e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendmsg(r0, &(0x7f0000000100)={&(0x7f0000000040)=@in={0x2, 0x4e21}, 0x80}, 0x0) [ 220.152961] binder: release 12941:12942 transaction 300 out, still active [ 220.159980] binder: unexpected work type, 4, not freed [ 220.165298] binder: undelivered TRANSACTION_COMPLETE 07:12:57 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304}], 0x0, 0x0, &(0x7f0000000780)}) [ 220.228688] binder: send failed reply for transaction 300, target dead [ 220.251860] FAULT_INJECTION: forcing a failure. [ 220.251860] name failslab, interval 1, probability 0, space 0, times 0 [ 220.256976] binder: release 12965:12968 transaction 305 out, still active [ 220.263155] CPU: 1 PID: 12957 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 07:12:57 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@bridge_delneigh={0x28, 0x1c, 0xf07, 0x0, 0x0, {0x7, 0x0, 0x0, r2}, [@NDA_LLADDR={0xc, 0x2, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}]}, 0x28}, 0x1}, 0x0) [ 220.263168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 220.270098] binder: unexpected work type, 4, not freed [ 220.278468] Call Trace: [ 220.278493] dump_stack+0x1c9/0x2b4 [ 220.278514] ? dump_stack_print_info.cold.2+0x52/0x52 [ 220.287882] binder: undelivered TRANSACTION_COMPLETE [ 220.293128] ? __kernel_text_address+0xd/0x40 [ 220.293146] ? unwind_get_return_address+0x61/0xa0 [ 220.318991] should_fail.cold.4+0xa/0x11 [ 220.323061] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 220.328174] ? save_stack+0xa9/0xd0 [ 220.331812] ? save_stack+0x43/0xd0 [ 220.335476] ? kasan_kmalloc+0xc4/0xe0 [ 220.339366] ? kmem_cache_alloc_trace+0x152/0x780 [ 220.344216] ? __memcg_init_list_lru_node+0x185/0x2d0 [ 220.349412] ? __list_lru_init+0x4d6/0x840 [ 220.353648] ? alloc_super+0x9a6/0xb10 [ 220.357537] ? sget+0x10b/0x150 [ 220.360817] ? mount_bdev+0x115/0x3e0 [ 220.364343] binder: send failed reply for transaction 305, target dead [ 220.364618] ? msdos_mount+0x3c/0x50 [ 220.375006] ? legacy_get_tree+0x118/0x440 [ 220.379227] ? vfs_get_tree+0x1cb/0x5c0 [ 220.383183] ? do_mount+0x6c1/0x1fb0 [ 220.386882] ? ksys_mount+0x12d/0x140 [ 220.390662] ? __x64_sys_mount+0xbe/0x150 [ 220.394797] ? do_syscall_64+0x1b9/0x820 [ 220.398841] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 220.404188] ? save_stack+0xa9/0xd0 [ 220.407802] ? lock_acquire+0x1e4/0x540 [ 220.411756] ? fs_reclaim_acquire+0x20/0x20 [ 220.416061] ? lock_downgrade+0x8f0/0x8f0 [ 220.420190] ? do_mount+0x6c1/0x1fb0 [ 220.423891] ? check_same_owner+0x340/0x340 [ 220.428213] ? rcu_note_context_switch+0x730/0x730 [ 220.433126] __should_failslab+0x124/0x180 [ 220.437349] should_failslab+0x9/0x14 [ 220.441137] kmem_cache_alloc_trace+0x2cb/0x780 [ 220.445797] ? kasan_kmalloc+0xc4/0xe0 [ 220.449671] __memcg_init_list_lru_node+0x185/0x2d0 [ 220.454670] ? kvfree_rcu+0x20/0x20 [ 220.458278] ? __kmalloc_node+0x47/0x70 [ 220.462235] __list_lru_init+0x4d6/0x840 [ 220.466280] ? list_lru_destroy+0x500/0x500 [ 220.470596] ? prealloc_shrinker+0x213/0x480 [ 220.474985] ? __init_waitqueue_head+0x9e/0x150 [ 220.479639] ? inactive_list_is_low+0x850/0x850 [ 220.484293] ? __lockdep_init_map+0x105/0x590 [ 220.488772] alloc_super+0x9a6/0xb10 [ 220.492471] ? destroy_unused_super.part.11+0x110/0x110 [ 220.497820] ? lock_downgrade+0x8f0/0x8f0 [ 220.501954] ? kasan_check_read+0x11/0x20 [ 220.506085] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 220.510650] ? kasan_check_write+0x14/0x20 [ 220.514866] ? do_raw_spin_lock+0xc1/0x200 [ 220.519085] sget_userns+0x276/0x860 [ 220.522783] ? kill_litter_super+0x60/0x60 [ 220.527002] ? test_single_super+0x10/0x10 [ 220.531227] ? vfs_get_super+0x270/0x270 [ 220.535279] ? kasan_check_read+0x11/0x20 [ 220.539421] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 220.543995] ? kasan_check_write+0x14/0x20 [ 220.548212] ? do_raw_spin_lock+0xc1/0x200 [ 220.552443] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 220.557961] ? ns_capable_common+0x13f/0x170 [ 220.562363] ? kill_litter_super+0x60/0x60 [ 220.566582] sget+0x10b/0x150 [ 220.569670] ? test_single_super+0x10/0x10 [ 220.573888] mount_bdev+0x115/0x3e0 [ 220.577499] ? msdos_mount+0x50/0x50 [ 220.581214] msdos_mount+0x3c/0x50 [ 220.584735] ? setup+0xe0/0xe0 [ 220.587910] legacy_get_tree+0x118/0x440 [ 220.591953] vfs_get_tree+0x1cb/0x5c0 [ 220.595734] ? vfs_set_fs_source+0x12c/0x180 [ 220.600126] do_mount+0x6c1/0x1fb0 [ 220.603652] ? check_same_owner+0x340/0x340 [ 220.607954] ? lock_release+0xa30/0xa30 [ 220.611923] ? copy_mount_string+0x40/0x40 [ 220.616142] ? kasan_kmalloc+0xc4/0xe0 [ 220.620018] ? kmem_cache_alloc_trace+0x318/0x780 [ 220.624847] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 220.630369] ? _copy_from_user+0xdf/0x150 [ 220.634503] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 220.640023] ? copy_mount_options+0x285/0x380 [ 220.644504] ksys_mount+0x12d/0x140 [ 220.648114] __x64_sys_mount+0xbe/0x150 [ 220.652072] do_syscall_64+0x1b9/0x820 [ 220.655944] ? finish_task_switch+0x1d3/0x870 [ 220.660424] ? syscall_return_slowpath+0x5e0/0x5e0 [ 220.665338] ? syscall_return_slowpath+0x31d/0x5e0 [ 220.670252] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 220.675252] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 220.680770] ? prepare_exit_to_usermode+0x291/0x3b0 [ 220.685771] ? perf_trace_sys_enter+0xb10/0xb10 [ 220.690425] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 220.695257] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 220.700430] RIP: 0033:0x4584ea [ 220.703597] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 220.722767] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 220.730466] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 220.737719] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 220.744977] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 220.752237] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 220.759497] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000044 07:12:58 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f7620") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:12:58 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000590fa8)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000)="0a0775b0d5e383e5b3b60ced5c54dbb7295df0df8217ad4000000000000000e6", 0x20) r1 = accept$alg(r0, 0x0, 0x0) lsetxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.syz\x00', &(0x7f00000000c0)='@@\x00', 0x3, 0x3) sendmmsg$alg(r1, &(0x7f00000046c0)=[{0x0, 0x0, &(0x7f0000001200), 0x0, &(0x7f0000001280)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) io_setup(0x1, &(0x7f0000479000)=0x0) io_submit(r2, 0x1, &(0x7f0000738000)=[&(0x7f0000f73fc0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f000079a000)="16", 0x1}]) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x8, 0x60002) ioctl$ASHMEM_GET_PIN_STATUS(r3, 0x7709, 0x0) 07:12:58 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x20600, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000100)='bridge_slave_1\x00') syz_emit_ethernet(0x26, &(0x7f0000000040)=ANY=[@ANYBLOB="013024825800ffffffffa2a108004500002800000000119078ac0314bbac1414bb00000000aa2b578d3a9aa7e21c4982a459ddbbb781f15f820000000063134c69f6e2739498873220d872dec6b7c3bdbbd24f", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], &(0x7f0000000000)) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000140)={0x0, @remote, @multicast2}, &(0x7f0000000180)=0xc) 07:12:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@ipv6_newroute={0x1b, 0x48, 0x23, 0x0, 0x0, {0xa}}, 0x1c}, 0x1}, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/uinput\x00', 0x280080, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000440)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000003c0)={r2, 0x6}, &(0x7f0000000400)=0x8) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='net/raw\x00') r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) pwrite64(r4, &(0x7f0000000000)="c25495189bb687f3a3f5ccb949e59364ce83bdb2d0198fdbc0a9052f8f535cbb9ed28495e5cbdfbdd85cb7c048038a1f306e162d8323b7e20c98858a9f2a0529b4298336d848af53a23418b6f93e075c60aed10411d486e8cbf6fe76dd8b8a8fb5620934e792e466fdfefb90f4cf1e01907f648cb3014b1db020ef08468e707b4868c17591feaaebf0e62d71f4d67a855e2e9e8222ebc31fbb49d3d75d6db09aae2ca7edc3de37a09959668f8d26ad05f65099d1ec845fa1c6e122e682b601aa5a006d5d17996e2a720ee0c1e690f2de36d9a53125083484dff1a3c1e73fc4261806", 0xe2, 0x0) preadv(r3, &(0x7f0000000380)=[{&(0x7f00000002c0)=""/139, 0x8b}], 0x0, 0x0) 07:12:58 executing program 2 (fault-call:8 fault-nth:0): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:12:58 executing program 7 (fault-call:2 fault-nth:69): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 220.902264] binder: release 12986:12991 transaction 310 out, still active [ 220.909279] binder: unexpected work type, 4, not freed [ 220.914588] binder: undelivered TRANSACTION_COMPLETE [ 220.921444] binder: invalid inc weak node for 311 [ 220.924700] FAULT_INJECTION: forcing a failure. [ 220.924700] name failslab, interval 1, probability 0, space 0, times 0 [ 220.926380] binder: 12986:12991 