mapped failed -16 [ 3262.877087] binder_alloc: 18056: binder_alloc_buf, no vma [ 3262.883081] binder: 18056:18059 got reply transaction with no transaction stack [ 3262.890918] binder: undelivered TRANSACTION_ERROR: 29201 [ 3262.896527] binder: undelivered TRANSACTION_ERROR: 29189 [ 3262.909198] binder: undelivered TRANSACTION_ERROR: 29201 [ 3262.928976] binder: undelivered TRANSACTION_ERROR: 29189 [ 3263.055886] chnl_net:caif_netlink_parms(): no params data found [ 3263.092344] bridge0: port 1(bridge_slave_0) entered blocking state [ 3263.092364] bridge0: port 1(bridge_slave_0) entered disabled state [ 3263.105759] device bridge_slave_0 entered promiscuous mode [ 3263.126543] bridge0: port 2(bridge_slave_1) entered blocking state [ 3263.132873] bridge0: port 2(bridge_slave_1) entered disabled state [ 3263.139818] device bridge_slave_1 entered promiscuous mode [ 3263.157334] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3263.166269] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3263.176842] chnl_net:caif_netlink_parms(): no params data found [ 3263.194001] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3263.201145] team0: Port device team_slave_0 added [ 3263.209396] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3263.216568] team0: Port device team_slave_1 added [ 3263.224253] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3263.241832] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3263.336222] device hsr_slave_0 entered promiscuous mode [ 3263.385176] device hsr_slave_1 entered promiscuous mode [ 3263.465150] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3263.481184] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3263.488091] bridge0: port 1(bridge_slave_0) entered blocking state [ 3263.494410] bridge0: port 1(bridge_slave_0) entered disabled state [ 3263.501431] device bridge_slave_0 entered promiscuous mode [ 3263.510569] bridge0: port 2(bridge_slave_1) entered blocking state [ 3263.516970] bridge0: port 2(bridge_slave_1) entered disabled state [ 3263.523719] device bridge_slave_1 entered promiscuous mode [ 3263.549023] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3263.558061] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3263.578902] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3263.586079] team0: Port device team_slave_0 added [ 3263.592615] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3263.600034] team0: Port device team_slave_1 added [ 3263.606762] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3263.613222] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3263.620582] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3263.686267] device hsr_slave_0 entered promiscuous mode [ 3263.744992] device hsr_slave_1 entered promiscuous mode [ 3263.799407] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3263.812541] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3263.827779] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3263.856735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3263.863898] device bridge_slave_1 left promiscuous mode [ 3263.869824] bridge0: port 2(bridge_slave_1) entered disabled state [ 3263.905573] device bridge_slave_0 left promiscuous mode [ 3263.911001] bridge0: port 1(bridge_slave_0) entered disabled state [ 3263.976011] device bridge_slave_1 left promiscuous mode [ 3263.981511] bridge0: port 2(bridge_slave_1) entered disabled state [ 3264.045858] device bridge_slave_0 left promiscuous mode [ 3264.051397] bridge0: port 1(bridge_slave_0) entered disabled state [ 3264.229309] device hsr_slave_1 left promiscuous mode [ 3264.269222] device hsr_slave_0 left promiscuous mode [ 3264.307577] team0 (unregistering): Port device team_slave_1 removed [ 3264.318532] team0 (unregistering): Port device team_slave_0 removed [ 3264.328049] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3264.398996] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3264.461047] bond0 (unregistering): Released all slaves [ 3264.627549] device hsr_slave_1 left promiscuous mode [ 3264.670771] device hsr_slave_0 left promiscuous mode [ 3264.728892] team0 (unregistering): Port device team_slave_1 removed [ 3264.738861] team0 (unregistering): Port device team_slave_0 removed [ 3264.751031] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3264.790319] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3264.875979] bond0 (unregistering): Released all slaves [ 3264.969150] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3264.981073] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3264.988468] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3264.995625] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3265.009663] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3265.016881] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3265.023111] 8021q: adding VLAN 0 to HW filter on device team0 [ 3265.037446] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3265.045344] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3265.053167] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3265.061207] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3265.068836] bridge0: port 1(bridge_slave_0) entered blocking state [ 3265.075179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3265.082033] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3265.092072] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3265.101954] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3265.108493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3265.117208] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3265.124982] bridge0: port 2(bridge_slave_1) entered blocking state [ 3265.131288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3265.138485] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3265.145390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3265.153438] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3265.163380] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3265.169839] 8021q: adding VLAN 0 to HW filter on device team0 [ 3265.178177] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3265.187162] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3265.194181] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3265.202383] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3265.210269] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3265.217918] bridge0: port 1(bridge_slave_0) entered blocking state [ 3265.224230] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3265.231125] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3265.238801] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3265.246378] bridge0: port 2(bridge_slave_1) entered blocking state [ 3265.252703] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3265.259587] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3265.269331] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3265.279135] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3265.287891] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3265.298732] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3265.306247] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3265.313859] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3265.321841] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3265.329663] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3265.339570] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3265.348426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3265.358058] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3265.367750] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3265.377311] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3265.384291] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3265.393051] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3265.400493] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3265.410363] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3265.419709] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3265.426820] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3265.434209] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3265.442011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3265.449710] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3265.458560] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3265.464541] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3265.472035] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3265.480890] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3265.489449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3265.498749] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3265.509017] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3265.516645] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3265.524082] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3265.533862] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3265.542711] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3265.550484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3265.560324] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3265.567131] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3265.575649] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3265.590168] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3265.600632] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3265.609759] 8021q: adding VLAN 0 to HW filter on device batadv0 18:46:28 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xfffff000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:28 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x400000, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) 18:46:28 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x20001a00) 18:46:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:28 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000fffffffffffff00000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:28 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x1) read$FUSE(r0, &(0x7f0000000a00), 0x14fb) [ 3265.886413] binder: 18093:18094 got reply transaction with bad transaction stack, transaction 1048 has target 18093:0 [ 3265.908726] binder: BINDER_SET_CONTEXT_MGR already set [ 3265.960593] binder: 18095:18097 ioctl 40046207 0 returned -16 [ 3265.985496] binder_transaction: 6 callbacks suppressed [ 3265.985510] binder: 18093:18094 transaction failed 29201/-71, size 0-0 line 2816 18:46:28 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000040)={{{@in6=@dev, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f00000001c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000200)={{{@in=@multicast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000300)=0xe8) getresuid(&(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)=0x0) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000004c0)={{}, {0x1, 0x5}, [{0x2, 0x4, r1}, {0x2, 0x6, r2}, {0x2, 0x5, r3}], {0x4, 0x1}, [{0x8, 0x3, r4}], {0x10, 0x3}, {0x20, 0x7}}, 0x44, 0x3) 18:46:28 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000000000100"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3266.053653] binder: 18095:18097 got reply transaction with no transaction stack [ 3266.079426] binder: BINDER_SET_CONTEXT_MGR already set 18:46:28 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) getpeername(r0, &(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, &(0x7f00000000c0)=0x80) socket$netlink(0x10, 0x3, 0x17) [ 3266.141119] binder: 18093:18114 ioctl 40046207 0 returned -16 [ 3266.144689] binder_alloc: 18093: binder_alloc_buf, no vma [ 3266.153513] binder: 18093:18119 transaction failed 29189/-3, size 0-0 line 3035 [ 3266.156737] binder: 18095:18097 transaction failed 29201/-71, size 0-0 line 2801 18:46:28 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xffffff7f, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3266.220506] binder: 18093:18094 got reply transaction with no transaction stack 18:46:28 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x200, 0x0) write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000000080)={0xa, 0x9, 0x8, 0x3}, 0xa) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:28 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:28 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000000000000200"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3266.278452] binder: undelivered TRANSACTION_ERROR: 29201 [ 3266.284122] binder: release 18095:18110 transaction 1050 out, still active [ 3266.343533] binder: undelivered TRANSACTION_COMPLETE 18:46:29 executing program 5: r0 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x203f, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x2, 0x0) ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f0000000140)={0x0, 0xfffffffffffffffe}) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000100)={0x7fffffffffffdd5, &(0x7f0000000000)=[{0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @link_local}]}) ioctl$VIDIOC_SUBDEV_S_SELECTION(r1, 0xc040563e, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x4, {0x1, 0x0, 0xffffffff, 0x5}}) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x5, 0xb, 0x2, "e5e553d992866bb062b24d0a0e2e4065cb6600"}) [ 3266.365953] binder: 18093:18094 transaction failed 29201/-71, size 0-0 line 2801 [ 3266.391788] binder: send failed reply for transaction 1048 to 18093:18094 18:46:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:29 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000007fffffffefff00"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:29 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x200000, 0x0) 18:46:29 executing program 5: openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x202, 0x800000002009) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/kcm\x00\b\x00') getpid() capset(0x0, &(0x7f0000000400)) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, &(0x7f0000000440)={0x1, 0x0, 0x0, @random="8d2eabd97081", 