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 220.937590] CPU: 0 PID: 12990 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 220.953753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 220.963108] Call Trace: [ 220.965706] dump_stack+0x1c9/0x2b4 [ 220.969337] ? dump_stack_print_info.cold.2+0x52/0x52 [ 220.974538] ? __kernel_text_address+0xd/0x40 [ 220.979040] ? unwind_get_return_address+0x61/0xa0 [ 220.980687] binder: send failed reply for transaction 310, target dead [ 220.983974] should_fail.cold.4+0xa/0x11 [ 220.983992] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 220.984013] ? save_stack+0xa9/0xd0 [ 221.003386] ? save_stack+0x43/0xd0 [ 221.006996] ? kasan_kmalloc+0xc4/0xe0 [ 221.010865] ? kmem_cache_alloc_trace+0x152/0x780 [ 221.015700] ? __memcg_init_list_lru_node+0x185/0x2d0 [ 221.020881] ? __list_lru_init+0x4d6/0x840 [ 221.025098] ? alloc_super+0x9a6/0xb10 [ 221.028969] ? sget+0x10b/0x150 [ 221.032231] ? mount_bdev+0x115/0x3e0 [ 221.036109] ? msdos_mount+0x3c/0x50 [ 221.039805] ? legacy_get_tree+0x118/0x440 [ 221.044022] ? vfs_get_tree+0x1cb/0x5c0 [ 221.047977] ? do_mount+0x6c1/0x1fb0 [ 221.051674] ? ksys_mount+0x12d/0x140 [ 221.055468] ? __x64_sys_mount+0xbe/0x150 [ 221.059601] ? do_syscall_64+0x1b9/0x820 [ 221.063645] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 221.069006] ? save_stack+0xa9/0xd0 [ 221.072646] ? lock_acquire+0x1e4/0x540 [ 221.076612] ? fs_reclaim_acquire+0x20/0x20 [ 221.080924] ? lock_downgrade+0x8f0/0x8f0 [ 221.085052] ? do_mount+0x6c1/0x1fb0 [ 221.088752] ? check_same_owner+0x340/0x340 [ 221.093057] ? rcu_note_context_switch+0x730/0x730 [ 221.097972] __should_failslab+0x124/0x180 [ 221.102190] should_failslab+0x9/0x14 [ 221.105980] kmem_cache_alloc_trace+0x2cb/0x780 [ 221.110643] ? kasan_kmalloc+0xc4/0xe0 [ 221.114525] __memcg_init_list_lru_node+0x185/0x2d0 [ 221.119531] ? kvfree_rcu+0x20/0x20 [ 221.123142] ? __kmalloc_node+0x47/0x70 [ 221.127101] __list_lru_init+0x4d6/0x840 [ 221.131147] ? list_lru_destroy+0x500/0x500 [ 221.135453] ? prealloc_shrinker+0x213/0x480 [ 221.139841] ? __init_waitqueue_head+0x9e/0x150 [ 221.144494] ? inactive_list_is_low+0x850/0x850 [ 221.149148] ? __lockdep_init_map+0x105/0x590 [ 221.153638] alloc_super+0x9a6/0xb10 [ 221.157356] ? destroy_unused_super.part.11+0x110/0x110 [ 221.162711] ? lock_downgrade+0x8f0/0x8f0 [ 221.166854] ? kasan_check_read+0x11/0x20 [ 221.170985] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 221.175556] ? kasan_check_write+0x14/0x20 [ 221.179782] ? do_raw_spin_lock+0xc1/0x200 [ 221.184000] sget_userns+0x276/0x860 [ 221.187698] ? kill_litter_super+0x60/0x60 [ 221.191917] ? test_single_super+0x10/0x10 [ 221.196160] ? vfs_get_super+0x270/0x270 [ 221.200202] ? kasan_check_read+0x11/0x20 [ 221.204336] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 221.208901] ? kasan_check_write+0x14/0x20 [ 221.213118] ? do_raw_spin_lock+0xc1/0x200 [ 221.217344] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.222863] ? ns_capable_common+0x13f/0x170 [ 221.227266] ? kill_litter_super+0x60/0x60 [ 221.231483] sget+0x10b/0x150 [ 221.234574] ? test_single_super+0x10/0x10 [ 221.238805] mount_bdev+0x115/0x3e0 [ 221.242425] ? msdos_mount+0x50/0x50 [ 221.246123] msdos_mount+0x3c/0x50 [ 221.249653] ? setup+0xe0/0xe0 [ 221.252831] legacy_get_tree+0x118/0x440 [ 221.256877] vfs_get_tree+0x1cb/0x5c0 [ 221.260660] ? vfs_set_fs_source+0x12c/0x180 [ 221.265052] do_mount+0x6c1/0x1fb0 [ 221.268573] ? check_same_owner+0x340/0x340 [ 221.272877] ? lock_release+0xa30/0xa30 [ 221.276837] ? copy_mount_string+0x40/0x40 [ 221.281054] ? kasan_kmalloc+0xc4/0xe0 [ 221.284924] ? kmem_cache_alloc_trace+0x318/0x780 [ 221.289759] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 221.295281] ? _copy_from_user+0xdf/0x150 [ 221.299416] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.304937] ? copy_mount_options+0x285/0x380 [ 221.309415] ksys_mount+0x12d/0x140 [ 221.313028] __x64_sys_mount+0xbe/0x150 [ 221.316988] do_syscall_64+0x1b9/0x820 [ 221.320858] ? finish_task_switch+0x1d3/0x870 [ 221.325335] ? syscall_return_slowpath+0x5e0/0x5e0 [ 221.330245] ? syscall_return_slowpath+0x31d/0x5e0 [ 221.335158] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 221.340159] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.345683] ? prepare_exit_to_usermode+0x291/0x3b0 [ 221.350694] ? perf_trace_sys_enter+0xb10/0xb10 [ 221.355345] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 221.360173] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 221.365341] RIP: 0033:0x4584ea [ 221.368506] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 221.387853] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 221.395550] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 221.402799] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 221.410060] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 221.417310] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 221.424563] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000045 07:12:58 executing program 1: r0 = syz_open_dev$dmmidi(&(0x7f0000004800)='/dev/dmmidi#\x00', 0x3797, 0xc4000) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000004840)={&(0x7f00000047c0)='./file0\x00', r0}, 0x10) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000840)='/dev/uinput\x00', 0x20000, 0x0) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000004780)={0x303, 0x33}, 0x4) openat$md(0xffffffffffffff9c, &(0x7f0000000200)='/dev/md0\x00', 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000004900)='/dev/vcs#\x00', 0x6, 0x202800) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) recvmmsg(0xffffffffffffff9c, &(0x7f00000045c0)=[{{&(0x7f0000000040)=@pptp={0x0, 0x0, {0x0, @local}}, 0x80, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/131, 0x83}, {&(0x7f0000000180)=""/60, 0x3c}, {&(0x7f0000000240)=""/254, 0xfe}], 0x3, &(0x7f0000000340)=""/186, 0xba, 0x100}, 0x1}, {{&(0x7f0000000400)=@ipx, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000480)=""/42, 0x2a}], 0x1, &(0x7f0000000500)=""/134, 0x86, 0x101}, 0x77c0}, {{&(0x7f00000005c0)=@nfc, 0x80, &(0x7f0000000880)=[{&(0x7f0000000640)=""/143, 0x8f}, {&(0x7f0000000700)=""/33, 0x21}, {&(0x7f0000000740)=""/3, 0x3}, {&(0x7f0000000780)=""/183, 0xb7}, {&(0x7f0000000840)}], 0x5, &(0x7f0000000900)=""/224, 0xe0, 0x1000}, 0x9}, {{&(0x7f0000000a00)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001b40)=[{&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/59, 0x3b}, {&(0x7f0000001ac0)=""/69, 0x45}], 0x3, &(0x7f0000001b80)=""/4096, 0x1000, 0x100000001}, 0x3}, {{&(0x7f0000002b80)=@can={0x0, 0x0}, 0x80, &(0x7f0000002e00)=[{&(0x7f0000002c00)=""/66, 0x42}, {&(0x7f0000002c80)=""/188, 0xbc}, {&(0x7f0000002d40)=""/185, 0xb9}], 0x3, &(0x7f0000002e40)=""/116, 0x74, 0xb03}, 0x1000}, {{&(0x7f0000002ec0)=@sco, 0x80, &(0x7f0000004440)=[{&(0x7f0000002f40)=""/71, 0x47}, {&(0x7f0000002fc0)=""/206, 0xce}, {&(0x7f00000030c0)=""/30, 0x1e}, {&(0x7f0000003100)=""/91, 0x5b}, {&(0x7f0000003180)=""/4096, 0x1000}, {&(0x7f0000004180)=""/117, 0x75}, {&(0x7f0000004200)=""/165, 0xa5}, {&(0x7f00000042c0)=""/52, 0x34}, {&(0x7f0000004300)=""/29, 0x1d}, {&(0x7f0000004340)=""/239, 0xef}], 0xa, &(0x7f0000004500)=""/148, 0x94, 0x20}, 0x5}], 0x6, 0x20, &(0x7f0000004740)) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000004880)={@remote={0xfe, 0x80, [], 0xbb}, @loopback={0x0, 0x1}, @mcast2={0xff, 0x2, [], 0x1}, 0x4, 0x44, 0x8, 0x100, 0x2, 0x180010b, r3}) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000004940)=0x0) fcntl$setown(r2, 0x8, r4) 07:12:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getpeername(r0, &(0x7f0000000480)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000500)=0x80) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000540)={@ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, r1}, 0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0xffffffff, 0x800) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f00000001c0)='./file0\x00', 0x3, 0x2, &(0x7f0000000380)=[{&(0x7f0000000200)="f8af80410ec6486ee3956b0e9e391c21fa1c60bae13c1f4cf4e8c5c6ea2aace6634638093858fca56e4aaf80f775e301b0aa2258d39dcd5aea7da85d8b7452797abc461be170b451c5aaedc6c6231255f388c62286303b284ddbf021a6", 0x5d, 0x401}, {&(0x7f00000002c0)="d3b92c08e298409d5ed4b4d9cda6195fb7114dbacadb7319d6d1ba21a2b9de16d026dbe54818b684b5debef617d646cd0ffc8e882943469b541f518ef5fa1d6c1e5b57a4277d96169f435c44e792727b8590b60c021f7cc348e7c8939856032710783812410682567a904f5b7247faba6413ada5e0ae47690dbf923e839b42fd5edc877b028abb9d8746bb80735a31239cf87cb84ed86e093004e4d9a6340a1bb237c2771c98e85b2f5ca31d41b20b613e34", 0xb2, 0x8}], 0x1, &(0x7f00000003c0)=ANY=[@ANYBLOB="6e6f646f74732c040074732c00"]) ioctl$SG_GET_ACCESS_COUNT(r4, 0x2289, &(0x7f0000000100)) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f0000000400), &(0x7f0000000440)=0x40) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f00000000c0)=0x4b, 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000580)=0xc) sendmmsg(r3, &(0x7f00000009c0)=[{{0x0, 0x0, &(0x7f00000002c0), 0x59, &(0x7f0000000300)}}, {{0x0, 0x0, &(0x7f0000000680), 0x59, &(0x7f00000006c0)}}], 0x2b9, 0x0) 07:12:58 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:12:58 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x4e20, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f0000000000)="c6", 0x1, 0x0, &(0x7f0000033ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x74, &(0x7f0000000080)={0x0, 0x0, 0x30}, &(0x7f0000000040)=0x18) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, &(0x7f00000000c0)=0x1e, 0x4) 07:12:58 executing program 7 (fault-call:2 fault-nth:70): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:12:58 executing program 6: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f000045fff8)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = open(&(0x7f0000000080)='./file0\x00', 0x40000, 0x50) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)={0x0, @remote, @multicast1}, &(0x7f0000000240)=0xc) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000002c0)=0x14, 0x80000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in=@rand_addr, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000400)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0}, &(0x7f0000000480)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000500)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000540)={{{@in=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}}}, &(0x7f0000000640)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f00000006c0)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000840)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000940)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000000a40)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000a80)={{{@in=@rand_addr, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000b80)=0xe8) getpeername$packet(r0, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000d80)=0x14) accept$packet(0xffffffffffffffff, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000e00)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000012c0)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@remote}}, &(0x7f00000013c0)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000001400)={@dev, @rand_addr, 0x0}, &(0x7f0000001440)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000014c0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002a40)={{{@in=@rand_addr, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000002b40)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000002c40)={{{@in=@broadcast, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f0000002d40)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000002e40)={'ipddp0\x00', 0x0}) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000002e80)={@ipv4={[], [], @broadcast}, 0x0}, &(0x7f0000002ec0)=0x14) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000003600)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000035c0)={&(0x7f0000003640)=ANY=[@ANYBLOB="a8060000", @ANYRES16=r3, @ANYBLOB="08002dbd7040fedbdf25000000000000000084f24b4f6fb13b56b53013faf4473c760d6a43e398b2249c041f263a4d8f7b2cd81755cb965027524231b763a98be3f86d88f5b7d3d85c85b9e03590ec2d1522a6e3b40171953b4a8a5fc19a878e9d5d0b84956ad3782db4cb903589197245a8665ce57930f15eaf0b69a14c949accc169b03f1eb796fd899c37bff29ea134f26019bf916a0f730415186ea9a84fc1cb3fe5e2f7032dde550cc36dc60e19a1a24381d707c646ddb905db5719f575a658ab3daecf899a01ed3c2dabc4487c02cf89709bbf28ae564fe1", @ANYRES32=r4, @ANYBLOB="bc0002003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r5, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000600000008000600", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r8, @ANYRESOCT, @ANYRES32=r9, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES64=r18, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="400002003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r11, @ANYBLOB="08000100", @ANYBLOB="4e302c444a07cfcc727acf00962444ff79498a16b2f257bf64fde758e11149b265326cd741145f05799ef0275ccc3af2f1084817104d9ab2c6bb4d20a7ff91dd6691ffe5b52563386f5a78b42f12edfb08336b53177f753d9e9a4f3d7213445e3f073518c39a4db3382e97dfe2df5eb0041bda21966d4e797f91e593b9c736cc0bbfaa08fd595096e2", @ANYBLOB="7002020040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000600000008000600", @ANYRES32=r12, @ANYBLOB="4c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e67000000006c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000003c000400930dc8090500000001ff0009000000800000ff0100000000c50a0207ff7f0000bd63861801000000ff0f0105840c00000700ff0706000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000600000008000600", @ANYRES32=r13, @ANYBLOB="74000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b000000440004000900a00808000000ff000806ce0d00000600ff01050000004000040505000000311e060800010000bc5209b0030000000500810109000000090004050000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040006000000080007000000000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r14, @ANYBLOB="0800070000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000300000008000600", @ANYRES32=r15, @ANYBLOB="08000100", @ANYRES32=r16, @ANYBLOB="9800020054000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000024000400030000082c0b00000300f8070600000080008105050000000100070000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000400000008000600", @ANYRES32=r17, @ANYBLOB="08000100", @ANYRES32=r18, @ANYBLOB="7401020038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000900000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400fcffffff080007000000000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b00000008000400b2f7000008000600", @ANYRES32=r19, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000000008040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040000f0ffff080007000000000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r20, @ANYBLOB='\b\x00\a\x00\x00\x00\x00\x00'], 0x29}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) ioprio_get$pid(0x1, r1) r21 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x20200, 0x0) ioctl$TCGETS(r21, 0x5401, &(0x7f0000000040)) ptrace(0x4207, r1) tgkill(r1, r1, 0x12) ptrace(0x4208, r1) [ 221.601629] binder: release 13018:13021 transaction 314 out, still active [ 221.608651] binder: unexpected work type, 4, not freed [ 221.613963] binder: undelivered TRANSACTION_COMPLETE [ 221.622236] FAULT_INJECTION: forcing a failure. [ 221.622236] name failslab, interval 1, probability 0, space 0, times 0 [ 221.630255] binder: invalid inc weak node for 315 [ 221.633490] CPU: 0 PID: 13019 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 221.633507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 221.638374] binder: 13018:13021 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 221.646714] Call Trace: [ 221.646739] dump_stack+0x1c9/0x2b4 [ 221.646757] ? dump_stack_print_info.cold.2+0x52/0x52 [ 221.675151] ? __kernel_text_address+0xd/0x40 [ 221.679650] ? unwind_get_return_address+0x61/0xa0 [ 221.681781] binder: send failed reply for transaction 314, target dead [ 221.684583] should_fail.cold.4+0xa/0x11 [ 221.684601] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 221.684620] ? save_stack+0xa9/0xd0 [ 221.684636] ? save_stack+0x43/0xd0 [ 221.707590] ? kasan_kmalloc+0xc4/0xe0 [ 221.711466] ? kmem_cache_alloc_trace+0x152/0x780 [ 221.716288] ? __memcg_init_list_lru_node+0x185/0x2d0 [ 221.721457] ? __list_lru_init+0x4d6/0x840 [ 221.725674] ? alloc_super+0x9a6/0xb10 [ 221.729543] ? sget+0x10b/0x150 [ 221.732803] ? mount_bdev+0x115/0x3e0 [ 221.736587] ? msdos_mount+0x3c/0x50 [ 221.740462] ? legacy_get_tree+0x118/0x440 [ 221.744679] ? vfs_get_tree+0x1cb/0x5c0 [ 221.748640] ? do_mount+0x6c1/0x1fb0 [ 221.752337] ? ksys_mount+0x12d/0x140 [ 221.756117] ? __x64_sys_mount+0xbe/0x150 [ 221.760247] ? do_syscall_64+0x1b9/0x820 [ 221.764291] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 221.769652] ? save_stack+0xa9/0xd0 [ 221.773261] ? lock_acquire+0x1e4/0x540 [ 221.777220] ? fs_reclaim_acquire+0x20/0x20 [ 221.781522] ? lock_downgrade+0x8f0/0x8f0 [ 221.785652] ? do_mount+0x6c1/0x1fb0 [ 221.789354] ? check_same_owner+0x340/0x340 [ 221.793658] ? rcu_note_context_switch+0x730/0x730 [ 221.798573] __should_failslab+0x124/0x180 [ 221.802798] should_failslab+0x9/0x14 [ 221.806583] kmem_cache_alloc_trace+0x2cb/0x780 [ 221.811238] ? kasan_kmalloc+0xc4/0xe0 [ 221.815111] __memcg_init_list_lru_node+0x185/0x2d0 [ 221.820110] ? kvfree_rcu+0x20/0x20 [ 221.823720] ? __kmalloc_node+0x47/0x70 [ 221.827686] __list_lru_init+0x4d6/0x840 [ 221.831736] ? list_lru_destroy+0x500/0x500 [ 221.836043] ? prealloc_shrinker+0x213/0x480 [ 221.840439] ? __init_waitqueue_head+0x9e/0x150 [ 221.845092] ? inactive_list_is_low+0x850/0x850 [ 221.849750] ? __lockdep_init_map+0x105/0x590 [ 221.854231] alloc_super+0x9a6/0xb10 [ 221.857931] ? destroy_unused_super.part.11+0x110/0x110 [ 221.863278] ? lock_downgrade+0x8f0/0x8f0 [ 221.867410] ? kasan_check_read+0x11/0x20 [ 221.871539] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 221.876105] ? kasan_check_write+0x14/0x20 [ 221.880324] ? do_raw_spin_lock+0xc1/0x200 [ 221.884563] sget_userns+0x276/0x860 [ 221.888257] ? kill_litter_super+0x60/0x60 [ 221.892477] ? test_single_super+0x10/0x10 [ 