'bond0\x00'}) uname(&(0x7f0000000300)=""/84) fstatfs(r1, &(0x7f0000000200)=""/100) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffeffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000540)={&(0x7f0000000700), 0xc, 0x0, 0x1, 0x0, 0x0, 0x1001}, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x4000, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x2200, 0x0) request_key(&(0x7f0000000780)='\xdc\x14\n\xac\x1b\xfb\xd3K\x9a\xed\xea\x8e\xc5\xdf\a\xa5/\xd7\xe6\x00\xff\x84\xfa%v\xf6#\x9aIP\x8bR\v\x97\x1ex8\xd8\xb1\x89\xfas\xab\xda\xf8\xa2\xfd9\x1e\xbb\xfe\xdc\xb5\xe6\xd0\x81J\xf7\xc5\xe10\x1aS\xa0\x01\xfd\x94\xbbtM\x98\xf2\x94R\x9dP\x16\x0f>\xc7\xc2{\x88\xd9\x93L_\xddi\xca', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000280)='\x00', 0x0) r4 = semget(0x0, 0x2, 0x44) semctl$SETVAL(r4, 0x0, 0x10, &(0x7f00000003c0)=0x8) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000100), &(0x7f00000002c0)=0x4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) write$cgroup_type(r2, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, 0x0, &(0x7f0000000740)) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000080)) close(r3) sendmsg$alg(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000980)}], 0x1}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000040)) socket$inet6(0xa, 0x803, 0x3) ioctl(0xffffffffffffffff, 0x1000008912, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$FS_IOC_FSGETXATTR(r0, 0x4004550c, 0x0) 18:46:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x80000001, 0x800) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000040)={{0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x9}, {0xa, 0x4e23, 0x10000, @dev={0xfe, 0x80, [], 0xe}, 0x7fffffff}, 0x3, [0x8000, 0xce4f, 0x59, 0x4, 0x7fff, 0x0, 0x7fffffff, 0x1ff]}, 0x5c) [ 3266.491271] binder: send failed reply for transaction 1050, target dead [ 3266.553866] binder: undelivered TRANSACTION_ERROR: 29201 [ 3266.586475] binder: 18165:18170 got reply transaction with bad transaction stack, transaction 1055 has target 18165:0 18:46:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) lsetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='trusted.overlay.impure\x00', &(0x7f00000001c0)='procppp1}%trusted\x00', 0x12, 0x2) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x1, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0xb) 18:46:29 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) [ 3266.606366] binder: 18165:18170 transaction failed 29201/-71, size 0-0 line 2816 [ 3266.614808] binder: undelivered TRANSACTION_ERROR: 29189 [ 3266.640278] binder: undelivered TRANSACTION_COMPLETE [ 3266.709200] binder: BINDER_SET_CONTEXT_MGR already set 18:46:29 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xffffff8c, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:29 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) write$FUSE_POLL(r0, &(0x7f0000000000)={0x18, 0x0, 0x6, {0x19}}, 0x18) read$FUSE(r0, &(0x7f0000003a00), 0xfffffffffffffef9) 18:46:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/snmp6\x00') ioctl$TCFLSH(r1, 0x540b, 0xffffffffffffffff) 18:46:29 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000060ffffffffff00"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3266.834948] binder: 18165:18179 ioctl 40046207 0 returned -16 [ 3266.834979] binder: release 18165:18170 transaction 1055 out, still active [ 3266.866831] binder: undelivered TRANSACTION_COMPLETE 18:46:29 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) fremovexattr(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="757365622e295bb28bf5e28ee81e0000fd0000000000000000000000"]) setsockopt$inet6_int(r1, 0x29, 0xd1, &(0x7f0000000180)=0x3c, 0x4) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xcb, &(0x7f0000000000), 0xc) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0x254) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000380)={&(0x7f0000be1000/0x2000)=nil, 0x2000}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000003c0)}}, 0x20) openat$ion(0xffffffffffffff9c, &(0x7f0000000540)='/dev/ion\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r2, 0xc040564b, &(0x7f00000001c0)={0x40, 0x0, 0x3037, 0x100, 0x7, {0x80000000, 0x3}, 0x1}) write$USERIO_CMD_REGISTER(r2, &(0x7f0000000080)={0x0, 0x8}, 0x2) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f00000000c0), 0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000600)=""/246, 0xf6}], 0x1, 0x80000000) [ 3266.940241] binder: send failed reply for transaction 1055, target dead 18:46:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:29 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x4, 0x4000) 18:46:29 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000f0ffffffffffff00"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = dup2(r0, r0) ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0xb, 0x9, 0x2, 0x2, 0x23, 0x0, 0x1000}]}) [ 3267.149878] binder: 18216:18227 transaction failed 29189/-22, size 0-0 line 2896 18:46:29 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f00000000c0)) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:29 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x1) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x40, 0x0) getdents(r1, &(0x7f00000001c0)=""/229, 0xe5) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3267.257196] binder: 18236:18237 got reply transaction with bad transaction stack, transaction 1059 has target 18236:0 [ 3267.368269] binder: 18236:18237 transaction failed 29201/-71, size 0-0 line 2816 18:46:30 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xfffffff6, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:30 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000200000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:30 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x2, 0x4, 0x1, 0x2, 0x29, 0x0, 0x70bd2a, 0x25dfdbfb, [@sadb_ident={0x2, 0x0, 0xfffffffffffffffc, 0x0, 0x1d}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e23, 0x8000, @ipv4={[], [], @multicast2}, 0x4}}, @sadb_x_nat_t_port={0x1, 0x17, 0x4e24}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d3}, @sadb_x_nat_t_type={0x1, 0x14, 0x7}, @sadb_sa={0x2, 0x1, 0x4d6, 0x6, 0x0, 0xc8, 0x3, 0x1}, @sadb_x_policy={0x8, 0x12, 0x4, 0x2, 0x0, 0x6e6bb2, 0x7, {0x6, 0x6c, 0x10000, 0x1, 0x0, 0x7, 0x0, @in=@remote, @in6=@loopback}}, @sadb_x_policy={0x8, 0x12, 0x3, 0x0, 0x0, 0x6e6bba, 0xb2, {0x6, 0x3c, 0xffffffff, 0x100000001, 0x0, 0x2, 0x0, @in=@multicast2, @in6=@loopback}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x5, 0x0, 0x6e6bbb, 0xffffffffffffffff, {0x6, 0xff, 0x7, 0x1f, 0x0, 0x25, 0x0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}}}]}, 0x148}}, 0x24000001) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') accept4$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, &(0x7f0000000040)=0x10, 0x80800) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000000180)={0x5, 0xdb6, 0xd945, 0xb6e}) 18:46:30 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000040)=""/161, &(0x7f0000000100)=0xa1) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000300)={0x0, 0x401, 0x1ff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f00000002c0)={0x3, &(0x7f00000001c0)="125b2463a2043c9d66cd221be4286ff045d81aab9f1a631b78d5bf6f302c94c70feddf783cbb191a7482cb33d308873dfa1b27416da56136af7e8a8e612a99d2b9ca34b0e1b07443b5bbd6c81cb7dcd9cc25b50a230f24e01b8769c34c30cbf80b539955cd0b29db80a78e5651e6f32c855c5b420c65785c4e7959371cf2b0dc64235939c74ec299ce5c5811d6d7871e4e0dad03281fc7655bab325ea78226ca1907f2abd9b1ba94a8b122f584f669b1accc39ba4ad4800c5deb9ab38af6b9bfa9a3dc3fb08b7a0d6d5727fb9d0ab7a7b0980904d5ae9ed5233c80b3f867425279933d720f1631"}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000340)={0x2008}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x0) [ 3267.448263] binder: BINDER_SET_CONTEXT_MGR already set [ 3267.514275] binder: 18236:18255 ioctl 40046207 0 returned -16 [ 3267.518277] binder_alloc: 18236: binder_alloc_buf, no vma [ 3267.566113] binder: 18236:18237 got reply transaction with no transaction stack [ 3267.664934] binder: release 18236:18237 transaction 1059 out, still active [ 3267.673913] binder: 18236:18237 transaction failed 29201/-71, size 0-0 line 2801 [ 3267.683237] binder: undelivered TRANSACTION_COMPLETE [ 3267.707048] binder_release_work: 4 callbacks suppressed [ 3267.707052] binder: undelivered TRANSACTION_ERROR: 29201 [ 3267.744851] binder: 18236:18265 transaction failed 29189/-3, size 0-0 line 3035 [ 3267.795158] binder: undelivered TRANSACTION_ERROR: 29201 [ 3267.800731] binder: undelivered TRANSACTION_ERROR: 29189 [ 3267.840479] binder: send failed reply for transaction 1059, target dead 18:46:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x7fff, 0x3, 0x7ff}) ioctl$RTC_WIE_OFF(r1, 0x7010) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0xfd010000, &(0x7f0000000100)={&(0x7f00000001c0)={0x2c, 0x32, 0x829, 0x0, 0x0, {0x3, 0x40000}, [@nested={0x18, 0x0, [@typed={0x14, 0xa, @ipv6=@loopback={0x8000000000}}]}]}, 0xd8}}, 0x0) 18:46:30 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) sendmsg$alg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="c19bd67faa1f53924de0eec656bcbab63c9fb516dcf5768656dad8a97baca106d46d1ddf890c882dcc35d7eb761a73eeb65fdc9168bb56d0acaf0e6e68c30f2548b8385d924e6e26b4040e84ac533e0f30ac228e4d59b9900f5aeca92617e09eb2457bc5d37b55e11aac1298e9732392a66fbccc5c039e317b", 0x79}, {&(0x7f00000000c0)="65f77c1c55be02638f56e951d2a520928eee901db3c4f6c6b39ef732d64bd060b453ddb8a76d24a3e2496164c45ef2f89dab3364a0e95a43aa2a49745247fec996f6815bbc163ffae4f307108bcdd9e476dce817ba3b75e8d0eb2315f6357821f1d75d2d0336d046e15e459ede41a823117776752a6ef78f02aea9fb3a20da1ca571a4286e837030e8fe9480ff6815c6392a795a66d2851faea8cf39", 0x9c}], 0x2, &(0x7f00000001c0)=[@op={0x18}, @assoc={0x18, 0x117, 0x4, 0xffffffff}], 0x30, 0x20000804}, 0x4041) 18:46:30 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) io_setup(0x5, &(0x7f0000000000)=0x0) r2 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) r3 = socket$alg(0x26, 0x5, 0x0) r4 = syz_open_dev$media(&(0x7f0000000200)='/dev/media#\x00', 0x3, 0x38800) r5 = creat(&(0x7f00000002c0)='./file0\x00', 0x4) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000380)='/proc/self/net/pfkey\x00', 0x101000, 0x0) r7 = dup2(r0, r0) r8 = syz_open_dev$midi(&(0x7f0000000500)='/dev/midi#\x00', 0x6, 0x2) r9 = syz_open_dev$swradio(&(0x7f00000006c0)='/dev/swradio#\x00', 0x1, 0x2) io_submit(r1, 0x8, &(0x7f0000000740)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x101, r0, &(0x7f0000000040)="271343e5ee49bcda712655284658d38c4a375c0a36d58482e25b656baafb9b09e68b06631e838a9d67527daf590b4a99b664cb9782aafbc18a56445b4e907b8e02b06549f3d45e9a133801", 0x4b, 0x7ff, 0x0, 0x1, r2}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x8, 0x40000000000000, r3, &(0x7f00000001c0)="a798038feec8285e5410465d91d8074a30e72ea270d4c237309725391e4ff7", 0x1f, 0x0, 0x0, 0x0, r4}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0xb, 0x6, r0, &(0x7f0000000280)="ecb7e30fc59470f58c0d761c6f8b3680f9a7b199cf0d", 0x16, 0x2, 0x0, 0x0, r5}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x5, 0x10001, r0, &(0x7f0000000340)="92c2ece1addb4833e1e7ad05ece6dfe0220a349c5f29", 0x16, 0x2, 0x0, 0x0, r6}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x8, 0x7, r0, &(0x7f0000000400)="a7eb8c8d73d07682fd", 0x9, 0x1, 0x0, 0x0, r7}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x3, 0x4, r0, &(0x7f0000000480)="0e14580056c7a253286bd6de92ba1913aeaac9cfed8afef51856813da4cca7d779598dbdf8d16bd763fb9b42617e2b603921dd39675e9b16da5b27cc3005439510818898a82e8a35eac1c45f819ab5628f7ffb664e29c430b9defb4f5f5fceb4687bcfd1985da68b31e67337ea2e5906aeb08a22d2349b", 0x77, 0x3ff, 0x0, 0x0, r8}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0xed21, r0, &(0x7f0000000580), 0x0, 0x6, 0x0, 0x1, 0xffffffffffffff9c}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x8, 0x9, r0, &(0x7f0000000600)="2534a8b8e7f99560cac0fcf8f7306d1c12dd52808e3fce26f19f9936c3f4f3466b23b4ec2c8e35d230bd8e4b71ee0cae36bbaa8bb3ffefcbae1fa993b0d96fb2d30355b2d2820f55837f0b63c0c74b9b5f905d61fe78d7ab4e3144fe6415afb89155d551a88280b5bdd3bb5425b321130ff2888f5416d32485f187bcccbcdbc7248e9eb1516f75756e60ce02b2203e924ec1d8d1be2353fe20ce97e4d41c76a396bd488c6541e5d1cdbdd3", 0xab, 0x2, 0x0, 0x2, r9}]) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) getsockopt$inet_sctp6_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f0000000780)={0x0, 0x4, 0x6, 0x328, 0x8c, 0x2, 0x7, 0x3, {0x0, @in6={{0xa, 0x4e22, 0x3, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5}}, 0xd0bf, 0x1f346f76, 0x9, 0x2ec}}, &(0x7f0000000580)=0xb0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r5, 0x84, 0x70, &(0x7f0000000840)={r10, @in={{0x2, 0x4e21, @local}}, [0x39, 0x0, 0x9, 0x3, 0x9, 0x2, 0x6, 0x4000, 0x40, 0x0, 0x100, 0x10000000000, 0x6, 0x80]}, &(0x7f0000000940)=0x100) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) ioctl$INOTIFY_IOC_SETNEXTWD(r7, 0x40044900, 0xc1a7) 18:46:30 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000f000000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:30 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xedc000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:30 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) fcntl$addseals(r0, 0x409, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3268.214276] binder: 18281:18287 got reply transaction with bad transaction stack, transaction 1064 has target 18281:0 18:46:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x210000, 0x0) sendmsg$nl_netfilter(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x120, 0xe, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {0x2, 0x0, 0x3}, [@nested={0x100, 0x21, [@typed={0x8, 0x64, @u32=0x9}, @generic="27f97800c9d4485bf76c994cd431053294dba1bcc572431ddb16e97ea1766d0b095c5c45bf92c20bd6d857c74a", @typed={0x8, 0x33, @u32=0x7}, @generic="9ce31a0046d0dea2b5454c983e8279c5a822fa0b334d3b047c1ac9075a6d18fc067f09d8f7ec143361c48f6c7e51fcda928a63724a8ec81352b3270d238cb44162931ad44486294f1208260dba8b43c72b9110a02d117884433636fd7c8271e143e63bce2ea444591221054d370e9a05c55c9427f00687f3fc92dd5b21b2ecc7a73a589548d4efc90234553acac6b02e2143afa6e4920472eb7e2aa7e9cce67d7c3fe6d017a241788f6c940d2d9d352dd365", @typed={0xc, 0x8e, @str='self.t\x00'}]}, @generic="7608a3ee8c3706eab8f6"]}, 0x120}}, 0x4000000) [ 3268.307170] binder: 18281:18287 transaction failed 29201/-71, size 0-0 line 2816 [ 3268.319614] netlink: 'syz-executor5': attribute type 10 has an invalid length. [ 3268.382750] binder: BINDER_SET_CONTEXT_MGR already set [ 3268.408766] openvswitch: netlink: Flow get message rejected, Key attribute missing. 18:46:31 executing program 2: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x3, 0x100) ioctl$CAPI_GET_SERIAL(r0, 0xc0044308, &(0x7f0000000080)=0xfffffffffffffff9) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='cp\x95s%t\x00\x00\x00\x00\x01\x00\x00\x00press\x7fre\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000003a00), 0xbca) 18:46:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0xfffffffffffffeaf) [ 3268.459025] binder: 18281:18303 ioctl 40046207 0 returned -16 [ 3268.459547] binder_alloc: 18281: binder_alloc_buf, no vma [ 3268.487881] binder: 18281:18287 got reply transaction with no transaction stack 18:46:31 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x4000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:31 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000040000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3268.529277] netlink: 'syz-executor5': attribute type 10 has an invalid length. [ 3268.555139] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 3268.595443] binder: release 18281:18287 transaction 1064 out, still active [ 3268.608515] binder: undelivered TRANSACTION_COMPLETE [ 3268.624852] binder: undelivered TRANSACTION_ERROR: 29201 [ 3268.642827] binder: undelivered TRANSACTION_ERROR: 29201 [ 3268.662628] binder: undelivered TRANSACTION_ERROR: 29189 18:46:31 executing program 5: socketpair$unix(0x1, 0x3ffffffffffc, 0x0, &(0x7f00000000c0)) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 18:46:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:31 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000000)={0x1, "e4"}, 0x2) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) lseek(r0, 0x0, 0x7) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x8, 0xa00) ioctl$IMCLEAR_L2(r1, 0x80044946, &(0x7f0000000100)=0x80000001) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000040)=""/90, 0x1020000, 0x1000, 0x6}, 0x18) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x3b2) [ 3268.690928] binder: send failed reply for transaction 1064, target dead [ 3268.776341] binder: 18335:18337 got reply transaction with bad transaction stack, transaction 1069 has target 18335:0 18:46:31 executing program 3: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x240a00, 0x0) fcntl$getflags(r0, 0x3) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x40, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)={0x12c, r3, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x118, 0x5, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x123b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x101}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe74}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x63d0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) 18:46:31 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x100, 0x0) [ 3268.862643] binder: BINDER_SET_CONTEXT_MGR already set 18:46:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x2000000011, 0x4000000000080002, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast2, @dev}, &(0x7f0000000340)=0xc) accept4$packet(r1, &(0x7f0000002800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002840)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000002900)={'vcan0\x00', r2}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'rose0\x00', r3}) preadv(r1, &(0x7f0000000140)=[{&(0x7f0000000040)=""/204, 0xcc}], 0x1, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x1f) epoll_create(0xe247) [ 3268.914636] binder: 18335:18345 ioctl 40046207 0 returned -16 [ 3268.915768] binder: release 18335:18352 transaction 1071 out, still active 18:46:31 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf0ffffffffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3268.997512] binder: undelivered TRANSACTION_COMPLETE 18:46:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:31 executing program 2: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0xb, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0xff}, [@map={0x18, 0xe}, @generic={0x6f6, 0xfffffffffffffffa, 0x401, 0x4, 0x1}, @exit, @alu={0x7, 0xa8, 0xf, 0x9, 0x1, 0xfffffffffffffff8, 0xffffffffffffffff}, @exit, @generic={0x1, 0x1ff, 0x6, 0x64, 0x5}, @call={0x85, 0x0, 0x0, 0x59}]}, &(0x7f00000000c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00, 0x1, [], 0x0, 0xd}, 0x48) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000180)=0x5) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000a00), 0x1000) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) [ 3269.022959] binder: release 18335:18337 transaction 1069 out, still active 18:46:31 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x1d) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3269.073721] binder: undelivered TRANSACTION_COMPLETE [ 3269.113661] binder: BINDER_SET_CONTEXT_MGR already set [ 3269.142933] binder: undelivered TRANSACTION_ERROR: 29201 [ 3269.173441] binder: 18369:18370 ioctl 40046207 0 returned -16 [ 3269.194706] binder: send failed reply for transaction 1069, target dead [ 3269.201579] binder: send failed reply for transaction 1071, target dead [ 3269.256298] binder: 18369:18370 got reply transaction with no transaction stack [ 3269.325688] binder_alloc: binder_alloc_mmap_handler: 18369 20010000-20014000 already mapped failed -16 [ 3269.365830] binder_alloc: 18369: binder_alloc_buf, no vma 18:46:32 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000ff60000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:32 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSBRK(r0, 0x5409, 0x0) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000000)) 18:46:32 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:32 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000680)=0x6) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000005c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x84001a12}, 0xc, &(0x7f0000000580)={&(0x7f00000001c0)=@deltaction={0x3b8, 0x31, 0x800, 0x70bd2d, 0x25dfdbfe, {}, [@TCA_ACT_TAB={0xcc, 0x1, [{0x10, 0x11, @TCA_ACT_INDEX={0x8, 0x3, 0x7fffffff}}, {0x18, 0x12, @TCA_ACT_KIND={0x10, 0x1, 'connmark\x00'}}, {0x14, 0x1b, @TCA_ACT_KIND={0xc, 0x1, 'mirred\x00'}}, {0x18, 0x1, @TCA_ACT_KIND={0x10, 0x1, 'connmark\x00'}}, {0x18, 0x3, @TCA_ACT_KIND={0x10, 0x1, 'tunnel_key\x00'}}, {0x14, 0x1a, @TCA_ACT_KIND={0xc, 0x1, 'police\x00'}}, {0x14, 0x1b, @TCA_ACT_KIND={0xc, 0x1, 'mirred\x00'}}, {0x10, 0x11, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x14, 0x1d, @TCA_ACT_KIND={0xc, 0x1, 'pedit\x00'}}, {0x10, 0x14, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}, @TCA_ACT_TAB={0x3c, 0x1, [{0x14, 0x18, @TCA_ACT_KIND={0xc, 0x1, 'mirred\x00'}}, {0x10, 0x10, @TCA_ACT_INDEX={0x8, 0x3, 0x400}}, {0x14, 0x1d, @TCA_ACT_KIND={0xc, 0x1, 'pedit\x00'}}]}, @TCA_ACT_TAB={0x58, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x14, 0x8, @TCA_ACT_KIND={0xc, 0x1, 'pedit\x00'}}, {0x10, 0x11, @TCA_ACT_INDEX={0x8, 0x3, 0x1db}}, {0x10, 0x16, @TCA_ACT_INDEX={0x8, 0x3, 0x10000}}, {0x10, 0x3, @TCA_ACT_INDEX={0x8}}]}, @TCA_ACT_TAB={0x80, 0x1, [{0x14, 0xa, @TCA_ACT_KIND={0xc, 0x1, 'skbmod\x00'}}, {0x10, 0x15, @TCA_ACT_INDEX={0x8, 0x3, 0x10000}}, {0x10, 0x13, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffffffffeff}}, {0x10, 0xd, @TCA_ACT_INDEX={0x8, 0x3, 0x2a58}}, {0x14, 0x9, @TCA_ACT_KIND={0xc, 0x1, 'sample\x00'}}, {0x14, 0x8, @TCA_ACT_KIND={0xc, 0x1, 'vlan\x00'}}, {0x10, 0x14, @TCA_ACT_INDEX={0x8, 0x3, 0x88}}]}, @TCA_ACT_TAB={0x7c, 0x1, [{0x14, 0x15, @TCA_ACT_KIND={0xc, 0x1, 'vlan\x00'}}, {0x10, 0x1a, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0x10, 0x5, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x10, 0x17, @TCA_ACT_INDEX={0x8, 0x3, 0x99}}, {0x10, 0x1a, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0x14, 0x19, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0xe, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}, @TCA_ACT_TAB={0x44, 0x1, [{0x10, 0x17, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0x18, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x20, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0x10, 0x10, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x6c, 0x1, [{0x14, 0x6, @TCA_ACT_KIND={0xc, 0x1, 'gact\x00'}}, {0x14, 0x17, @TCA_ACT_KIND={0xc, 0x1, 'csum\x00'}}, {0x10, 0x4, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x10, 0x18, @TCA_ACT_INDEX={0x8, 0x3, 0x101}}, {0x10, 0x3, @TCA_ACT_KIND={0x8, 0x1, 'xt\x00'}}, {0x10, 0x1f, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}, @TCA_ACT_TAB={0x4c, 0x1, [{0x18, 0x14, @TCA_ACT_KIND={0x10, 0x1, 'connmark\x00'}}, {0x10, 0xa, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0x1f, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffffffffffc}}, {0x10, 0xf, @TCA_ACT_INDEX={0x8, 0x3, 0xc2}}]}, @TCA_ACT_TAB={0x4c, 0x1, [{0x14, 0x9, @TCA_ACT_KIND={0xc, 0x1, 'csum\x00'}}, {0x10, 0x1a, @TCA_ACT_INDEX={0x8, 0x3, 0x8001}}, {0x10, 0x1e, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0x14, 0x15, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0x3b8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000600), &(0x7f0000000640)=0x4) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x401, 0xfffffffffffffffe) mq_getsetattr(r3, &(0x7f0000000040)={0x1000, 0x6, 0x9, 0x502e, 0xd4, 0x5, 0x5, 0x80000000}, &(0x7f0000000080)) 18:46:32 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x100000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3269.401912] binder: undelivered TRANSACTION_ERROR: 29189 [ 3269.407762] binder: undelivered TRANSACTION_ERROR: 29201 [ 3269.413211] binder: undelivered TRANSACTION_ERROR: 29189 18:46:32 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)={'syz0', "2c210eb01884842af18e4dcb347014537e5b11b005bd19c6576298e340527a2c597176368b699d023fae923d5bfa68d12a42ae84d3a696d73c0678c26f75f7223dff89965c329a51406439134c41224a6eba4efc5f8c7a7ca34d5a87af04ec8ba2513ef1562bccc5425cd01503e255040d09a4e8f17419cc7dda1bf365fc275ff5cb374d24daaa81f32474c3a5b111b4f6e095c4c99e08e5ac2847d957728e750655c763d74730706f95a311901147d83e54747f0e284a0282787f5aa529624cd84159bc6365a7ac0e4574170f4a892aa0a74c18ca4abe14be51a3b25d9bc9a593cb1bf727e7b7b57b2d"}, 0xee) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000a00), 0x1000) 18:46:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:32 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000074000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:32 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}}, 0xa0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3, 0x200000) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f0000000040)={0x0, @reserved}) [ 3269.564035] binder: 18406:18408 got reply transaction with bad transaction stack, transaction 1077 has target 18406:0 18:46:32 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)) [ 3269.609502] binder: BINDER_SET_CONTEXT_MGR already set 18:46:32 executing program 5: r0 = syz_open_dev$adsp(&(0x7f0000000180)='/dev/adsp#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x2d, 'memory'}, {0x2b, 'pids'}]}, 0xe) r1 = syz_open_procfs(0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x6) bind$unix(r1, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) writev(r2, &(0x7f0000000080)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a06760661ff81004e220000000058000b4824ca944f64009400050028925aa8000000000000008000f0fffeffff09000000fff5dd00000010000100000c0900fcff0000040e05a5", 0x58}], 0x1) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000100)={0xa, 0x7, 0x905, 0xffffffffffffff9d}, 0xa) [ 3269.702365] binder: 18406:18411 ioctl 40046207 0 returned -16 [ 3269.702440] binder_alloc: 18406: binder_alloc_buf, no vma [ 3269.714407] binder: release 18406:18408 transaction 1077 out, still active 18:46:32 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) r1 = semget$private(0x0, 0x1, 0x401) semctl$GETZCNT(r1, 0x3, 0xf, &(0x7f0000000000)=""/75) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3269.761559] binder: undelivered TRANSACTION_COMPLETE [ 3269.822464] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. [ 3269.824915] binder: send failed reply for transaction 1077, target dead 18:46:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:32 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x200000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:32 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x1, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) write$FUSE_IOCTL(r0, &(0x7f0000000000)={0x20, 0x0, 0x2, {0x3, 0x4, 0x8000, 0x9513}}, 0x20) [ 3269.943046] binder: 18436:18437 got reply transaction with bad transaction stack, transaction 1081 has target 18436:0 [ 3269.957321] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. [ 3270.071045] binder: BINDER_SET_CONTEXT_MGR already set [ 3270.133791] binder: 18436:18444 ioctl 40046207 0 returned -16 [ 3270.211287] binder: 18436:18437 got reply transaction with no transaction stack [ 3270.270588] binder: release 18436:18437 transaction 1081 out, still active [ 3270.278650] binder_alloc: 18436: binder_alloc_buf, no vma [ 3270.291843] binder: undelivered TRANSACTION_COMPLETE [ 3270.331471] binder: send failed reply for transaction 1081, target dead 18:46:33 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xd702, 0x12000) r2 = msgget(0x2, 0x544) msgctl$IPC_RMID(r2, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000080)=0x8, 0x8) futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x1) 18:46:33 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)={0x0, @aes128, 