221.896695] ? vfs_get_super+0x270/0x270 [ 221.900738] ? kasan_check_read+0x11/0x20 [ 221.904867] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 221.909431] ? kasan_check_write+0x14/0x20 [ 221.913658] ? do_raw_spin_lock+0xc1/0x200 [ 221.917894] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.923418] ? ns_capable_common+0x13f/0x170 [ 221.927807] ? kill_litter_super+0x60/0x60 [ 221.932023] sget+0x10b/0x150 [ 221.935110] ? test_single_super+0x10/0x10 [ 221.939332] mount_bdev+0x115/0x3e0 [ 221.942940] ? msdos_mount+0x50/0x50 [ 221.946637] msdos_mount+0x3c/0x50 [ 221.950159] ? setup+0xe0/0xe0 [ 221.953336] legacy_get_tree+0x118/0x440 [ 221.957383] vfs_get_tree+0x1cb/0x5c0 [ 221.961165] ? vfs_set_fs_source+0x12c/0x180 [ 221.965555] do_mount+0x6c1/0x1fb0 [ 221.969078] ? kasan_check_write+0x14/0x20 [ 221.973300] ? copy_mount_string+0x40/0x40 [ 221.977521] ? retint_kernel+0x10/0x10 [ 221.981395] ? __sanitizer_cov_trace_const_cmp8+0x1/0x20 [ 221.986840] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.992358] ? copy_mount_options+0x285/0x380 [ 221.996844] ksys_mount+0x12d/0x140 [ 222.000457] __x64_sys_mount+0xbe/0x150 [ 222.004427] do_syscall_64+0x1b9/0x820 [ 222.008299] ? finish_task_switch+0x1d3/0x870 [ 222.012777] ? syscall_return_slowpath+0x5e0/0x5e0 [ 222.017688] ? syscall_return_slowpath+0x31d/0x5e0 [ 222.022604] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 222.027604] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.033122] ? prepare_exit_to_usermode+0x291/0x3b0 [ 222.038120] ? perf_trace_sys_enter+0xb10/0xb10 [ 222.042776] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 222.047605] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 222.052778] RIP: 0033:0x4584ea [ 222.055943] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 222.075111] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 222.082801] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 222.090053] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 07:12:59 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = mq_open(&(0x7f0000000100)=']vboxnet1GPL#^{\x00', 0x40, 0x59, &(0x7f0000000140)={0x80000001, 0x1, 0xff, 0x4, 0x2, 0xe23a0000, 0xbb98, 0x62}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000240)={@loopback, @empty, 0x0}, &(0x7f0000000280)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@multicast1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f00000003c0)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000500)={{{@in, @in=@dev={0xac, 0x14, 0x14, 0x21}, 0x4e23, 0x0, 0x4e20, 0x3, 0x2, 0x0, 0xa0, 0xae, r3, r4}, {0x7fffffff, 0x4, 0x80000001, 0x9, 0x80000000, 0x7, 0x8, 0x6}, {0x4462, 0x100000000, 0x5, 0x3}, 0x834, 0x6e6bb4, 0x2, 0x1, 0x1}, {{@in=@local={0xac, 0x14, 0x14, 0xaa}, 0x80000000}, 0x2, @in6=@loopback={0x0, 0x1}, 0x0, 0x6, 0x3, 0x5, 0x200, 0xb, 0xfffffffffffff801}}, 0xe8) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000400)={{{@in, @in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x4e21, 0x0, 0x4e24, 0x0, 0x0, 0x80, 0xa0, 0x2f, r3, r4}, {0x1000, 0x3, 0x6, 0x1, 0xfffffffffffffbff, 0x1f, 0x6, 0x85e}, {0x2, 0x1, 0x6, 0x8d7}, 0x100, 0x6e6bbb, 0x1, 0x1, 0x2, 0x1}, {{@in=@loopback=0x7f000001, 0x4d6, 0xff}, 0x2, @in6, 0x3502, 0x3, 0x0, 0xd98c, 0x5, 0x8, 0x9}}, 0xe8) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)=ANY=[@ANYBLOB="cf0000005d00fff2e0100000000800000012114b36f8ed1688050000000000000005000000400000f50600000000000020"]) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x1a3700, 0x0) r6 = accept(r5, &(0x7f00000001c0)=@vsock, &(0x7f00000000c0)=0x80) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r6, 0x84, 0x1b, &(0x7f0000000680)={0x0, 0x31, "71c7ee943ab96b49f3ccc9cd9cdbbac1b2d01052713e9b53bc8c8ea5ca4e4646da1fc5b7c03dbd5ddb7644dfa61e2c7284"}, &(0x7f00000006c0)=0x39) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000700)=@assoc_id=r7, &(0x7f0000000740)=0x4) getsockname$inet(r5, &(0x7f0000000040)={0x0, 0x0, @multicast1}, &(0x7f0000000080)=0x10) [ 222.097302] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 222.104551] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 222.111805] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000046 [ 222.120300] FAT-fs (loop5): Unrecognized mount option "" or missing value [ 222.179115] FAT-fs (loop5): Unrecognized mount option "" or missing value 07:13:00 executing program 3: clock_gettime(0x4, &(0x7f0000000100)) r0 = syz_open_dev$dmmidi(&(0x7f0000000280)='/dev/dmmidi#\x00', 0x9, 0x200000) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000002c0)={@mcast2, 0x0}, &(0x7f0000000300)=0x14) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000340)={r1, 0x1, 0x6, @random="c67bec9aa5df"}, 0x10) kexec_load(0x4996, 0x1, &(0x7f0000000140)=[{&(0x7f0000000000)="4323c2c0ae12bdaa38a3e44e7bb51a69b311be027998166e84119f3c1cfc00db047d35c2b90eedcfd8b24461c4149ffd32c6475de1986819bcd0d6dea075c164187c30269e04b25b25804021a8084c6c96dbc8a844433ac76b131f831ffbef2f9bde59195a61987ae01fb486396d21033e86f7cc067a096fdffce33cc76d288bf4fbbce68be29d9fc4c0fa803a0e5c7674ac7e29062c7886ce1d0babc2dd176c8f1d7b08bf68b3344b33924d4df1b05747d2e288afab93f99dbbafbefbc62007180248a89e8f10fa56c1cf6ba7589f66141467962b7774e79156fa34ba30ebdcd688836d3ed3", 0xe6, 0xffffffffffffff41, 0xc4e}], 0x370000) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='system]userGPL\x00'}, 0x10) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r2, 0x4040534e, &(0x7f0000000200)={0x22, @tick=0x5, 0x37a, {0x40, 0x6}, 0x1, 0x1, 0x7fffffff}) 07:13:00 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5450, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:00 executing program 7 (fault-call:2 fault-nth:71): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:00 executing program 6: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) fcntl$setflags(r1, 0x2, 0x1) 07:13:00 executing program 1: modify_ldt$write(0x1, &(0x7f00007a7ff0)={0xd1f}, 0x10) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f00000000c0)=0x1ff) socketpair(0x0, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) prctl$getreaper(0x1b, &(0x7f0000000000)) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000001c0)=@nat={'nat\x00', 0x1b, 0x5, 0x6a0, 0x110, 0x0, 0x0, 0x110, 0x0, 0x5d0, 0x5d0, 0x5d0, 0x5d0, 0x5d0, 0x5, &(0x7f0000000140), {[{{@ipv6={@local={0xfe, 0x80, [], 0xaa}, @dev={0xfe, 0x80, [], 0x1e}, [0xffffffff, 0xff, 0xffffffff], [0xff, 0xffffffff, 0xffffffff, 0xffffff00], 'bond_slave_1\x00', 'teql0\x00', {0xff}, {0xff}, 0x3c, 0x7, 0x3, 0x20}, 0x0, 0xc8, 0x110}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, @ipv6=@mcast2={0xff, 0x2, [], 0x1}, @port=0x4e20, @port=0x4e20}}}, {{@uncond, 0x0, 0x120, 0x168, 0x0, {}, [@common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x20, 0x89, 0x1}}, @common=@frag={0x30, 'frag\x00', 0x0, {0x8, 0x7, 0x0, 0x3a, 0x3}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x10, @ipv4=@dev={0xac, 0x14, 0x14, 0xa}, @ipv6=@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, @gre_key=0xffffffff, @port=0x4e20}}}, {{@uncond, 0x0, 0x200, 0x248, 0x0, {}, [@common=@rt={0x138, 'rt\x00', 0x0, {0xb0a, 0xfff, 0x3, 0x8000, 0xd, 0x0, [@mcast2={0xff, 0x2, [], 0x1}, @dev={0xfe, 0x80, [], 0x14}, @loopback={0x0, 0x1}, @dev={0xfe, 0x80, [], 0xe}, @empty, @local={0xfe, 0x80, [], 0xaa}, @empty, @empty, @dev={0xfe, 0x80, [], 0xb}, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, @ipv4={[], [0xff, 0xff], @rand_addr=0xcd}, @local={0xfe, 0x80, [], 0xaa}, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}]}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x10, @ipv6=@mcast2={0xff, 0x2, [], 0x1}, @ipv6, @icmp_id=0x66, @gre_key=0x2}}}, {{@ipv6={@local={0xfe, 0x80, [], 0xaa}, @mcast1={0xff, 0x1, [], 0x1}, [0xff, 0xff, 0xff0000ff, 0xffffffff], [0xffffff00, 0xffffffff, 0xff, 0xffffffff], 'bcsh0\x00', 'ip6tnl0\x00', {0xff}, {}, 0x33, 0x0, 0x4, 0x9}, 0x0, 0xc8, 0x110}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}, @port=0x4e24, @gre_key=0xd5}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x700) modify_ldt$write2(0x11, &(0x7f0000000100), 0x10) modify_ldt$write(0x1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x4da2, 0x0, 0x0, 0x1000000000000000, 0x0, 0x3}, 0xfffffffffffffeba) 07:13:00 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:00 executing program 5: perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x20, 0xffffffffffffffff, 0x4) r0 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0xa7c7, 0x100) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 07:13:00 executing program 0: r0 = socket$l2tp(0x18, 0x1, 0x1) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x8000, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) io_setup(0x1, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f0000000840)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f0000000100)}]) [ 223.245175] binder: release 13058:13059 transaction 318 out, still active [ 223.252216] binder: unexpected work type, 4, not freed [ 223.257521] binder: undelivered TRANSACTION_COMPLETE [ 223.261693] FAULT_INJECTION: forcing a failure. [ 223.261693] name failslab, interval 1, probability 0, space 0, times 0 [ 223.273979] CPU: 