0x1, "88e1b36cd2af950b"}) read$FUSE(r0, &(0x7f0000000a00), 0x1000) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0xe3, 0x5, @buffer={0x0, 0x5d, &(0x7f00000000c0)=""/93}, &(0x7f0000000140)="892b16444fe544b5574606ce81cf0a19e14e1758b5ae62519ee9d85b366f8c6cd76f55d8947f37e326dd856014eebdf0baead491cf3c7d2d89208fa3bfff46f74173762bafa980c0d23909a5bd78e9cd3184c739de16a50537ea3c717b712537e805baa58bc9e2ee7a19430e96ce8b072a7f1d3796c7e83d1a5abe7c9111a972bcff3de9e8d1219b1de1ac913f43af859aece563e4d2135e66e9a756d84a9cc27c7c8411cf01c3ae671dcd601c3a3e1fbf3eb9b5c1439dd94c292129a6b4bd700d0ca5fb1f7bca7c0b790bb2d069cc4d13967c3d4ada7815293511afe68178800da6e6", &(0x7f0000000040)=""/10, 0xfffffffffffffffa, 0x10000, 0x3, &(0x7f0000000240)}) r1 = gettid() ioprio_get$pid(0x2, r1) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0x3f) 18:46:33 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000182000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:33 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x4000, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000740)={'team0\x00', 0x0}) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f0000000040)=""/33, &(0x7f0000000080)=0x21) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000780)={@local, 0x21f, r2}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, r1, 0x0, 0x2, &(0x7f00000000c0)='/\x00'}, 0x30) ptrace$getregs(0xe, r3, 0x9, &(0x7f00000001c0)=""/212) syncfs(r0) 18:46:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3270.448380] binder: 18457:18468 got reply transaction with bad transaction stack, transaction 1086 has target 18457:0 18:46:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001000)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x88) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5}, 0x3e8) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/49, 0x31}], 0x10000023, &(0x7f00000002c0)=""/77, 0x4d}, 0x0) recvmsg$kcm(r2, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000680)='posix_acl_access*\x00') bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000500)='cgroup.events\x00', 0x0, 0x0) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f0000000340)={0xa, 0x40, 0x1}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) mknod$loop(&(0x7f00000003c0)='./file0\x00', 0x0, 0xffffffffffffffff) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB='zX']) chown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000540)={'gretap0\x00', @dev={[], 0x12}}) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000005c0)={0x0, 0x8000, 0x8}, 0xc) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x9, 0x0, 0x7fff, 0x3, 0x22, 0xffffffffffffffff, 0x5}, 0x2c) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000c00)={r5, &(0x7f0000000a80), 0x0}, 0x18) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000e80)={{{@in6=@remote, @in6=@remote}}}, &(0x7f0000000400)=0xe8) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000240)={0x0, 0x80000, r2}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000640)={r6, 0x80000, r4}) getresuid(&(0x7f0000000440), &(0x7f00000004c0), &(0x7f0000000600)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) 18:46:33 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000000)) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:33 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000080)={0x6, &(0x7f0000000040)=[{0xf2, 0x4, 0x5, 0x1}, {0x0, 0x2, 0x6}, {0xfe1, 0x7, 0x20, 0x1}, {0x3ff, 0x9, 0xd20, 0x7f}, {0x2, 0x0, 0x1, 0x40}, {0x8001, 0x4, 0xc1, 0x401}]}, 0x10) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfe95) [ 3270.490711] binder: BINDER_SET_CONTEXT_MGR already set [ 3270.509015] binder: 18457:18472 ioctl 40046207 0 returned -16 [ 3270.549722] binder_alloc: 18457: binder_alloc_buf, no vma 18:46:33 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000094000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3270.597127] binder: 18457:18468 got reply transaction with no transaction stack 18:46:33 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xffffffffffffff14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)={{{@in6=@ipv4={[], [], @broadcast}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000001c0)=0xe8) r2 = getuid() stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x5, &(0x7f0000000580)=[0xffffffffffffffff, 0xee00, 0xffffffffffffffff, 0xee00, 0xee01]) r9 = getgid() fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f00000005c0)={{}, {}, [{0x2, 0x1, r1}, {0x2, 0x5, r2}, {0x2, 0x7, r3}, {0x2, 0x1, r4}], {0x4, 0x1}, [{0x8, 0x5, r5}, {0x8, 0x3, r6}, {0x8, 0x2, r7}, {0x8, 0x3, r8}, {0x8, 0x0, r9}], {0x10, 0x2}}, 0x6c, 0x3) r10 = socket$inet_udplite(0x2, 0x2, 0x88) r11 = syz_open_dev$media(&(0x7f0000000b40)='/dev/media#\x00', 0x40000000, 0x20000) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000b80)=0x0) ioctl$DRM_IOCTL_GET_CLIENT(r11, 0xc0286405, &(0x7f0000000bc0)={0x401, 0xffffffffffffff7f, r12, 0x0, r4, 0x0, 0x9, 0x5}) setsockopt$ARPT_SO_SET_REPLACE(r10, 0x0, 0x60, &(0x7f0000000680)={'filter\x00', 0x7, 0x4, 0x468, 0x0, 0x268, 0x268, 0x380, 0x380, 0x380, 0x4, &(0x7f0000000640), {[{{@arp={@multicast1, @rand_addr=0x8, 0xffffff00, 0xffffffff, @empty, {[0xff, 0xff, 0x0, 0xff, 0xff, 0xff]}, @empty, {[0x0, 0x0, 0xff, 0xff, 0x0, 0xff]}, 0x3, 0x1, 0x1, 0x5, 0x2, 0x79a4, 'ip6tnl0\x00', 'nlmon0\x00', {0xff}, {0xff}, 0x0, 0x40}, 0xf0, 0x130}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "914241c5f3bf7a6ebd68fbaff2cdf054c84203c908a9668f1587b62cff45"}}, {{@arp={@broadcast, @local, 0xffffff00, 0xffffffff, @empty, {[0xff, 0xff, 0xff, 0xff, 0xff]}, @mac=@random="e9f92b5e15b3", {[0xff, 0x0, 0x0, 0x0, 0xff]}, 0x8000, 0x0, 0xfffffffffffffc01, 0x2, 0x79f, 0xd1, 'rose0\x00', 'syzkaller0\x00', {}, {0xff}, 0x0, 0x1}, 0xf0, 0x138}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x100000000, 'syz1\x00', 0x5aa}}}, {{@arp={@multicast1, @loopback, 0xff000000, 0xffffffff, @mac=@dev={[], 0x14}, {[0x0, 0x0, 0x0, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0x0, 0x0, 0xff]}, 0x204000000, 0x8, 0x7fff, 0x8, 0xe1, 0x6, 'nlmon0\x00', 'nlmon0\x00', {}, {}, 0x0, 0x300}, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0xb75}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4b8) [ 3270.674434] binder: release 18457:18468 transaction 1086 out, still active [ 3270.694924] binder: undelivered TRANSACTION_COMPLETE [ 3270.763068] binder: send failed reply for transaction 1086, target dead 18:46:33 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x300000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:33 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:33 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x12a, 0x10000) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000040)=0x5, 0x4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) 18:46:33 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r1, 0x40485404, &(0x7f0000000040)={{0x3, 0x3, 0x0, 0x0, 0x1}, 0x1f, 0x7f}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3271.150343] binder: 18501:18507 got reply transaction with bad transaction stack, transaction 1091 has target 18501:0 18:46:33 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0x0, r0, 0x0, 0xb, &(0x7f0000000240)='/dev/hwrng\x00', 0xffffffffffffffff}, 0x30) getpgid(r1) read$FUSE(r0, &(0x7f0000002a00), 0x1000) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x2, 0x0}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x80000001, 0x8200, 0x10001, 0x9, 0x0}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000140)={r2, 0x8, 0xf82f, 0x2, 0xfff, 0x7ff, 0x100000000, 0x6, {r3, @in={{0x2, 0x4e21, @local}}, 0xfff8000000000000, 0x3, 0x1, 0x2, 0x6}}, &(0x7f0000000200)=0xb0) [ 3271.205332] binder_transaction: 14 callbacks suppressed [ 3271.205345] binder: 18501:18507 transaction failed 29201/-71, size 0-0 line 2816 [ 3271.286379] Unknown ioctl 1078481924 [ 3271.322912] binder: BINDER_SET_CONTEXT_MGR already set [ 3271.339419] Unknown ioctl 1078481924 [ 3271.349512] binder: 18501:18517 ioctl 40046207 0 returned -16 [ 3271.370513] binder_alloc: 18501: binder_alloc_buf, no vma 18:46:34 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0xffffffd, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1b) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x0, 0x2, 0x8, 0x8001, 0x9, 0x7fff, 0x2, 0x10000, 0x0}, &(0x7f0000000040)=0x20) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000000c0)={r1, 0x0, 0xda, 0x5, 0x0, 0xffffffffffffffff}, 0x14) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000140), 0x4) read$FUSE(r0, &(0x7f0000003a00), 0x1000) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)=0x20) [ 3271.424672] binder: 18501:18507 got reply transaction with no transaction stack [ 3271.432232] binder: 18501:18507 transaction failed 29201/-71, size 0-0 line 2801 18:46:34 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0xffffffffffffff91) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x8, 0x8402) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001340)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000008e80)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0xa5}], 0x1}}], 0x1, 0x0, 0x0) 18:46:34 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000000)={'netdevsim0\x00', 0x244fc101}) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x1, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000080)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3271.566836] binder: release 18501:18507 transaction 1091 out, still active [ 3271.573850] binder: undelivered TRANSACTION_COMPLETE [ 3271.580592] binder: 18501:18523 transaction failed 29189/-3, size 0-0 line 3035 18:46:34 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x3, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3271.624667] binder: send failed reply for transaction 1091, target dead 18:46:36 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000c0ed000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3273.560041] binder: 18539:18541 got reply transaction with bad transaction stack, transaction 1096 has target 18539:0 [ 3273.620447] binder: 18539:18541 transaction failed 29201/-71, size 0-0 line 2816 [ 3273.667382] binder: BINDER_SET_CONTEXT_MGR already set [ 3273.672681] binder: 18539:18542 ioctl 40046207 0 returned -16 [ 3273.712657] binder_alloc: 18539: binder_alloc_buf, no vma [ 3273.740982] binder: 18539:18543 transaction failed 29189/-3, size 0-0 line 3035 [ 3273.783523] binder: 18539:18541 got reply transaction with no transaction stack [ 3273.844476] binder: release 18539:18541 transaction 1096 out, still active [ 3273.852759] binder: 18539:18541 transaction failed 29201/-71, size 0-0 line 2801 [ 3273.885385] device bridge_slave_1 left promiscuous mode [ 3273.890878] bridge0: port 2(bridge_slave_1) entered disabled state [ 3273.898026] binder: undelivered TRANSACTION_COMPLETE [ 3273.903149] binder_release_work: 11 callbacks suppressed [ 3273.903155] binder: undelivered TRANSACTION_ERROR: 29201 [ 3273.932879] binder: undelivered TRANSACTION_ERROR: 29201 [ 3273.954634] binder: undelivered TRANSACTION_ERROR: 29189 [ 3273.960142] binder: send failed reply for transaction 1096, target dead [ 3274.000516] IPVS: ftp: loaded support on port[0] = 21 [ 3274.021749] device bridge_slave_0 left promiscuous mode [ 3274.033444] bridge0: port 1(bridge_slave_0) entered disabled state [ 3274.363639] device hsr_slave_1 left promiscuous mode [ 3274.423756] device hsr_slave_0 left promiscuous mode [ 3274.480039] team0 (unregistering): Port device team_slave_1 removed [ 3274.490696] team0 (unregistering): Port device team_slave_0 removed [ 3274.502688] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3274.561491] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3274.660993] bond0 (unregistering): Released all slaves 18:46:37 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x400000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:37 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'tgr192-generic\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x3000, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f00000000c0)=0x8) 18:46:37 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) fsetxattr(r0, &(0x7f0000000000)=@random={'trusted.', 'vmnet1vboxnet0selinux^mime_type*posix_acl_access-\x00'}, &(0x7f0000000040)='/dev/hwrng\x00', 0xb, 0x3) 18:46:37 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket(0x0, 0x80000, 0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x20, 0x20}, &(0x7f0000000040)=0xc) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000080)={r2, @in={{0x2, 0x4e21, @empty}}, 0x9, 0x4}, 0x90) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0xfffffddf) 18:46:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3274.961029] chnl_net:caif_netlink_parms(): no params data found [ 3274.997260] binder: 18552:18553 got reply transaction with bad transaction stack, transaction 1101 has target 18552:0 18:46:37 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000000)={'team0\x00', {0x2, 0x4e24, @multicast1}}) read$FUSE(r0, &(0x7f0000000a00), 0xa79) [ 3275.049012] binder: 18552:18553 transaction failed 29201/-71, size 0-0 line 2816 [ 3275.111456] binder: BINDER_SET_CONTEXT_MGR already set [ 3275.145505] binder: 18552:18559 ioctl 40046207 0 returned -16 [ 3275.163509] binder_alloc: 18552: binder_alloc_buf, no vma [ 3275.180022] bridge0: port 1(bridge_slave_0) entered blocking state [ 3275.197745] bridge0: port 1(bridge_slave_0) entered disabled state 18:46:37 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000100)=0x7, 0xb6595689) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) connect$l2tp(r0, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x1, 0x0, 0x1, 0x3, {0xa, 0x4e22, 0xbd, @loopback, 0x2}}}, 0x32) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x71, 0x200842) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000380)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000400)={0x13, 0x10, 0xfa00, {&(0x7f0000000180), r2, 0x1}}, 0x18) syz_open_dev$midi(&(0x7f0000000480)='/dev/midi#\x00', 0x9, 0x400001) read$FUSE(r0, &(0x7f0000000a00), 0x1000) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:bsdpty_device_t:s0\x00', 0x25, 0x0) ioctl$BLKGETSIZE(r0, 0x1260, &(0x7f0000000440)) [ 3275.213069] device bridge_slave_0 entered promiscuous mode [ 3275.218964] binder: 18552:18559 transaction failed 29189/-3, size 0-0 line 3035 [ 3275.226032] binder: 18552:18553 got reply transaction with no transaction stack [ 3275.252220] bridge0: port 2(bridge_slave_1) entered blocking state [ 3275.281766] bridge0: port 2(bridge_slave_1) entered disabled state [ 3275.288623] binder: 18552:18553 transaction failed 29201/-71, size 0-0 line 2801 [ 3275.296452] binder: send failed reply for transaction 1101 to 18552:18553 [ 3275.303789] binder: undelivered TRANSACTION_COMPLETE 18:46:38 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000001a00), 0x1000) [ 3275.348715] binder: undelivered TRANSACTION_ERROR: 29201 [ 3275.354181] binder: undelivered TRANSACTION_ERROR: 29189 [ 3275.360118] IPVS: ftp: loaded support on port[0] = 21 [ 3275.360843] device bridge_slave_1 entered promiscuous mode 18:46:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:38 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000140)='/dev/video#\x00', 0x4, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x109000, 0x0) setsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000000200)="0a494d0e87edcd901c157dd681d1bb33f1adac82c40c920883c9214b9c7c5454dffc9898b6b57b737b22bcfd03f39c77cd0d463947ab1ff7d2005726380123ab6e083b7058c6bf04a6a2f8626bd13eeaa83d56714202657cd7703d4745c16f0db8dca374d756785802dd1bafa5660d5a9fbe6b6e31476678128242298f7344f044b71a0719b70772e468548a40dd4c67bc4e0b867ba2bffcbc80a03ff7d08c6ca8e9a796edc15fed2aa1f529371f4310c91d468c58a7ee6d5641cbc3bb80e6d8ab5af8529fe0cc3f176a51c80bca30b14d02b9370f683e395b2e5d70cf89a809d2e10a", 0xe3) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40100, 0x0) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)={0x1b8, r4, 0x10, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0xc0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xa3}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x23}}}, {0x14, 0x2, @in={0x2, 0x4e20, @loopback}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0xfa4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x2}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x2, @mcast1, 0x4}}}}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1000}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8}]}, @TIPC_NLA_NET={0x54, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x10000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6329}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xa27}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7ff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8a4}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xa1da}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1f}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}]}, 0x1b8}, 0x1, 0x0, 0x0, 0x40}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x7a0f, 0x1700) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0205649, &(0x7f00000000c0)={0x0, 0x1, 0x0, [], &(0x7f00000001c0)={0x98f90a, 0xfffffffffffffffd, [], @p_u32=&(0x7f0000000040)}}) [ 3275.398559] IPVS: ftp: loaded support on port[0] = 21 [ 3275.418537] binder: undelivered TRANSACTION_ERROR: 29201 [ 3275.462378] binder: undelivered TRANSACTION_ERROR: 29189 [ 3275.494946] binder: 18571:18572 transaction failed 29189/-22, size 0-0 line 2896 [ 3275.521779] binder: undelivered TRANSACTION_ERROR: 29189 [ 3275.532387] binder: undelivered TRANSACTION_ERROR: 29189 [ 3275.542365] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3275.607075] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3275.670964] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3275.678489] team0: Port device team_slave_0 added [ 3275.696149] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3275.703289] team0: Port device team_slave_1 added [ 3275.730518] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3275.765555] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3275.847427] device hsr_slave_0 entered promiscuous mode [ 3275.890785] device hsr_slave_1 entered promiscuous mode [ 3275.962747] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3276.013721] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3276.027752] chnl_net:caif_netlink_parms(): no params data found [ 3276.073352] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3276.097470] chnl_net:caif_netlink_parms(): no params data found [ 3276.146752] bridge0: port 1(bridge_slave_0) entered blocking state [ 3276.153174] bridge0: port 1(bridge_slave_0) entered disabled state [ 3276.160802] device bridge_slave_0 entered promiscuous mode [ 3276.168555] bridge0: port 2(bridge_slave_1) entered blocking state [ 3276.175290] bridge0: port 2(bridge_slave_1) entered disabled state [ 3276.182553] device bridge_slave_1 entered promiscuous mode [ 3276.209625] bridge0: port 1(bridge_slave_0) entered blocking state [ 3276.216548] bridge0: port 1(bridge_slave_0) entered disabled state [ 3276.223888] device bridge_slave_0 entered promiscuous mode [ 3276.248941] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3276.260654] bridge0: port 2(bridge_slave_1) entered blocking state [ 3276.267280] bridge0: port 2(bridge_slave_1) entered disabled state [ 3276.274559] device bridge_slave_1 entered promiscuous mode [ 3276.288684] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3276.309270] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 3276.327411] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 3276.353173] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3276.362202] team0: Port device team_slave_0 added [ 3276.378651] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3276.388878] team0: Port device team_slave_1 added [ 3276.406999] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3276.415690] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 3276.423358] team0: Port device team_slave_0 added [ 3276.443632] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3276.459966] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3276.466996] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 3276.474129] team0: Port device team_slave_1 added [ 3276.479882] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 3276.494107] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 3276.511891] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3276.577452] device hsr_slave_0 entered promiscuous mode [ 3276.614919] device hsr_slave_1 entered promiscuous mode [ 3276.655497] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3276.662361] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3276.736836] device hsr_slave_0 entered promiscuous mode [ 3276.765274] device hsr_slave_1 entered promiscuous mode [ 3276.806535] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3276.812908] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 3276.828352] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3276.835376] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3276.849951] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 3276.863884] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3276.881336] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3276.891898] 8021q: adding VLAN 0 to HW filter on device team0 [ 3276.904230] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3276.916315] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3276.923734] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3276.931665] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3276.939308] bridge0: port 1(bridge_slave_0) entered blocking state [ 3276.945674] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3276.952578] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3276.960681] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3276.968354] bridge0: port 2(bridge_slave_1) entered blocking state [ 3276.974730] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3276.982501] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3276.993815] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3277.007036] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3277.017101] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3277.025856] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 3277.036344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3277.050852] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3277.080139] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3277.099992] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3277.110924] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3277.126149] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3277.143834] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3277.153575] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3277.165837] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3277.173324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3277.182298] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3277.197752] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3277.215085] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3277.222550] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3277.250761] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3277.265437] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3277.271440] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3277.283658] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3277.301189] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3277.315263] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 3277.323684] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3277.332847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3277.341414] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3277.354100] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 3277.362883] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3277.369129] 8021q: adding VLAN 0 to HW filter on device team0 [ 3277.376547] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3277.382753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 3277.390601] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 3277.400045] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 3277.407563] 8021q: adding VLAN 0 to HW filter on device team0 [ 3277.415722] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3277.426071] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3277.433327] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3277.441107] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3277.449339] bridge0: port 1(bridge_slave_0) entered blocking state [ 3277.455752] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3277.462528] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3277.470985] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3277.478668] bridge0: port 2(bridge_slave_1) entered blocking state [ 3277.485046] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3277.492105] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3277.500945] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3277.509880] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 3277.518553] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 3277.527331] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3277.535739] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 3277.543427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 3277.551728] bridge0: port 1(bridge_slave_0) entered blocking state [ 3277.558128] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3277.567091] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3277.577209] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3277.602377] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 3277.612945] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3277.621367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3277.631829] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3277.640527] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 3277.655732] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3277.663090] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3277.674191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 3277.684188] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 3277.693286] bridge0: port 2(bridge_slave_1) entered blocking state [ 3277.699662] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3277.707704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3277.715696] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3277.739543] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready 18:46:40 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000f0000000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:40 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) [ 3277.757328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 3277.776657] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 3277.802950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 3277.814288] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 3277.831632] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3277.844491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 3277.857328] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 3277.865754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3277.873337] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3277.909918] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 3277.917792] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 3277.925614] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 3277.933458] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 3277.944484] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3277.953635] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 