0 PID: 13073 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 223.282384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 223.291734] Call Trace: 07:13:00 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000005480)='./file0\x00', &(0x7f0000000880)='./file0\x00', &(0x7f0000005440)='hugetlbfs\x00', 0x0, &(0x7f0000001d80)) chdir(&(0x7f0000000000)='./file0\x00') mknod(&(0x7f00000000c0)='./file0\x00', 0xffffc002, 0x0) 07:13:00 executing program 1: socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup3(r0, 0xffffffffffffff9c, 0x7fffe) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000000)=0xffffffffffff7bf0, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000062c0)={0xf, 0x5, &(0x7f00000001c0)=@framed={{0x18}, [@map={0x18, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x1810}], {0x95}}, &(0x7f0000000240)='GPL\x00', 0x3, 0x1000, &(0x7f0000000280)=""/4096}, 0x48) 07:13:00 executing program 5: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0xfffffffffffffbff, 0x30}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000240)={r2, @in={{0x2, 0x4e20, @multicast2=0xe0000002}}, 0x80, 0x7, 0x7, 0x80000000, 0x2}, &(0x7f0000000140)=0x98) connect(r0, &(0x7f0000002000)=@ethernet, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000006000)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1d, r3}, 0x10, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="958e000000000000000000000000000000000000"], 0x48}, 0x1}, 0x0) [ 223.294329] dump_stack+0x1c9/0x2b4 [ 223.297968] ? dump_stack_print_info.cold.2+0x52/0x52 [ 223.303168] ? alloc_page_buffers+0x1cd/0x680 [ 223.307766] should_fail.cold.4+0xa/0x11 [ 223.311832] ? ksys_mount+0x12d/0x140 [ 223.315669] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 223.320780] ? lock_downgrade+0x8f0/0x8f0 [ 223.324933] ? lock_release+0xa30/0xa30 [ 223.327414] binder_alloc: binder_alloc_mmap_handler: 13058 20001000-20004000 already mapped failed -16 [ 223.328908] ? memcg_kmem_get_cache+0x3a9/0x9d0 07:13:00 executing program 1: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000140)={{{@in=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f00000000c0)=0xe8) r1 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000380)={{{@in, @in=@rand_addr}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000000100)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xe, &(0x7f0000001000)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x6426bba42bbf553d, [], r0}, 0x3c5) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000280)={{{@in6=@loopback, @in=@dev}}, {{@in=@local}, 0x0, @in6}}, &(0x7f0000000080)=0xe8) 07:13:00 executing program 6: unshare(0x64000400) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) socketpair$inet(0x2, 0x8000f, 0xc54, &(0x7f0000000000)) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000040)={r2, 0x0, 0x2, r2}) [ 223.328927] ? mem_cgroup_handle_over_high+0x130/0x130 [ 223.328949] ? lock_acquire+0x1e4/0x540 [ 223.352253] ? __find_get_block+0x79b/0xe60 [ 223.356580] ? lock_downgrade+0x8f0/0x8f0 [ 223.360737] ? kasan_check_write+0x14/0x20 [ 223.364971] ? __brelse+0x104/0x180 [ 223.368598] ? block_commit_write+0x30/0x30 [ 223.372920] ? do_raw_spin_lock+0xc1/0x200 [ 223.377170] ? __find_get_block+0x36d/0xe60 [ 223.381505] __should_failslab+0x124/0x180 [ 223.385745] should_failslab+0x9/0x14 [ 223.385749] binder: BINDER_SET_CONTEXT_MGR already set 07:13:00 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000140)) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/nullb0\x00', 0x200000, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r1) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r2, 0xc10c5541, &(0x7f0000000200)={0x1, 0xffffffff, 0xffffffffffff8001, 0x0, 0x0, [], [], [], 0xfffffffffffffe00, 0x7}) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000100)={0x401, 0xd14}) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000000)={0x0, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x8c) 07:13:00 executing program 1: r0 = socket$inet(0x2, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_int(r0, 0x0, 0x5, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_int(r0, 0x0, 0xc8, &(0x7f0000000080), 0x4) listen(r0, 0x7fffffff) [ 223.385767] binder: 13058:13059 ioctl 40046207 0 returned -16 [ 223.389541] kmem_cache_alloc+0x47/0x760 [ 223.389557] ? rcu_note_context_switch+0x730/0x730 [ 223.389572] ? wake_up_page_bit+0x5b0/0x5b0 [ 223.389593] ? mempool_free+0x370/0x370 [ 223.417874] binder_alloc: 13058: binder_alloc_buf, no vma [ 223.417926] mempool_alloc_slab+0x44/0x60 [ 223.423504] binder: 13058:13081 transaction failed 29189/-3, size 24-8 line 2967 [ 223.427585] mempool_alloc+0x193/0x4b0 [ 223.427604] ? mempool_destroy+0x30/0x30 [ 223.443034] ? __find_get_block+0xe60/0xe60 [ 223.447365] bio_alloc_bioset+0x3a8/0x700 [ 223.451508] ? bvec_alloc+0x2d0/0x2d0 [ 223.455329] ? check_same_owner+0x340/0x340 [ 223.459645] submit_bh_wbc+0x14b/0x790 [ 223.463526] ? vfat_rename.cold.16+0x78/0x78 [ 223.467920] __bread_gfp+0x13f/0x310 [ 223.471620] fat_fill_super+0x353/0x4400 [ 223.475668] ? netdev_bits+0xb0/0xb0 [ 223.479368] ? format_decode+0x1b1/0xaf0 [ 223.483428] ? fat_flush_inodes+0x1a0/0x1a0 [ 223.487741] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 223.493263] ? vsnprintf+0x20d/0x1b60 [ 223.497050] ? pointer+0x990/0x990 [ 223.500583] ? snprintf+0xae/0xe0 [ 223.504024] ? vsprintf+0x40/0x40 [ 223.507463] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 223.512474] ? set_blocksize+0x2c1/0x340 [ 223.516526] msdos_fill_super+0x2e/0x40 [ 223.520491] mount_bdev+0x314/0x3e0 [ 223.524102] ? msdos_mount+0x50/0x50 [ 223.527812] msdos_mount+0x3c/0x50 [ 223.531337] ? setup+0xe0/0xe0 [ 223.534517] legacy_get_tree+0x118/0x440 [ 223.538567] vfs_get_tree+0x1cb/0x5c0 [ 223.542349] ? vfs_set_fs_source+0x12c/0x180 [ 223.546748] do_mount+0x6c1/0x1fb0 [ 223.550274] ? check_same_owner+0x340/0x340 [ 223.554593] ? lock_release+0xa30/0xa30 [ 223.558558] ? copy_mount_string+0x40/0x40 [ 223.562780] ? kasan_kmalloc+0xc4/0xe0 [ 223.566665] ? kmem_cache_alloc_trace+0x318/0x780 [ 223.571497] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 223.577035] ? _copy_from_user+0xdf/0x150 [ 223.581171] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 223.586695] ? copy_mount_options+0x285/0x380 [ 223.591179] ksys_mount+0x12d/0x140 [ 223.594798] __x64_sys_mount+0xbe/0x150 [ 223.598759] do_syscall_64+0x1b9/0x820 [ 223.602632] ? syscall_slow_exit_work+0x500/0x500 [ 223.607482] ? syscall_return_slowpath+0x5e0/0x5e0 [ 223.612399] ? syscall_return_slowpath+0x31d/0x5e0 [ 223.617316] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 223.622837] ? prepare_exit_to_usermode+0x291/0x3b0 [ 223.627838] ? perf_trace_sys_enter+0xb10/0xb10 [ 223.632505] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 223.637338] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 223.642514] RIP: 0033:0x4584ea [ 223.645693] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 223.664973] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 223.672678] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 223.679931] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 223.687185] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 07:13:00 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0xf, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x7, 0x2000) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000100)={0x0, 0x70, 0x4, 0x1, 0x1, 0x7fff, 0x0, 0x8f1, 0x0, 0x6, 0x8, 0x6, 0x6, 0x2, 0x6, 0xbb, 0x1000, 0x800, 0x6, 0x4, 0x7, 0x5, 0x5, 0x0, 0x2, 0xffffffffffffff45, 0x6e6, 0x800, 0xffff, 0x0, 0x7ff, 0x3, 0x101, 0x5, 0x23ed2c1f, 0x0, 0x1, 0xffffffff, 0x0, 0xdcd, 0x0, @perf_bp={&(0x7f00000000c0), 0x4}, 0x880, 0x8, 0xf7a4, 0x0, 0x0, 0x7, 0x1}) r2 = getegid() ioctl$TUNSETGROUP(r1, 0x400454ce, r2) r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x801) ioctl$RTC_WKALM_RD(r3, 0x80287010, &(0x7f0000000040)) [ 223.694436] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 223.701694] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000047 [ 223.720152] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 07:13:00 executing program 1: r0 = inotify_init1(0x80000) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f00000004c0)={0x0, 0x0}) r2 = request_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000180)='-+nodev*+mime_typecpuset{-\x00', 0xfffffffffffffffa) r3 