3277.965922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3277.975340] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3277.986217] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 3277.993852] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 3278.005707] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 3278.023229] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3278.030397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 3278.038412] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 3278.056117] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 3278.062136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 3278.079805] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 3278.093974] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3278.103000] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3278.390304] device bridge_slave_1 left promiscuous mode [ 3278.396703] bridge0: port 2(bridge_slave_1) entered disabled state [ 3278.481173] device bridge_slave_0 left promiscuous mode [ 3278.487132] bridge0: port 1(bridge_slave_0) entered disabled state [ 3278.546848] device bridge_slave_1 left promiscuous mode [ 3278.552542] bridge0: port 2(bridge_slave_1) entered disabled state [ 3278.629394] device bridge_slave_0 left promiscuous mode [ 3278.635290] bridge0: port 1(bridge_slave_0) entered disabled state 18:46:41 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x500000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:41 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x600000, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f0000000140)={0x1, 0x0, {0x800, 0x5, 0x1017, 0x4, 0x7, 0x4, 0x3}}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3}) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000200)=""/126) r4 = eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000015c0)={r4}) ioctl$VIDIOC_S_EDID(r0, 0xc0285629, &(0x7f0000000080)={0x0, 0x7, 0x1000, [], &(0x7f0000000000)=0x11722e77}) ioctl$KVM_ASSIGN_DEV_IRQ(r2, 0x4040ae70, &(0x7f0000000040)={0x80000001, 0x7, 0x8c7, 0x400}) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) 18:46:41 executing program 2: r0 = socket$inet6(0xa, 0x801, 0x40) getsockname(r0, &(0x7f00000001c0)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f0000000240)=0x80) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x8000000, 0x0) ioctl$VIDIOC_G_MODULATOR(r1, 0xc0445636, &(0x7f0000000080)={0x101, "171d8b8c106d141e8c6f8956db6974d965e3b96e41f538dcb441a215907df48d", 0x20, 0xab, 0x7, 0x7, 0x3}) read$FUSE(r1, &(0x7f0000000a00), 0x1000) ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000140)={0xf, 0x5930, {0x55, 0xd28, 0xfffffffffffffffa, {0x40, 0x3}, {0x343472e7, 0x3710000000000000}, @period={0x5f, 0x26cc, 0xff, 0x4, 0x4, {0x2, 0x81, 0x6, 0x1}, 0x5, &(0x7f0000000000)=[0xa10, 0x20, 0x1, 0x3, 0xffff]}}, {0x53, 0x10000, 0x101, {0x80, 0x8}, {0x537d, 0x9}, @period={0x5d, 0x8, 0x3, 0x1, 0x3, {0xfffffffffffffffe, 0x4, 0x1de, 0xf026}, 0x6, &(0x7f0000000100)=[0x2e838455, 0x68, 0x401, 0x1, 0x5, 0x1]}}}) prctl$PR_GET_DUMPABLE(0x3) 18:46:41 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000071300000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:41 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="08e260e66f8b7ed9d409b92823370e2931bbc5bdd68c3e517e4ea02bbe1e6a2f938be36c8f0eb1bc69bc3aa44033d5e321fb1c8c042d214f9ab721a45d3a773d59a42a6773c4a43a593be366478010bb39b88c0ece84b0eedf0acf174981fd8600361eb4432eb80e3cf92373fa84992d78e41ff8a35b7f6616f5d921414017ccf2d2a7d9724c77c7c6cbcacb82d748d7302390e9adf8ba2420d85c481b5f0364bdb10853f06822e4370427cd5b8cc472f7edb9756db711d3bb982d29590c912c3692a25b68c1834ef96005905b7e9220a517a66744dfa0a296eefdd2", 0xdc) [ 3278.778296] binder: 18620:18627 got reply transaction with bad transaction stack, transaction 1108 has target 18620:0 18:46:41 executing program 3: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x4, 0xef49f13606239c61) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000040)) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x36) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) [ 3278.860580] binder_transaction: 1 callbacks suppressed [ 3278.860596] binder: 18620:18627 transaction failed 29201/-71, size 0-0 line 2816 [ 3278.942224] binder: BINDER_SET_CONTEXT_MGR already set 18:46:41 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) socket(0x11, 0x80000, 0x2) 18:46:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VIDIOC_S_FREQUENCY(r0, 0x402c5639, &(0x7f0000000180)={0x2, 0x1, 0x6}) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000140)={0xb1, 0xd91, 0x20, &(0x7f0000000080)="30c155d0efbdbaced2ef8af538e0a1cdd53f9721e7eaf8a66cc013b1f0dfc643"}) unshare(0x2000400) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f00000000c0)=0xffffffffffffff7d, 0xfe59) 18:46:41 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x2000, 0x0) r1 = fcntl$getown(r0, 0x9) r2 = syz_open_procfs(r1, &(0x7f0000000000)='net/sockstat\x00') r3 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x6, 0x80) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f00000000c0)={r3, 0x40, 0x5, r4}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3278.992799] binder: 18620:18650 ioctl 40046207 0 returned -16 [ 3279.029116] binder: release 18620:18627 transaction 1108 out, still active [ 3279.050831] binder: undelivered TRANSACTION_COMPLETE 18:46:41 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000400000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:41 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x600000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) [ 3279.085354] binder: undelivered TRANSACTION_ERROR: 29201 [ 3279.113111] binder: send failed reply for transaction 1108, target dead 18:46:41 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f0000000000)={0x0, 0x9, 0x5, 0x83, &(0x7f0000ffb000/0x3000)=nil, 0xffff}) read$FUSE(r0, &(0x7f0000000a00), 0x1000) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000040)) 18:46:41 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000640)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000b80)=""/4096) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2f0080, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7189, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x2}, 0x10) ioctl$FICLONE(r0, 0x40049409, r3) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0x19b) sendto$inet(r3, 0x0, 0x0, 0x900000020000000, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10) sendto$inet(r3, &(0x7f0000000280)="a5fe9e7be7060871618b23a8d86d12156655aa50100792f46b647308d3e2a67328969288734cc698158a84b40408261762639ee5e5881d4fb471fcb9639d30513ab42a04f920d8c1fa0c6ed49b0028fda44d1e69121bd2ff68125d42c7beccab2998e3392614583dd729cd341292ded369a34c4c75e12e8e0f519531fc8f11e74b74f2e5ad24cd0ab65395a2307394f48438306edcbb2ad2261f7535abea9833df32f75d92d392390bcfef75c9923a1745b53c", 0xb3, 0x8801, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xc2fe) fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x0, 0x2, 0xc701, 0x6, r4}) openat$tun(0xffffffffffffff9c, &(0x7f0000000380)='/dev/net/tun\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000001080)='/dev/dri/card#\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) quotactl(0x0, 0x0, 0x0, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x9) ioctl$RTC_AIE_ON(r5, 0x7001) ioctl$RTC_AIE_OFF(r5, 0x7002) connect$inet(r1, 0x0, 0x0) add_key(&(0x7f00000001c0)='cifs.srgoL\xba]\xa4bLWD\xd3a\x1ed', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000380)="9b68d05fd2c86ce86915964bea150d31254488764f7f8929a86f7737ff750f4f8ebc5074d5ac0ca066a76e7094c3e3ba85350e7e6a1f59694241e09759cd523fe3cb0eb798", 0x45, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(r5, 0x7006) prctl$PR_GET_DUMPABLE(0x3) timer_create(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, 0x0) 18:46:41 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0xfffe, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x7f6d) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x8000, 0x0) tee(r0, r0, 0x4, 0x2) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, &(0x7f0000000000)=0x3) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000000c0)={0xa, &(0x7f0000000080)=[0x8, 0x200, 0x9, 0x3, 0x0, 0x8d7c, 0x2, 0x8001, 0x3, 0xe528]}) [ 3279.245768] binder: 18675:18678 got reply transaction with bad transaction stack, transaction 1111 has target 18675:0 18:46:42 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000a0500000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:42 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x301000, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0xcf39, 0x543b}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000140)={r1, 0x8, 0xd8d}, 0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r2, 0x400443c8, &(0x7f0000000000)={r2, 0x81}) read$FUSE(r2, &(0x7f0000000a00), 0x1000) [ 3279.362159] binder: 18675:18678 transaction failed 29201/-71, size 0-0 line 2816 [ 3279.413250] binder: BINDER_SET_CONTEXT_MGR already set [ 3279.449112] binder: 18675:18698 ioctl 40046207 0 returned -16 [ 3279.497115] binder_alloc: 18675: binder_alloc_buf, no vma 18:46:42 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a000500000000a0700000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:42 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) [ 3279.540237] binder: 18675:18705 transaction failed 29189/-3, size 0-0 line 3035 18:46:42 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000001a00), 0xbc) [ 3279.600992] binder: 18675:18678 got reply transaction with no transaction stack [ 3279.635164] device hsr_slave_1 left promiscuous mode 18:46:42 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x700000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) [ 3279.649219] binder: release 18675:18678 transaction 1111 out, still active [ 3279.656917] binder: 18675:18678 transaction failed 29201/-71, size 0-0 line 2801 [ 3279.667563] binder: undelivered TRANSACTION_COMPLETE [ 3279.689919] binder: undelivered TRANSACTION_ERROR: 29201 18:46:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:42 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x2108c0, 0x0) ioctl$NBD_SET_BLKSIZE(r1, 0xab01, 0x8001) [ 3279.721108] binder: undelivered TRANSACTION_ERROR: 29201 [ 3279.724691] protocol 88fb is buggy, dev hsr_slave_0 [ 3279.731637] protocol 88fb is buggy, dev hsr_slave_1 [ 3279.744781] device hsr_slave_0 left promiscuous mode [ 3279.758292] binder: undelivered TRANSACTION_ERROR: 29189 18:46:42 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000030710000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:42 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440)='/dev/hwrng\x00', 0x4000000000, 0x0) read$FUSE(r0, &(0x7f0000001a00), 0x10ce) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000380)) sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x410100}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)={0x154, r3, 0x0, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x34, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x37}]}, @TIPC_NLA_SOCK={0x20, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x48d}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA={0xe0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x75a7}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000000c0)={0x2, 0x100, 0x1, {r1, r2+10000000}, 0x8, 0x2}) [ 3279.804223] binder: send failed reply for transaction 1111, target dead [ 3279.814145] team0 (unregistering): Port device team_slave_1 removed [ 3279.872631] binder: 18729:18730 got reply transaction with bad transaction stack, transaction 1116 has target 18729:0 [ 3279.895299] binder: 18729:18730 transaction failed 29201/-71, size 0-0 line 2816 [ 3279.906569] team0 (unregistering): Port device team_slave_0 removed [ 3279.983211] binder: BINDER_SET_CONTEXT_MGR already set [ 3280.005005] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3280.031610] binder: 18729:18743 ioctl 40046207 0 returned -16 [ 3280.045424] protocol 88fb is buggy, dev hsr_slave_0 [ 3280.050874] protocol 88fb is buggy, dev hsr_slave_1 [ 3280.057144] binder_alloc: 18729: binder_alloc_buf, no vma [ 3280.063138] binder: release 18729:18730 transaction 1116 out, still active [ 3280.071099] binder: 18729:18747 transaction failed 29189/-3, size 0-0 line 3035 [ 3280.092925] binder: undelivered TRANSACTION_COMPLETE [ 3280.118816] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3280.149195] binder: undelivered TRANSACTION_ERROR: 29201 [ 3280.177377] binder: undelivered TRANSACTION_ERROR: 29189 [ 3280.193224] binder: send failed reply for transaction 1116, target dead [ 3280.308764] bond0 (unregistering): Released all slaves [ 3280.525217] protocol 88fb is buggy, dev hsr_slave_0 [ 3280.530766] protocol 88fb is buggy, dev hsr_slave_1 [ 3280.571965] device hsr_slave_1 left promiscuous mode [ 3280.639872] device hsr_slave_0 left promiscuous mode [ 3280.684681] protocol 88fb is buggy, dev hsr_slave_0 [ 3280.689756] protocol 88fb is buggy, dev hsr_slave_1 [ 3280.709806] team0 (unregistering): Port device team_slave_1 removed [ 3280.721576] team0 (unregistering): Port device team_slave_0 removed [ 3280.734328] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 3280.779508] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 3280.854119] bond0 (unregistering): Released all slaves 18:46:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000640)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000b80)=""/4096) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2f0080, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7189, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x2}, 0x10) ioctl$FICLONE(r0, 0x40049409, r3) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0x19b) sendto$inet(r3, 0x0, 0x0, 0x900000020000000, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10) sendto$inet(r3, &(0x7f0000000280)="a5fe9e7be7060871618b23a8d86d12156655aa50100792f46b647308d3e2a67328969288734cc698158a84b40408261762639ee5e5881d4fb471fcb9639d30513ab42a04f920d8c1fa0c6ed49b0028fda44d1e69121bd2ff68125d42c7beccab2998e3392614583dd729cd341292ded369a34c4c75e12e8e0f519531fc8f11e74b74f2e5ad24cd0ab65395a2307394f48438306edcbb2ad2261f7535abea9833df32f75d92d392390bcfef75c9923a1745b53c", 0xb3, 0x8801, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xc2fe) fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x0, 0x2, 0xc701, 0x6, r4}) openat$tun(0xffffffffffffff9c, &(0x7f0000000380)='/dev/net/tun\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000001080)='/dev/dri/card#\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) quotactl(0x0, 0x0, 0x0, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x9) ioctl$RTC_AIE_ON(r5, 0x7001) ioctl$RTC_AIE_OFF(r5, 0x7002) connect$inet(r1, 0x0, 0x0) add_key(&(0x7f00000001c0)='cifs.srgoL\xba]\xa4bLWD\xd3a\x1ed', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000380)="9b68d05fd2c86ce86915964bea150d31254488764f7f8929a86f7737ff750f4f8ebc5074d5ac0ca066a76e7094c3e3ba85350e7e6a1f59694241e09759cd523fe3cb0eb798", 0x45, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(r5, 0x7006) prctl$PR_GET_DUMPABLE(0x3) timer_create(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, 0x0) 18:46:43 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000000)={0x8, 0x80000000, 0x6}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000000100)={0x55, 0x0, 0x5}) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:43 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000740000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(sha512-arm64)\x00'}, 0xff66) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-monitor\x00', 0x3f, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/sctp\x00') fchmodat(r2, &(0x7f0000000040)='./file0\x00', 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000000c0)=0x0) syz_open_procfs(r3, &(0x7f0000000100)='maps\x00') 18:46:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:43 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0xf00000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:43 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000000940000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3281.046867] binder: 18764:18765 got reply transaction with bad transaction stack, transaction 1120 has target 18764:0 18:46:43 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000000)={0x40, 0x9, 0x3, 0x4, 0x49, 0x2}) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000040)={0x1, 0x0, 0x10002, 0x100000001}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f00000000c0)={0x91, r1}) fsetxattr$security_smack_transmute(r0, &(0x7f0000000180)='security.SMACK64TRANSMUTE\x00', &(0x7f00000001c0)='TRUE', 0x4, 0x3) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, &(0x7f0000000100)={0x0, 0x5, {0x55, 0x0, 0x10001, {0x40, 0x6}, {0x1000000000000, 0x9}, @rumble={0x7, 0x86a7}}, {0x51, 0x7, 0x5, {0x4, 0x38}, {0x9, 0xffffffffffffda9e}, @const={0xfffffffffffff216, {0x52, 0x0, 0xcb8d, 0x4}}}}) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x2040, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f00000001c0)={0x6, 0x118, 0xfa00, {{0x7fff, 0x1, "b42948fa7bece9ad6a9aaa3695aa965f9cf50c219818ef86d12a9fdea5716f445c123cd5a326f999af38a5cb97cfa539988a0204f7ecadf3e532db289637d067fa63300eeec9b81617bda73837bf0d9e6f2f8f2744660bda2a968f87bda07383d58c25fb30ec3cdc01004a660403b93fa7c69c1815ef92c923cd9a3ca5a1407fd6050fdc7eb6a7ab0292cfab008fa5f40a8b2713637bd88ac31e3c4463890fb7b54a541c6043cc3a8f9f479781d56ffd0702f8977facabc3255fbb557a90ac6571cceda1a8d95b0e1b73c064a9d60f4326c6a1d7bd4dbe14857195290c9a942ab03be708c8d5bb83cbbdb75825aca8801762e650cc66f153ec03f793aa4db73a", 0x90, 0x1, 0x1, 0x8, 0x3c, 0x7, 0xff, 0x1}, r2}}, 0x120) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) [ 3281.125424] binder: 18764:18765 transaction failed 29201/-71, size 0-0 line 2816 [ 3281.192142] binder: BINDER_SET_CONTEXT_MGR already set [ 3281.205277] binder: 18764:18782 ioctl 40046207 0 returned -16 18:46:43 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0xa4, 0x8800) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:43 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000050a00000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3281.272702] binder: send failed reply for transaction 1120 to 18764:18765 [ 3281.286262] binder: undelivered TRANSACTION_COMPLETE 18:46:43 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000640)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000b80)=""/4096) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2f0080, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7189, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x2}, 0x10) ioctl$FICLONE(r0, 0x40049409, r3) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0x19b) sendto$inet(r3, 0x0, 0x0, 0x900000020000000, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10) sendto$inet(r3, &(0x7f0000000280)="a5fe9e7be7060871618b23a8d86d12156655aa50100792f46b647308d3e2a67328969288734cc698158a84b40408261762639ee5e5881d4fb471fcb9639d30513ab42a04f920d8c1fa0c6ed49b0028fda44d1e69121bd2ff68125d42c7beccab2998e3392614583dd729cd341292ded369a34c4c75e12e8e0f519531fc8f11e74b74f2e5ad24cd0ab65395a2307394f48438306edcbb2ad2261f7535abea9833df32f75d92d392390bcfef75c9923a1745b53c", 0xb3, 0x8801, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xc2fe) fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x0, 0x2, 0xc701, 0x6, r4}) openat$tun(0xffffffffffffff9c, &(0x7f0000000380)='/dev/net/tun\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000001080)='/dev/dri/card#\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) quotactl(0x0, 0x0, 0x0, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x9) ioctl$RTC_AIE_ON(r5, 0x7001) ioctl$RTC_AIE_OFF(r5, 0x7002) connect$inet(r1, 0x0, 0x0) add_key(&(0x7f00000001c0)='cifs.srgoL\xba]\xa4bLWD\xd3a\x1ed', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000380)="9b68d05fd2c86ce86915964bea150d31254488764f7f8929a86f7737ff750f4f8ebc5074d5ac0ca066a76e7094c3e3ba85350e7e6a1f59694241e09759cd523fe3cb0eb798", 0x45, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(r5, 0x7006) prctl$PR_GET_DUMPABLE(0x3) timer_create(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, 0x0) 18:46:44 executing program 3: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x400, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000080)={0x0, @aes256, 0x1, "42fc05770f74bf14"}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f00000001c0)={0x3, 0x2, 0x0, [{0x4, 0x0, 0x9, 0xffffffff7fffffff, 0x6, 0x1, 0x9}, {0x9, 0x1, 0x5, 0x80, 0x3, 0x200, 0x4}]}) [ 3281.315685] binder: undelivered TRANSACTION_ERROR: 29201 [ 3281.361611] binder: undelivered TRANSACTION_ERROR: 29189 18:46:44 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000280)=ANY=[@ANYRES32=0x0, @ANYBLOB="bd000000184ec078d5aa72d3fbc0380273c378c62e1d76ead2bde6193ba3be1e52f41247cb715b5ffc718933d6f4eb4cb54aa0d4fe601983a3caa58423d5d63f9e665d326b9db90b5e7e304681db55176ff49000e9bcb6731689858256366048e774c6e8823192c260b124146e2656a9afe47c935c495aff3abb6515cb60b72cc651038a85b2a29d14cc1a55b4007eb423d4c1e4b54266444e7bf9c08624cc8e6b1aba97fe8416f75a3caf73b65f6980325254c86ef935b280ff8209cb349dd5198ff1454dca5255926e0e7562127b1a25724aa36171e0a8f5b3ae4309d8f8bcfaf04c7e85c9ff8ea4c4386feb479d42ae371c7854f13300eeafcaff5f756080b4e6ed0080191caf0b9326e3ace0fecfd8dd61b1cbca1377bead50722b7963330cd46d57c1501e28b6f0092c6c3c17b3b72908ab3b22738d4e15f0e5ee2a183a8ffc01000000151a768e39cbe42a0780dfc2c7de961538eba11e95aa64ad1e2ac8d5934a442c24d06def258ec37bad17774fd48733be5b96cf1033de51179b4f0e369ae6ff7297bad0ce9a0f95f4b45ef5f57c3a9e2c76"], &(0x7f00000001c0)=0xc5) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000200)=r1, 0x4) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000040)=0x4) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:44 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0xfffffffffffffef1) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) 18:46:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000640)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000b80)=""/4096) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2f0080, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7189, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x2}, 0x10) ioctl$FICLONE(r0, 0x40049409, r3) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0x19b) sendto$inet(r3, 0x0, 0x0, 0x900000020000000, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10) sendto$inet(r3, &(0x7f0000000280)="a5fe9e7be7060871618b23a8d86d12156655aa50100792f46b647308d3e2a67328969288734cc698158a84b40408261762639ee5e5881d4fb471fcb9639d30513ab42a04f920d8c1fa0c6ed49b0028fda44d1e69121bd2ff68125d42c7beccab2998e3392614583dd729cd341292ded369a34c4c75e12e8e0f519531fc8f11e74b74f2e5ad24cd0ab65395a2307394f48438306edcbb2ad2261f7535abea9833df32f75d92d392390bcfef75c9923a1745b53c", 0xb3, 0x8801, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xc2fe) fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x0, 0x2, 0xc701, 0x6, r4}) openat$tun(0xffffffffffffff9c, &(0x7f0000000380)='/dev/net/tun\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000001080)='/dev/dri/card#\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) quotactl(0x0, 0x0, 0x0, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x9) ioctl$RTC_AIE_ON(r5, 0x7001) ioctl$RTC_AIE_OFF(r5, 0x7002) connect$inet(r1, 0x0, 0x0) add_key(&(0x7f00000001c0)='cifs.srgoL\xba]\xa4bLWD\xd3a\x1ed', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000380)="9b68d05fd2c86ce86915964bea150d31254488764f7f8929a86f7737ff750f4f8ebc5074d5ac0ca066a76e7094c3e3ba85350e7e6a1f59694241e09759cd523fe3cb0eb798", 0x45, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(r5, 0x7006) prctl$PR_GET_DUMPABLE(0x3) timer_create(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, 0x0) [ 3281.615465] binder: 18812:18814 transaction failed 29189/-22, size 0-0 line 2896 [ 3281.676559] binder: 18812:18820 got reply transaction with no transaction stack [ 3281.727477] binder: 18812:18820 transaction failed 29201/-71, size 0-0 line 2801 [ 3281.804480] binder: 18812:18820 transaction failed 29189/-22, size 0-0 line 2896 [ 3281.812464] protocol 88fb is buggy, dev hsr_slave_0 [ 3281.812515] protocol 88fb is buggy, dev hsr_slave_1 18:46:44 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a00050000000070a00000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) 18:46:44 executing program 2: mknod$loop(&(0x7f0000000000)='./file0\x00', 0x2808, 0x1) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) 18:46:44 executing program 0: socketpair$unix(0x1, 0x100000, 0x0, &(0x7f0000000200)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000006380)='/proc/capi/capi20\x00', 0x50801, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x401}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000040)=@nullb='.u\n:d]:.,[:\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ceph\x00', 0x2000000000000000, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0xffffffff, 0x1bb946ec}, 0x3f, 0x3}) 18:46:44 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f00000001c0)) 18:46:44 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x9, 0x200200) read$FUSE(r0, &(0x7f0000000a00), 0xffffff3b) 18:46:44 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x10000000, 0x0, 0x0, 0x200000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa20b, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) clone(0x2102001ff4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2e751d20d9201c5b171b1e0ea10b29f80a3a645d3a0005000000017fe00000000000"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfffffffffffffffd}, 0x1, 0x0, 0x100000000, {0x0, 0x1bb946ec}, 0x3f, 0x3}) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000200), 0x4) prctl$PR_SVE_SET_VL(0x32, 0x393a6) [ 3281.945359] binder: undelivered TRANSACTION_ERROR: 29189 [ 3281.961460] binder: undelivered TRANSACTION_ERROR: 29189 18:46:44 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x210400, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null-generic\x00'}, 0x58) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x5, 0x0, 0x10) 18:46:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000003c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x0, 0x4020011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x0, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}], 0x0, 0x0, 0x0}) 18:46:44 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000040)) read$FUSE(r0, &(0x7f0000000a00), 0xffffffffffffff6f) ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000000)={0xc2a, 0xffffffffffffffe0, 0x10001}) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f00000000c0)) fstatfs(r0, &(0x7f0000000100)=""/4) ioctl$KVM_KVMCLOCK_CTRL(r0, 0xaead) 18:46:44 executing program 3: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x14000, 0x0) ioctl$VIDIOC_G_ENC_INDEX(r0, 0x8818564c, &(0x7f00000009c0)) getsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000940), &(0x7f0000000980)=0x4) r1 = socket$alg(0x26, 0x5, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256\x00'}, 0x58) 18:46:44 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000640)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000b80)=""/4096) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x2f0080, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7189, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r0, 0x54a3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000100)={0x2, 0x2}, 0x10) ioctl$FICLONE(r0, 0x40049409, r3) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0x19b) sendto$inet(r3, 0x0, 0x0, 0x900000020000000, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10) sendto$inet(r3, &(0x7f0000000280)="a5fe9e7be7060871618b23a8d86d12156655aa50100792f46b647308d3e2a67328969288734cc698158a84b40408261762639ee5e5881d4fb471fcb9639d30513ab42a04f920d8c1fa0c6ed49b0028fda44d1e69121bd2ff68125d42c7beccab2998e3392614583dd729cd341292ded369a34c4c75e12e8e0f519531fc8f11e74b74f2e5ad24cd0ab65395a2307394f48438306edcbb2ad2261f7535abea9833df32f75d92d392390bcfef75c9923a1745b53c", 0xb3, 