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000001500)="2f92b5728f4e673a7adfca930e7497b3ae44e052b062c07cc3a2362ca6e659bf99d2eceb8f1ce588501ca746fb6ddd04ea0f95fcc3b202ce75c27a8872a496483dbbe972c549816a18bd4c1ef5596d86aadaec7b19df21d53cb9d4b886bc7a44c8e2bbb5f3f3c540843523b90266a4444b3cfa95e56ab54f252044f862cfa5d70f5384dabfdd07ba23c6ef2c7a29da75ce87bf8b2c8079c69a580cd4d42d44d66bfc95496758003d65fdf53ef5140fef6f448c9a13bf3e29d851077520aa869fcd62c62738d1ce60860abf6cc4e1855b3a53f5346600f42f6c8bd5be1b5cd32ef878fedb1264012ecba06e722257c0ee36a7901e2b09f7d8de9c6eba904be0a2027f1a14e978c5619cb55f5aa8e8a75900a162757488d5c182d3ae8fc68cbd73d667f5aac5c9aee542e981af12174fbe56eab3ea7a17b47405d5375a0f09a21d9d416f0ce0d483985ce1ea799da495005f6e69e13548cee46567221d10a63305de0d2d25c628a6f75715782badab81cf9f773a573398238d81fc5341308cf30c64d812dc39a3b254b7f68f6aed407104292a527db121fc1bf66b3c3fd507b3ce6c887bbaa229611bdce11fcfe974eea0726ddb12947ffab8b8e9be24e4a26918d590f03346e47fe0104b9b8049ca5ef389663e4b564e31525caec77cf9faa64cce5973a2b2b5384b231f0ea19b1275dc24d9dd712ffce837ad33ef619d93013a0bfa411ea71c2e0178a4879448e648ad8340f3fe9937b5f92fd10446000d77429ece40aeb5cfc13a8489e9688960d5af0dec662ecc4dfddf142b68fbd86500bfdbb8d230cdc1b27f0afc225f68ca682d3bbf1d691e96f526f88a94e7ccdce0c49314e1f82f9c8349c330fb3191a85ae14abe60de8786a569998e421e11076b1aa28c63ca74182174a929424eae0d91dd1bf9d5d58f3b712717327e010e8389aec0129d18c7328c15d8438a3198438e5ea85903949ac4ff9ed5b099a68b64b8b6822e23ce0659c07feddca3c08b88e6b455d026d59dfc34a5015443fd4fefa26d470d41fd285e0854184cdb41a5d47074d38ee49f232b7bd3a42ff4e3cfe0e8e1d8ba2245c930394d35a271e476ac82717e979455dee64607537f19a83ecf85150f49682cd068973b04ee3ec9288568b2969302a7afaaff2ec55a4805c45d8fce270bc77993cd7cc980829d8a52985336676bd6fd3ac499911b79b7b3ab486d6aac55d307e2e4f791db58e43cd07436e166f58a5580055e051d71bfc1bd4e1b30483f6926a7356ce7531b3d553561c5c2045576dde1288d264ae0845258512b2e1f8a06b6aa13d4cd0801ab1ba6a383e81d2af4d2609516f27cfb609bd8cc496c6cd67ec9bd40bb56b44ddc47510d33582ebc8557662ae6427b411ed34d7e944a8d67ad5f794f50ec9b90bf303ec1f4cc989a8af31f2579ffc0558cb14959a3dcfc4f4987c9844657b5c3ffdd57bd805b4fb4ccb6c5c4e8f237f3c75587dfc558026ecbda3a5dc75652ee0063739dc30e7c4d95bf7a01baf4eacb6b37c4ced2370b0a36b45ce7f5224ed4fbe4173939b4a7057df7767b0429fc6fe43b1e54d25f30a8897e1a69c61135a30dff99f3f6f0aba0546d3e97de2663df9ee54947b6d4b0a7a43f25423fe38f06da492292fe291daf6e3574a5158012bb1715ba3520a17ad786439e93a798236d40ec1cc17f66ed3df4254c9f39cd579ce978f7876816fcfe22236fe4dfda22782cf14432ad932bcdb5065062aa55e4f66bee4ebd27d6e59287f96f889e906bbe8fcde1de5cb044623d3c9bea76671e1992cdb4c770b4de35b25226ac3b51424b8725f4d7b84b36ffe3e34bc8221c084f6a8b42107403897282d30f8544d6cedab352de6d941b28284468d76e02c8ab96ec4f52150a0a1cbd4bbe1d8356d341c60c110c3442a6c6f0aa59dfd8bb995142b7cac4001b126ec94a4727b0c939cc6e545ae8a0c551f6c5fe6865607019914e4b4ccf1e08053a13cc24d5d6d3e215a1a9c66bb2f94d67b34e53ea2471053dd70b9ea6b2612635e4290102f16e9502b04669ae0e6c870c51d4c0083825c311da20ec358a2c2cbbc145d609433114253cd9b9ec2d68cf0c8753a329cde9fc4ce13ae9405f62f6d394f35d3cbc4afe70224ca14f147f2c2b5b706822fdaee971f010e81e0c0d7c3a4a19e84f70b87f69ca34387138af8dded20713e83d9eb84da3e65ff13e442522b4c9a124061fd769e496bb987569a3c00fc9e9fdf6c7bf17ecae01d172b82183d587bdb8275b9e596ac72a1147e1a2a4a7b16be496821628cd77566aaf113ef5107773de2630705d51200f88455b6ac63b800f0b10a2002c93c4db39aef8c7c0c1a038c62cb7c30791b1bee9922d8453cfd2462590cabeae80d96d953dea04579d67ab3bdf46bfd939bb23d7e067082bb2db9f7d071a6a04e7ec64bd816d9c3096d0ee29ce495a661fdab9e02b7ad7cc0f2f846de86a95f4c4222300a3021976b0c678e669b17902262a5d7c3e8980a641c96802513c5db9873706d66fb5f903b29f0ffcca95d256b1dc2da99e72fbba2f706588883d101c52422cbfda4fac8b01f676f7c717c03079942b929ed16ff2d7bb1904cf5b03ced5d2e479c04b4e35470839719c86337ea7b98fdf2d22fc84c11223a82e8e79b7ec377bf181fbc0d757f9d7171fe8c562b0f26c2d23fb473ed9f3c33b004238bfc7dc6220fd48e5dd490f8f9550e670dbe0e6a248cec921ef042a77a7c8f56259f3e104d4f49c49429f8eefc97b640b84ba91e6a2d7e3b1f501f74784f678980190048023f2f2d6d276fa034f4741e7d85841d40583d264622ffe354e9ae8daa9b26ca9d8e931b4eb9833045a41ca80379d8b8dd6faf06accc504b09c586eef500ec4d110dd64be64d043cc5970e63f0e00f1e61442f7c14bd772a747218da7ad769e11b7d6ca2dbcff057aa9b99d624df50b2f5a28a95b33dea52044e1c363a26a62d58af595a503e534f8d54ecdcc251a7622f8f8ec77aaa6b02b372085f7238f8fd89bedaa5d479da9629360aef744ec25a9b3a00eda93df6ae114b5d73568480fe3ab72481efc077a18c95ad7ac1d558374d889a009f4a6320c865d0ffd5d8ae2b71500ef4df777c1e29e02674fcc201df24cb69741f1f30a72864c928dd8fc10fc95b315d9c16c74d56eb466d6e922a08dc57f5db91152860613f2476d7a9d337b82fe4a93250267c462055def6c5b70563b066e8584bedf599524ff7800110b20cbc0ff470834713f90e21748280b319cb177e69071406fc0d374dbeb26fa64af6782df28571bc69c76917bf4c787307e3d32ae973deb847362144f91276f190cd25c42200cf9578c89f55ac589cdc8df1413753be6cd4e374912ac87545d214c91adf2f02a49b6acf6ccf3dba900bc39770de8648db70231ebd071cb4a8619e584024c99dc895561a82b7607aefc74a1827ce13af5b8207ee7255ea681f03afc3424d8d650fde0a4a80c918ea5171ac2e438fc730e099a69112d7c1e3b049c0e7347766f98eaca22916e11f43dcb693e2090fb54b2b52fb0d6b1ed259dc584c08a0e653a0221e21c56f963234e603f7c494c1f3a9750790e8d5868b6e34d5f454ad850b12413aea8d5fa30843392f7adf7ae72f449ff7cf535087b19d92d8c558fa34db9076b43bf08145bb44368cf6a323ae64157565115365e6b25a6333009686ee7992f70f0deb42d94862eb2fcef07c3c60ee510aaf3e4f7e4aad44d9ed8bd79d2d90b2a99a7a83052ba884543358f896f3dc89df1fdce8374a0524712740f413ba5649231aceb8833bec155b6730e2e5e7f7881aa99436b8e187211d2fe971722e5202ab0f6cdb5f184c0f71332f4219b837d002917c52e04b51d34efb5af8e964410b86c2ecabf25c00b61ad4faf82220a4e03cbdfd768a3793d4dae14b168aef85b2dcdf90aae5d0b7b213a5c4a2a1759e1352d687966f7c0ae3018557c389917b259321711f4a734d70040abfbe21941a42f8534f567870980448f8c610d873361bdd4ebaa9cdf643b79ba51d5ec5c5f0c8d7156b14f82d65177e352687dcd0c44be1ab41b944ed88017896c0fd6f46c580fca8603b3a695973ad2c7af060bce42564f3ad6fc400db606ea4f4fa309431a7beb6c1b831c79b5edf5abb86fb1c7598e39688e4a773b2782c64fa6bed87890e80593c03b195a2dda6288d0504e6a79cf0e338f9d3118e53af0e6120c5308b26e62fa087a3c46e2e144a5e0e611c6cc33ad1fe4b809adb5da6e66c397f323fb13ea57fe3b8b6f4724463252fc1bfe93a465740a4e705276b1ef319193a3a4b07cacb41e6954dffcb51d6e8023016857c1d9d6750bf49cd7c8f3fd8d79aca8214dc343448d13e338740fb3f37252b22b6f5116a3065bc5d4ea83af1d5d613ae8906daa9c97c17c2ac03944603a265f80efa9c8501473d13791f32d9e88b8655cbdcda80c834b3125df5cd4445f87187f06b89f803337da278fe8c97621fa54cebf4c85435116193a425b79f39d5d10af5d3bf381763760e1845727e59eb1091daba470c7fa6f1e6e588b2ebe8e5708e981c6b9c154c1480c2ac9694c975e347b24c3f22b734806668413ad5fe5e65f334c160a2b5b34c58b2617d42e4f24da63be307ba258585bf5c84e7ea8ff3c57b52dbfd6df32fa4cc5fd985460b07c94803e3ea8e09966e26448b08649b378c4cf60737a6a10ed14d60fe712901ca67e6880d99f047ac011d1c77ea28c24bebc608d7b8e03694d1e44e6c3bf35167ca0b5f74e297f477f991383fe3418cc55bd67b68a7859faa33c9e641d846f78930894ae57232e48d522024fe67065389f6abe8ed4de9cb4b72232658b58b75ea12c48043aad07083cb81eb71b49d7fe555c11a2aaf62122b65292f494306550fc699e21b4ec43034c89d7c5d6bfa5b3aaf5c7385fbf0415d2ef35f8c59b05b2faaf18b307c96d67e95982def279705766a18aca5e99ef6b80fe0c50d46351692900db1eb8318d47d4eab281d1cf44e0167d689d26bfc61a9380debb17f53c8177cd3fbbc17f11f88c2726278569a5ae1bf5638e71cd4511b14c1d552fc2929dbc2b32325b7cf4a756cff51bb4c8f9a1e272b1159fbd570e2776eb3f2e413a7f47bacf4ae47aca8ed994438b1816bb511410451b6c5978ef99f64a02b590c7bb71053a146ba8e1add99ff2bbd39da771e0ebc96e84cd2e22e5adeaf54c74ea12e0c0b782d2196cb097f09642197fcb0911cc9c9a1bddb363ce11a2a26739a739393eec7f4d468de39fe012cc39f56b8cb07c5847e90501b7d4841acbf275475d1806b395e06c425047f8cf91cd09fb8dcb79b6d05388fda44111e86aa8689b6bab3460d650a2eb0584ba4168c9c700ae7ad85d161139a8c5a7b56e09a9b76df5e934290d0eeeb9353802d86aead584948a614e067582d4d3419951f091d20003e2961927819d418e1717d031038ea878fcef77493c86d7296ce2f50defe3171d7b4631e2914216b06a1d3e3abed74176d6fde78e20c3acc4db9e91dce078c637e5954e83c34cf2ded2fe3efa88fe4440804166ad8ed5b9cec2b0afd9ce63ba4df0496ca20d8947ef34b7756897d898a8ce404e3210d583b9cedcd65a014f9548aac7c4ebc49a2433fce195a1d77f06fcf6a1f476f7a740311f3d442f50a86dff94442ab06b174ed7d9d6d3013c58ade7c7d79588747d20fa727a5e5bea84689cba137ef07d5a913a5d60c904b48067f0c7bdd70acc71c5a15717afd6992f18fc1818f91203543df54e7f7a45c84e6a18ebb1", 0x1000, 0xfffffffffffffffd) keyctl$instantiate_iov(0x14, r2, &(0x7f0000000380)=[{&(0x7f00000001c0)="a70821b0268e95cf4cfb434cedfd4a830494d1f29dc8e5d5f7fc8d2d2b092f9fbf401df447e53f13a3abf29cecdb08583082ecaec2b86da4f811bf33033246c2eb8b7a0804bf793b12e56ca577c4b66289b5691a0ac99433032864f9906d5b5c8a", 0x61}, {&(0x7f0000000240)="913526185bccf41a79bcc6d4", 0xc}, {&(0x7f0000000280)="39c7d6ca9cf1a02e96bbaf0d21e32b6958a0a9bef8bb05fcb70421554a86520707bd897f68ab7d825a0a574ec8a57ce0645d679c3daeceafc3370016f74e4c473a6c8f6280ef65e28ce4d72781c42301dbb1c0c6b5154d0664fc42ada890ffbab3208a764b349dae14a7701b2cdeec54855cfa7065d417ea50", 0x79}, {&(0x7f0000000300)="3dfbc166d8ced18b2f688b7d5a", 0xd}, {&(0x7f0000000500)="ba2988a14df86e2152e0e6b64f994921ae27171cbee4f4c3205074a853588e126d5b0bed4162b4ac56859571160d288c96031ef1fca0dba66947f8a2dd34987670e67ef1f91c80d10bc45255345042ea94f17f3bbd06a02ee3f0a99894a42639a9328e6e8eb421d0163f3fe271447c0f07d2a4099d9b4d737d0bb3d23f14e93ad98eb93b5489c214e374b5864c2b65f6847f362fef22886bcdd050b195df1c9a2b45cc0e7cedbc9520cb75b4527f5dde222227c14c7657634bf7f5c577ba8e1c2f9fb1d73f9e05dc3b472091509dcb72c5ed4396b68c82dd973d3cd8c95fc1559d96c0025e68740f45acb75c36c7772af88cf6873f9954b0e854262cd84df5eae18e2091299c06da95f8e6db562744460270d5f058515c1c433639cf2a4fdb39dfee261721572ae42cf90ebd7b672d7c54e81a55f1d5c24c7a7b2077d6539b4fc909a97737b4f090cc4f02999604a1c1e2399494aac7053eae7fb4cff63e30c69c2e29e0e3c6285154728678e590e77226a77c12732385136ede2515d96dd1aa3a100144c8ddb941bb634bc776ea068527b497126cd77571d79be1597e5dea99f9b7c5f81b7b9c91708d4a8bc37b4cc212f0fb2f973256d6a0e960a8b77be4576e907e834b3482e999710f50926cd507d9f573e7517966dba7d738c1c0e6587b7fe7d16f000e2c2b9b8ff942d48064e2aae71d12096625fe8fad5834de91d2cf78c1317267a4f7bb4c2502f4db9c84f500d9dc6cd96409953c15e74cbde20b1b6e8335f9f233021de2f94b86d58e4b1ee7887f26d1d578b45b782eab6b900e9d9781c607aa7731bcbcdf4f38612799a88dc5cb104f05857bbf34da7ff38e165cea6bdae28c19e9581f94350368405fdeeeb34ae7c5d78a49a1c81adad173a255ce3294be7427d0dc9903503b2301fa68ad5901fee4a3832288b30629fb0e61776ca6a5912feca8813529f115aac1487e8b78f383ffbca980821926df2feab5f5f4a05e8ae3b9036d16dfccd1ed338aeb2913991b1e98a700f54c434f657ba7ae959331c870138d4a4f5c5e85ec25dcddfab617c0918879fafcec408f21f11b8f2877f59a00c5fb46c90462abb43b70f4f19f827de9bf0842b241eb7aae69b8b394b2b11c0bde4044dd5da738ea8854d109b21aeb8574109a5b1ed215e697e4e8b5a78add8e46e4bd6113d46572e2bb06298e0906a1fe271a10e30c288556117b37ad56f5ac55e01b73a60f30a737d518ccc05c3333e9362d8f5864605344793ecc15cb6c3fefbcb743af869641fef0f73de988869336734a57b97b278ebe51c47256d039b2d53350728a4c9d2e9dd044b0013a4f58352b5700e9f9e753da88e4acb459d64a280dfdf208920b6f175ddb9c70b2d2ae68cc714c3bf5a53fbfdec5fc2b5762f8d7d962644113ba396b01ce622ca59da0e68464e631b6dce2d7bfd694c0af333c2e19ea874777040b6eb32e7f23a68dcd579b9c2f2aac19269993df856f23cdb26ca9a1b3c2927ee7847191a9089a029571bae81c151e671e4304d4b9da211afab2a0ac295460a6964a7a8ed0d2b99343b444746bba48b2f644b233c85b0170aa98b9744013d7e7c4094c125414192f59b5eb1d305bf3cc13b253439c02b94e6636071827dbdf3aef9e6360c74b3b9c41b7a4172f715bf1264f9b887803f132fdc5f3302aa7f2dc4e2867de893d67203f3750f3844c0a402b44f9bab08ae3c769428d4bec35ed6228b3b87698f79b1fadd472afc60de2647f116d2b0d312f27f97e4566759c7718a73a288b1efe293c057cfa61166b6a0fc99be36e7408bdd58a4867ba8ed747609d2a554a4e8743afefe5ae9b03ad26a7eec063a7cedeae8946d0c4b17bfbfb9a4db185bcf21f8b4266596d9eeef711f8f98e320624dad10b1522bc09457a9b0a8dfb20fe8bd09bb3a374ac9d9869e48298b1daa206c66dba583ffa0d78cd66fcee6639a3d34ad8ea30b2db6cb62c8e86517dbde0c50530250d9afac87ad894dd5568845cf5b7ee3fc377d06237f9f0c5d1d38718075129c9e22675062a03d6ced4e156c516810a923024df031336cf773360a39e8cdf3213762052c499947db177005dc67b0cbe17b19f701da4509641a6a1f2858b6364db0e698bb55f4ca323627008aa1596b7c25d6dc99c20f0c406d6f9fe9ae2ef38dc1139cd6cec630898ad99e0936faf57160ab6a068a488be9a3b250f02fea85e8dd7fce3a1a396b995bf4b9c001881b05cf2134210ed70a13b592b7681e84981841a3fbcd2e002b14b64fb5d9433ca7871f19a87a23bfc567ee14cd1b5bf3a04d7e1bc5e34e4106eeff14bdf5ac5ad533a11f4db293824e78c968145bf13f6188b57d9548e2f49aa750ac20e66e95f08c596c88216de993fb320593d3d3717d2e8f16323fab798a086104b6257ebc1e46c7e269ae0c173b6cd1386151e2017f2b42bea992017ea1e94808073f8b2a60f8cc9613d83208c619164cb44fac8355b244db9b897f8848a85e00a02b9d1c7ffa692b381bb26ba3eca73fef981ae06c8b588509df34412cd132e3ed887d749107713622c51b9f7a333dda654901e5277c15998028c9d92eae74ef39ca7fa9ac70b624aacaaaf86fb39a72c77aa3247a8aada377ab7ad6489497581b6947f1286870114a1d23d4b127ae74769d19cf19f03ba59541679825cf4a93796203d02e9f3bd905762e20ab85cb055f3ae3874369a0bd6a5572534be343d1b3e38df9e397ee4c47843864141a4033cc93341ba6a1de853d2c89079a3ccae4158c80ed3ca755c9e00bc639c1b3838ebed681e587b3dac783413ae2770a4344d2ae968f902226706574f4ca5716f113e6038fee2cb1d26c32ab75bb46ab6f9e9273ab2b7741e9c1e1bf090e84a5b586722090afa91e2cd07baacbefd8912abc9c40f03b998f9da6854b12a14890173d1dc65670a5c86976626c6e636a81a343b6dcf9cdc692860c9b6a6dc33d391884079280a5e75d675eeff0bf753aa5da9b0d78c40e90a0618a3d49aa7716a6043741b9984b7ee97c1ce818e3545e4bf14c7dbd881f408aab95ac1f99e381d981ab83a94c89b90c1f0a032fbf99ba077a84c550b2fe9d029ae4de693c8c76f1860b49c2682612353bea0965846388ca59f61d1fdfdba2c5cb770f50dc4e7f7851880f7170312abac31bad2e4ccd28b0c841845b31571938d3187a26c3896b406267a0c3de0818459fcbc958698f61b7c3220a54a9806a862e5a9da09509b688a1036265f51849f6681bf18d388316f5ba7babf0ecbef670f0868e87b1f74ca9c99c1e8e427f56dc4e473886c9c48a90a81e7c98f0b769626e8d4ea475347c70de578363605f701b7e11860ae2b66b8b39b8bfa4af00a05088af7a926c5351d1d5ca2318693089e9257b69719ad7585999e1bfbf3e2942f01f9ed203a85d879c1666857f92bf8b56143bbe65f8b881f6b8cb75f342f90a7f20c9c4be182f4d447a420f68753d894aa61280494f75111e59917491c3808e924685f73d3a358b374ec09336eef9dbde6b60c876e8f21dba0bdafa0341aed06683c891cb5ef852f3c6177c67e274c0c9f63d7dec7a0f6cbf22164b2ecdc19ff691e74ff1bc7d99a1eb8fc53e704032391b5b7726b82f46716cc69fe35331bfafb04817c7c6fa469a8469523de67472c13873d7b97a38f19ffe9c3aa51de2a18d5ca3bc2d4120db8ba48e21fc772d793bdea138c46fcbdfec1f60db2e8ed7a169dd5fd08f19775c2111bbd94044581ecd21044a367234f48c9e720b2343f2c0279faac67c22d3676f96a7a8062fe3f1bc76820b406712ef3adfdd438f4d69421162bf962c2935f1aa8ac05df6a93a5661de10ba742342c517ef77cad37715ddfac4e35c3ac0662b15459b5b0cdd4269faaf2e9eda9198718c73bc7e2b462f7487740780525a6acb9f659f74369d0aaaef6096e8515518ffcd788b783f667f775bbec4a6aa68f100f2ba6be8b354eff6cbd0ab5cd4653547f3a7f8af951a1305fdb02aac436527a7a8096c3810148dec82bb6d766494efbb1edc08b48394ffad45e9a29aab32d58963f79f6018ad26284149160c25bcb2d89ebdbee2cb8ce1a397866c41cdde164480ef71d6d036d8ce0975deed1912207d069ccdbcb60f4ac90f43af9c0c3dceeebe28acf05d92aadf0e6ec8218030bd640f7e0340a8cd99465039b5267074d393bd926340a3eecd74c022f8ba78e294c13b533a650cf7498adf0148a326d78514aae202902403f10f03662e64f70218bfb4f7054a99262032899981224728192497f3093c10dac18598b3226d791aec61845adb92c73f9789dba935450070926d7a1f87f3fd6cffca2d7e3f1de62f8a0f5a843efdbc43d3723d41d7d89719f07c86c43b2f8e9ef5f1716e7891954572e1b372f37f89bee4e4604b5d38c56ce7d381265860970865c9a383679f14baaf94ab8a32ce3dea3d1cca289917c8a35664c42e72fd531bbf1acef2fd82f9ed2497b1578f653a01f6788e519d96a41368caf17fef0b932a720bf1732b5906453f5edd5a63520e3044283bb22ae572a11c49189dafffc7c636c514f16289863c54cfa32e7d91cf8b802742200377d3f04eb5d2e73c8ab9551606abd34b8f256bcc11b32cfd25e426c4289eae2caa97ca6978465caf0b7a7d17dca91b94d1895a075404754698897a2cd2f848595e96af0c86ec44b8d23bf185f957ec63b9784345ba4cf1da5b6b034aea8f10ca79de5c4a9f44e5ef3bcafebdde216bd0a26a2f8b8ce043425675be037d6578eedaebf001124742f73a0c8469d4550733ae9dee6cb55c0cae87d7168fc178683a020805bb924f0772f6131de108fd65856d7d0deb4a0cccce18076621bcdae99f40f81194cc912d8f9f89b7ee7933fbd8022b93de7796fa2472a092d7c7f5a41dc68bebcea3567cba8bff3468856141be50a23589aaf6d7706b8ca969ce5b81432067ac80e5af15054dd8a84999ad110d1c9a046d4552a0a3e289f41e155a4b6f57ccf44a8a3a602d4ac88ef5d29756dfbcdb453e78f649ad47d903c378066e3205466cedc4e677b5ea7746feed05e102c2312b7037da16b9b5c9757c550aa08f9a90fd67e0ac5f920e6f6c124e40bd85c17bf70bff964a307861eb314767a28e27da8354237fe98f532147439c3097e657e5d851956d12d5be69941e358d8a4c342f304bd6c4d4009bf4c6d0bd3fb7862021821516267df52f39f6802e4ac54e1c776d7a720e47fc5ca6fd67931b437b24867b03584f949d195e6e9c5ec49134ad6f13775fadef6acb8b066c7b4b5d3322712b806a2d994af8663c4132bdfa6976f3f8aa4dd979c4d3773bc438b159143d1d8c34323d3e8a3f5fcf10d7fb3ab7b12ff2cf5eb531ac471cfc001f8875a4759cfc5327d49db23b8b0ca73184b24c526de78e57169649750e0fd8e87978f7c841ab2c90e354098576077e310d0968d6c27fe1532f06a1630aef8c2838563fb4f65d0f1b1d997576253384a0fc7d581d9be56f525c4555baf589c7ea530c741771e1e76898c67208dd5e2a3be489e67d06e26f4dda15e511afff9d6621f133c48764fa88d8af3f6baf4fa16fde0a21547c6c215a0c05b9c02df7d4a18a2b77a84c02fa5ac5509e620aba7acd1bfa2e6724978d4aab46cea99db842e155f83fc28bcbc8c35c4c7731e20ad7d4e3856f3b383cbdcf61908f6e0657354e983367e674ef32a70aa791cc49a8e89f12509a0c5eb258d55fccce03e73e4854d3c34ce354fe7a6658e9b44cd9f4b3f5b3964c20615b9fa9a49f19a16ff", 0x1000}, {&(0x7f0000000340)="8834312ee87e792852e96f1c61e77de2469bca96f64d280dba5e8a1d22dbf911b5", 0x21}], 0x6, r3) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace$setregset(0x4205, 0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)="02b1b58632ae68adbbf1ce05866b5dfee02d903c70b2c388d170756a70bfe9fca6c712c47a38bec0a8b10e2e86d4e4f994cc61682e3cf506ee131baa53ca9857a2b642395af4124fabf91a7b74398a5e09d12b605cbc1462499a6a508cd884b9cc284715584476022a349c4479f1ed07677659f23fc251c3dfb1119b6da10d5742f250ee40ad", 0x86}) ptrace(0x4208, r1) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000000)) ptrace(0x4208, r1) getpid() [ 223.774560] IPVS: ftp: loaded support on port[0] = 21 07:13:01 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0189436, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:01 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e21, 0x3902, @dev={0xfe, 0x80, [], 0x11}, 0x4}}, 0x6, 0x20, 0x10001, 0x7fff, 0x20}, &(0x7f00000001c0)=0x98) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f00000002c0)={r1, 0xe9, "0647646db73178f5b889be6dfe43472db5e5213dc30f8d59a3be9b38db6f70e1cba83b58d360a2e15618b6556909a68a899840978f5dfb6f78431276feca842c78085e945235d441b75d3725a0fd71a27ced5e2bc816fb3c14335a233ad6bea6bdfc2dafdbf058ec5e8a93d8d68a5421eba5988889d1774960fd3d529fa6481cff2243223c61939ec742f2448f16cd7bba97b6df5e8cde5c67b6f65a6dbfbf341d889f64fcbd120b548ce3f3b138deb9edb64231014d7ad0108e2ceec214701e9f58db4beed8bc1a1779aeffebe64c278e9441840d90813f22019e6d95268cef98f74a126e05175d62"}, &(0x7f0000000200)=0xf1) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x4}, 0x1c) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x15, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x3) 07:13:01 executing program 5: r0 = socket(0x40000000002, 0x3, 