0x8801, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xc2fe) fcntl$lock(r2, 0x6, &(0x7f0000000080)={0x0, 0x2, 0xc701, 0x6, r4}) openat$tun(0xffffffffffffff9c, &(0x7f0000000380)='/dev/net/tun\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000001080)='/dev/dri/card#\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) quotactl(0x0, 0x0, 0x0, 0x0) r5 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc\x00', 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x9) ioctl$RTC_AIE_ON(r5, 0x7001) ioctl$RTC_AIE_OFF(r5, 0x7002) connect$inet(r1, 0x0, 0x0) add_key(&(0x7f00000001c0)='cifs.srgoL\xba]\xa4bLWD\xd3a\x1ed', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000380)="9b68d05fd2c86ce86915964bea150d31254488764f7f8929a86f7737ff750f4f8ebc5074d5ac0ca066a76e7094c3e3ba85350e7e6a1f59694241e09759cd523fe3cb0eb798", 0x45, 0xfffffffffffffffc) ioctl$RTC_PIE_OFF(r5, 0x7006) prctl$PR_GET_DUMPABLE(0x3) timer_create(0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, @thr={0x0, 0x0}}, 0x0) [ 3282.214621] binder: 18859:18861 got reply transaction with bad transaction stack, transaction 1126 has target 18859:0 [ 3282.241658] binder: BINDER_SET_CONTEXT_MGR already set 18:46:44 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) [ 3282.280927] binder: 18859:18866 ioctl 40046207 0 returned -16 [ 3282.305520] ================================================================== [ 3282.313264] BUG: KASAN: use-after-free in _free_event+0x475/0x15d0 [ 3282.319658] Write of size 4 at addr ffff888090be60e0 by task syz-executor0/18855 [ 3282.327171] [ 3282.327186] CPU: 0 PID: 18855 Comm: syz-executor0 Not tainted 5.0.0-rc3+ #42 [ 3282.327193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3282.327199] Call Trace: [ 3282.333435] binder_alloc: 18859: binder_alloc_buf, no vma [ 3282.335976] dump_stack+0x1db/0x2d0 [ 3282.335992] ? dump_stack_print_info.cold+0x20/0x20 [ 3282.336009] ? rcu_is_watching+0x30/0x30 [ 3282.336019] ? _free_event+0x475/0x15d0 [ 3282.336036] print_address_description.cold+0x7c/0x20d [ 3282.366198] ? _free_event+0x475/0x15d0 18:46:45 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'sha256-arm64-neon\x00'}, 0x58) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) sendto(r0, &(0x7f00000005c0)="a258ae7715f18c86204ce5592e2c145d30c7000005c5a7cebf3604ef3bdd8823e4de975facdece4695e762481acc311b2f57c60b6aae0041a6894450db8b8085c47be6afbd490f8b96019156c8164e412abf95a5edffffffffdc05e4644bf2dee606cc96cc493ceec0b7272a4c92e84f8e32b6507180f09e3db7d0cfad1146336de101bc7b4624a96e8cd708a88100b7ca25ace2d97c8fc30390d2c86f0e9fc47a35b94b86d4959b412593c746db77a6f4db018f28152f159e69910100b7bba921e011296c6d581a1465d940f1935f5e1f2fe4c186526b4d227b12370dd6d94561100d50b07c3b888b8fca60aba5b00ea30a94c942ec4b4fb77d1336200e85aa505573e04200000000000000", 0xffffffffffffffb7, 0x80, &(0x7f0000000540)=@tipc=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x1}}, 0x80) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x10) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) [ 3282.366210] ? _free_event+0x475/0x15d0 [ 3282.366226] kasan_report.cold+0x1b/0x40 [ 3282.366238] ? _free_event+0x475/0x15d0 [ 3282.366253] check_memory_region+0x123/0x190 [ 3282.395734] kasan_check_write+0x14/0x20 [ 3282.399787] _free_event+0x475/0x15d0 [ 3282.403584] ? ring_buffer_attach+0x850/0x850 [ 3282.408080] ? kasan_check_write+0x14/0x20 [ 3282.412309] ? __mutex_unlock_slowpath+0x195/0x870 [ 3282.417233] ? mark_held_locks+0xb1/0x100 [ 3282.419262] binder: 18859:18861 got reply transaction with no transaction stack 18:46:45 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000a00), 0x1000) write$P9_RREAD(r0, &(0x7f0000000000)={0x52, 0x75, 0x2, {0x47, "c9dd89027dfc93268d393af511aa74d4f58996b16269ca9cd3f363c8cfef76f113fa64021a1375aaba71413f1cdac715920f33698790df0e1f568c7289213f5324d170dedc2824"}}, 0x52) [ 3282.421375] ? wait_for_completion+0x810/0x810 [ 3282.421391] free_event+0xb5/0x1a0 [ 3282.421403] ? _free_event+0x15d0/0x15d0 [ 3282.433394] perf_event_release_kernel+0x794/0xf70 [ 3282.440939] ? put_event+0x60/0x60 [ 3282.440954] ? kasan_check_read+0x11/0x20 [ 3282.453520] ? locks_check_ctx_file_list+0xdd/0x120 [ 3282.458527] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3282.461025] binder: release 18859:18861 transaction 1126 out, still active [ 3282.464063] ? _raw_spin_unlock+0x2d/0x50 [ 3282.464077] ? locks_remove_file+0x3d5/0x5c0 [ 3282.479687] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 3282.485237] ? ima_file_free+0x128/0x630 [ 3282.485249] ? fcntl_setlk+0xfe0/0xfe0 [ 3282.485259] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3282.485269] ? ima_file_check+0x130/0x130 [ 3282.485287] perf_release+0x37/0x50 [ 3282.506425] __fput+0x3c5/0xb10 [ 3282.506683] binder: undelivered TRANSACTION_COMPLETE [ 3282.509710] ? perf_event_release_kernel+0xf70/0xf70 [ 3282.509723] ? get_max_files+0x20/0x20 [ 3282.509735] ? ___might_sleep+0x1e7/0x310 [ 3282.509748] ? trace_hardirqs_off_caller+0x300/0x300 [ 3282.532988] ? arch_local_save_flags+0x50/0x50 [ 3282.537568] ____fput+0x16/0x20 [ 3282.540838] task_work_run+0x1f4/0x2b0 [ 3282.544721] ? task_work_cancel+0x2c0/0x2c0 [ 3282.549239] get_signal+0x168d/0x19b0 [ 3282.549252] ? add_lock_to_list.isra.0+0x450/0x450 [ 3282.549268] ? lock_acquire+0x1db/0x570 [ 3282.555422] binder: send failed reply for transaction 1126, target dead [ 3282.557972] ? ptrace_notify+0x130/0x130 [ 3282.557988] ? __might_fault+0x12b/0x1e0 [ 3282.558001] ? find_held_lock+0x35/0x120 [ 3282.558012] ? __might_fault+0x12b/0x1e0 [ 3282.568692] ? lock_acquire+0x1db/0x570 [ 3282.588863] do_signal+0x91/0x1ea0 [ 3282.592379] ? lock_release+0xc40/0xc40 [ 3282.596329] ? trace_hardirqs_off_caller+0x300/0x300 [ 3282.601414] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3282.606926] ? setup_sigcontext+0x7d0/0x7d0 [ 3282.611225] ? exit_to_usermode_loop+0x98/0x3b0 [ 3282.615887] ? exit_to_usermode_loop+0x98/0x3b0 [ 3282.620533] ? lockdep_hardirqs_on+0x415/0x5d0 [ 3282.625092] ? trace_hardirqs_on+0xbd/0x310 [ 3282.629391] ? do_syscall_64+0x696/0x800 [ 3282.633524] ? trace_hardirqs_off_caller+0x300/0x300 [ 3282.638692] ? nsecs_to_jiffies+0x30/0x30 [ 3282.642816] ? do_syscall_64+0x8c/0x800 [ 3282.646772] exit_to_usermode_loop+0x2f7/0x3b0 [ 3282.651433] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3282.656772] ? syscall_trace_enter+0x12a0/0x12a0 [ 3282.661516] do_syscall_64+0x696/0x800 [ 3282.665397] ? syscall_return_slowpath+0x5f0/0x5f0 [ 3282.670326] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 3282.675320] ? __switch_to_asm+0x34/0x70 [ 3282.679360] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 3282.684182] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3282.689346] RIP: 0033:0x458099 [ 3282.692515] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3282.711390] RSP: 002b:00007f0e14dcdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 3282.719215] RAX: fffffffffffffffc RBX: 0000000000000005 RCX: 0000000000458099 [ 3282.726463] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3282.733711] RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 [ 3282.740956] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0e14dce6d4 [ 3282.748201] R13: 00000000004be480 R14: 00000000004cea40 R15: 00000000ffffffff [ 3282.755462] [ 3282.757063] Allocated by task 18850: [ 3282.760756] save_stack+0x45/0xd0 [ 3282.764183] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 3282.769088] kasan_slab_alloc+0xf/0x20 [ 3282.773046] kmem_cache_alloc_node+0x144/0x710 [ 3282.777604] copy_process+0x405b/0x8710 [ 3282.781553] _do_fork+0x1a9/0x1170 [ 3282.785068] __x64_sys_clone+0xbf/0x150 [ 3282.789024] do_syscall_64+0x1a3/0x800 [ 3282.792887] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3282.798045] [ 3282.799646] Freed by task 18850: [ 3282.802988] save_stack+0x45/0xd0 [ 3282.806417] __kasan_slab_free+0x102/0x150 [ 3282.810625] kasan_slab_free+0xe/0x10 [ 3282.814400] kmem_cache_free+0x86/0x260 [ 3282.818349] free_task+0x170/0x1f0 [ 3282.821864] copy_process+0x10c8/0x8710 [ 3282.825812] _do_fork+0x1a9/0x1170 [ 3282.829327] __x64_sys_clone+0xbf/0x150 [ 3282.833277] do_syscall_64+0x1a3/0x800 [ 3282.837184] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3282.842344] [ 3282.843952] The buggy address belongs to the object at ffff888090be60c0 [ 3282.843952] which belongs to the cache task_struct(17:syz0) of size 6080 [ 3282.857466] The buggy address is located 32 bytes inside of [ 3282.857466] 6080-byte region [ffff888090be60c0, ffff888090be7880) [ 3282.869310] The buggy address belongs to the page: [ 3282.874216] page:ffffea000242f980 count:1 mapcount:0 mapping:ffff8880a9231d80 index:0x0 compound_mapcount: 0 [ 3282.884155] flags: 0x1fffc0000010200(slab|head) [ 3282.888805] raw: 01fffc0000010200 ffffea0000354788 ffffea00003c2c88 ffff8880a9231d80 [ 3282.896664] raw: 0000000000000000 ffff888090be60c0 0000000100000001 ffff88805ab341c0 [ 3282.904525] page dumped because: kasan: bad access detected [ 3282.910205] page->mem_cgroup:ffff88805ab341c0 [ 3282.914676] [ 3282.916281] Memory state around the buggy address: [ 3282.921184] ffff888090be5f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3282.928516] ffff888090be6000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 3282.935850] >ffff888090be6080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 3282.943180] ^ [ 3282.949646] ffff888090be6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3282.956978] ffff888090be6180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3282.964415] ================================================================== [ 3282.971743] Disabling lock debugging due to kernel taint [ 3283.054753] Kernel panic - not syncing: panic_on_warn set ... [ 3283.060730] CPU: 1 PID: 18855 Comm: syz-executor0 Tainted: G B 5.0.0-rc3+ #42 [ 3283.069293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3283.078716] Call Trace: [ 3283.081285] dump_stack+0x1db/0x2d0 [ 3283.084901] ? dump_stack_print_info.cold+0x20/0x20 [ 3283.089910] panic+0x2cb/0x65c [ 3283.093088] ? add_taint.cold+0x16/0x16 [ 3283.097048] ? _free_event+0x475/0x15d0 [ 3283.101010] ? preempt_schedule+0x4b/0x60 [ 3283.105151] ? ___preempt_schedule+0x16/0x18 [ 3283.109544] ? trace_hardirqs_on+0xb4/0x310 [ 3283.113859] ? _free_event+0x475/0x15d0 [ 3283.117817] end_report+0x47/0x4f [ 3283.121254] ? _free_event+0x475/0x15d0 [ 3283.125214] kasan_report.cold+0xe/0x40 [ 3283.129173] ? _free_event+0x475/0x15d0 [ 3283.133132] check_memory_region+0x123/0x190 [ 3283.137524] kasan_check_write+0x14/0x20 [ 3283.141567] _free_event+0x475/0x15d0 [ 3283.145357] ? ring_buffer_attach+0x850/0x850 [ 3283.149839] ? kasan_check_write+0x14/0x20 [ 3283.154060] ? __mutex_unlock_slowpath+0x195/0x870 [ 3283.158972] ? mark_held_locks+0xb1/0x100 [ 3283.163111] ? wait_for_completion+0x810/0x810 [ 3283.167680] free_event+0xb5/0x1a0 [ 3283.171205] ? _free_event+0x15d0/0x15d0 [ 3283.175344] perf_event_release_kernel+0x794/0xf70 [ 3283.180263] ? put_event+0x60/0x60 [ 3283.183788] ? kasan_check_read+0x11/0x20 [ 3283.187922] ? locks_check_ctx_file_list+0xdd/0x120 [ 3283.193029] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3283.198554] ? _raw_spin_unlock+0x2d/0x50 [ 3283.202683] ? locks_remove_file+0x3d5/0x5c0 [ 3283.207075] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 3283.212613] ? ima_file_free+0x128/0x630 [ 3283.216660] ? fcntl_setlk+0xfe0/0xfe0 [ 3283.220542] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 3283.226064] ? ima_file_check+0x130/0x130 [ 3283.230204] perf_release+0x37/0x50 [ 3283.233818] __fput+0x3c5/0xb10 [ 3283.237082] ? perf_event_release_kernel+0xf70/0xf70 [ 3283.242168] ? get_max_files+0x20/0x20 [ 3283.246038] ? ___might_sleep+0x1e7/0x310 [ 3283.250167] ? trace_hardirqs_off_caller+0x300/0x300 [ 3283.255252] ? arch_local_save_flags+0x50/0x50 [ 3283.259821] ____fput+0x16/0x20 [ 3283.263087] task_work_run+0x1f4/0x2b0 [ 3283.266958] ? task_work_cancel+0x2c0/0x2c0 [ 3283.271289] get_signal+0x168d/0x19b0 [ 3283.275075] ? add_lock_to_list.isra.0+0x450/0x450 [ 3283.280000] ? lock_acquire+0x1db/0x570 [ 3283.283958] ? ptrace_notify+0x130/0x130 [ 3283.288007] ? __might_fault+0x12b/0x1e0 [ 3283.292050] ? find_held_lock+0x35/0x120 [ 3283.296097] ? __might_fault+0x12b/0x1e0 [ 3283.300315] ? lock_acquire+0x1db/0x570 [ 3283.304276] do_signal+0x91/0x1ea0 [ 3283.307799] ? lock_release+0xc40/0xc40 [ 3283.311762] ? trace_hardirqs_off_caller+0x300/0x300 [ 3283.316849] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 3283.322368] ? setup_sigcontext+0x7d0/0x7d0 [ 3283.326679] ? exit_to_usermode_loop+0x98/0x3b0 [ 3283.331330] ? exit_to_usermode_loop+0x98/0x3b0 [ 3283.335999] ? lockdep_hardirqs_on+0x415/0x5d0 [ 3283.340563] ? trace_hardirqs_on+0xbd/0x310 [ 3283.344875] ? do_syscall_64+0x696/0x800 [ 3283.348928] ? trace_hardirqs_off_caller+0x300/0x300 [ 3283.354016] ? nsecs_to_jiffies+0x30/0x30 [ 3283.358152] ? do_syscall_64+0x8c/0x800 [ 3283.362113] exit_to_usermode_loop+0x2f7/0x3b0 [ 3283.366683] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3283.372122] ? syscall_trace_enter+0x12a0/0x12a0 [ 3283.376868] do_syscall_64+0x696/0x800 [ 3283.380745] ? syscall_return_slowpath+0x5f0/0x5f0 [ 3283.385675] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 3283.390688] ? __switch_to_asm+0x34/0x70 [ 3283.394752] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 3283.399581] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3283.404756] RIP: 0033:0x458099 [ 3283.407932] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 3283.426902] RSP: 002b:00007f0e14dcdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 3283.434593] RAX: fffffffffffffffc RBX: 0000000000000005 RCX: 0000000000458099 [ 3283.441847] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 3283.449101] RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 [ 3283.456356] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0e14dce6d4 [ 3283.463609] R13: 00000000004be480 R14: 00000000004cea40 R15: 00000000ffffffff [ 3283.472069] Kernel Offset: disabled [ 3283.475684] Rebooting in 86400 seconds..