0x2) ioctl$sock_proto_private(r0, 0x89e0, &(0x7f0000000000)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x400, 0x0) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000040)) 07:13:01 executing program 7 (fault-call:2 fault-nth:72): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 223.803768] binder: undelivered TRANSACTION_ERROR: 29189 [ 223.811565] binder: send failed reply for transaction 318, target dead [ 223.895828] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 223.929855] FAULT_INJECTION: forcing a failure. [ 223.929855] name failslab, interval 1, probability 0, space 0, times 0 [ 223.932811] binder: release 13133:13134 transaction 323 out, still active [ 223.941185] CPU: 0 PID: 13126 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 223.948082] binder: unexpected work type, 4, not freed [ 223.956457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 223.956463] Call Trace: [ 223.956487] dump_stack+0x1c9/0x2b4 [ 223.956507] ? dump_stack_print_info.cold.2+0x52/0x52 [ 223.961774] binder: undelivered TRANSACTION_COMPLETE [ 223.971124] ? __kernel_text_address+0xd/0x40 [ 223.971143] ? unwind_get_return_address+0x61/0xa0 [ 223.996972] should_fail.cold.4+0xa/0x11 [ 224.001036] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 224.006137] ? save_stack+0xa9/0xd0 [ 224.009748] ? __lockdep_init_map+0x105/0x590 [ 224.014225] ? kasan_slab_alloc+0x12/0x20 [ 224.018358] ? kasan_check_write+0x14/0x20 [ 224.022576] ? __init_rwsem+0x1cc/0x2a0 [ 224.026534] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 224.031535] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 224.036532] ? map_id_range_down+0x1ee/0x430 [ 224.040923] ? __put_user_ns+0x60/0x60 [ 224.044797] ? __lockdep_init_map+0x105/0x590 [ 224.049277] ? check_same_owner+0x340/0x340 [ 224.053581] ? lock_acquire+0x1e4/0x540 [ 224.057539] ? rcu_note_context_switch+0x730/0x730 [ 224.062451] ? lock_downgrade+0x8f0/0x8f0 [ 224.066584] __should_failslab+0x124/0x180 [ 224.070803] should_failslab+0x9/0x14 [ 224.074590] kmem_cache_alloc+0x2af/0x760 [ 224.078720] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 224.083288] ? kasan_check_write+0x14/0x20 [ 224.087502] ? do_raw_spin_lock+0xc1/0x200 [ 224.091718] ? fat_i_callback+0x30/0x30 [ 224.095672] fat_alloc_inode+0x1b/0x70 [ 224.099542] alloc_inode+0x63/0x190 [ 224.103149] new_inode_pseudo+0x71/0x1a0 [ 224.107192] ? prune_icache_sb+0x1b0/0x1b0 [ 224.111413] ? _raw_spin_unlock+0x22/0x30 [ 224.115547] new_inode+0x1c/0x40 [ 224.119428] fat_fill_super+0x20b5/0x4400 [ 224.123561] ? fat_flush_inodes+0x1a0/0x1a0 [ 224.127864] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 224.133380] ? vsnprintf+0x20d/0x1b60 [ 224.137165] ? pointer+0x990/0x990 [ 224.140690] ? snprintf+0xae/0xe0 [ 224.144123] ? vsprintf+0x40/0x40 [ 224.147560] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 224.152558] ? set_blocksize+0x2c1/0x340 [ 224.156601] msdos_fill_super+0x2e/0x40 [ 224.160558] mount_bdev+0x314/0x3e0 [ 224.164169] ? msdos_mount+0x50/0x50 [ 224.167866] msdos_mount+0x3c/0x50 [ 224.172036] ? setup+0xe0/0xe0 [ 224.175215] legacy_get_tree+0x118/0x440 [ 224.179260] vfs_get_tree+0x1cb/0x5c0 [ 224.183040] ? vfs_set_fs_source+0x12c/0x180 [ 224.187437] do_mount+0x6c1/0x1fb0 [ 224.190959] ? check_same_owner+0x340/0x340 [ 224.195262] ? lock_release+0xa30/0xa30 [ 224.199221] ? copy_mount_string+0x40/0x40 [ 224.203446] ? kasan_kmalloc+0xc4/0xe0 [ 224.207329] ? kmem_cache_alloc_trace+0x318/0x780 [ 224.212155] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 224.217673] ? _copy_from_user+0xdf/0x150 [ 224.221889] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 224.227410] ? copy_mount_options+0x285/0x380 [ 224.231893] ksys_mount+0x12d/0x140 [ 224.235505] __x64_sys_mount+0xbe/0x150 [ 224.239466] do_syscall_64+0x1b9/0x820 [ 224.243335] ? finish_task_switch+0x1d3/0x870 [ 224.247811] ? syscall_return_slowpath+0x5e0/0x5e0 [ 224.252729] ? syscall_return_slowpath+0x31d/0x5e0 [ 224.257642] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 224.262639] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 224.268158] ? prepare_exit_to_usermode+0x291/0x3b0 [ 224.273156] ? perf_trace_sys_enter+0xb10/0xb10 [ 224.277807] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 224.282636] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 224.287813] RIP: 0033:0x4584ea [ 224.290978] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 224.310154] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 224.317844] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 224.325101] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 224.332354] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 224.339602] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 224.346853] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000048 [ 224.359129] binder_alloc: binder_alloc_mmap_handler: 13133 20001000-20004000 already mapped failed -16 [ 224.372187] binder: BINDER_SET_CONTEXT_MGR already set [ 224.379799] binder: 13133:13134 ioctl 40046207 0 returned -16 [ 224.388772] binder_alloc: 13133: binder_alloc_buf, no vma [ 224.394391] binder: 13133:13137 transaction failed 29189/-3, size 24-8 line 2967 [ 224.412049] binder: undelivered TRANSACTION_ERROR: 29189 [ 224.417947] binder: send failed reply for transaction 323, target dead 07:13:01 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:01 executing program 3: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x1, 0x2000) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x20800, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000080)={r1, r2}) getsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f00000000c0)=""/159, &(0x7f0000000180)=0x9f) r3 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x101, 0x101200) socket$kcm(0x29, 0x2, 0x0) epoll_create(0x7) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000200)=[@in={0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e22, @rand_addr=0x100000000}, @in6={0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, [], 0x16}, 0x10000}, @in={0x2, 0x4e24, @multicast2=0xe0000002}, @in={0x2, 0x4e23, @rand_addr=0x101}, @in6={0xa, 0x4e21, 0x6, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x4}, @in6={0xa, 0x4e24, 0x4, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0xfd4}, @in6={0xa, 0x4e21, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x4}, @in6={0xa, 0x4e21, 0x1f, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x4}], 0xcc) prctl$setendian(0x14, 0x2) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000400)=@get={0x1, &(0x7f0000000300)=""/203, 0x1}) ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000440)={0x8, 0x100000}) r4 = syz_open_dev$sndpcmc(&(0x7f0000000480)='/dev/snd/pcmC#D#c\x00', 0x3, 0x80000) ioctl$KVM_GET_LAPIC(r0, 0x8400ae8e, &(0x7f00000004c0)={"8b12fa9382d1d0910d74ab5cc03b378d0d7df816a4fec59c1ed07f848a1c4cb9e364bc89ffba87ef06f103904b8e9a586b6cb14e33ac164a7af3a497a7797b715700e0aff71de6487d45d2e662281d8b8fc77a7809950795720dd151a29f91b45b76425d6f30457daac6e211b451b3f50e7c6d6907b3cac68e908b46ea4e9a673a85655b72c41c29085f12f7c56ee1140b6d190cfa4edda432d4325c476ed21d8a6a1952bc14f4a5962933135bdb6a25b7e2e2fb8ff9a496d6465aafe2182065386d7788250f6458204442dd8838727a124f16b10ea0bda1aafb5793f81634a4a9b507a4372e1b7200cf2e943124c61dfbcfb98ed8adb45560a1472635d95e0c7a7e03cb1a23b34e06035d4f4630ce8692c032abd780707592983544a71ba2b276324936cc004e692ca7057a0cffd345dc7c027f1deda86070f66b2c9b6f5b3e68dc2b6d237821c319e33dbd37f91fe870c2efc5eb47a314f4a6192bb3a64deb42efec2d184bed5c285bf20d567d4b1bc2f08442d126a59ef0980562d9d32a026049d0bc50b3eb1254394286d59e5b556af89993f0d7c1d2e65c458059b922a3d5d465f49e56f15f9916160884a2bb75cd962613c5be9d8183ea2e8a74c7eb5ab162cb517983c40e0a2b1c604f4114cbaa5befb19a10ede4292e9ccd1ae726ab97a45b512a38f60e66931bc5f7f8e331b539c6dbdde2f9eef946b797ca7af0bc55987201cc43d7c23a801fbc5e255bf0a1901d4ac409cccb7e1b1337df9de5cc92b58053a035af8a33f5a94a1a30234220ef44bd7b2ce9b434f467c808c7e5e3348b1c648cac0ecebe4ec888b0b7d996145ec7288323bcfdf09fdda695f878abfa6a567196bbd9b189a003d966eb335b693b05902cdee70b2ca8e07d2aa2362e7f7f7a84fd5915ac90f42950f1732b956e1297046867fd6605f9d1ea005010b3554ba891b1d6203f17b943a7a97644b16a4f4d6f89a5eb636c6a68b9a8165717eb10f496440b3c474766fce3db28bcfad71ecbd3054449539f967206aeeaa94e500fb76176b63af5433b25613cfcfb3219b1b156a007dc28e399f06333ca156e9cce8c82f0d1888f182c5a137335a0a89f379401fb70d9ad08942f02d57e8a945d181842592862ec0fc1f89c705217f81ca8678ef45ed759868a88a2604fd4cdf727947cec969eea84638898edcee5e0b3ed1af51141016e6f0675fd620fc454141829e14c3672c3014dee23d6647f0a6b2c162df207316b49bee5aaf5089daa8db371d1917b4713b23123ed7dfde812aa82ff9871a6b986a2fc21c5c04cb293719a80bb7c8a2a164a43b709e31f398075451093d854eb15e630e4f74df66287a0567d65ba760213bf5f78be36f3311a087053c6bce9a92de04dc8d5b6052a1d43a7db1c86f1569e8ce11c47a40a3f1447eaa3a7393789215288bc7f1a5e9fd1"}) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f00000008c0)=0x3, 0x4) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000900)='/dev/full\x00', 0x40000, 0x0) bind$inet(r3, &(0x7f0000000940)={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) getsockopt$inet_tcp_buf(r4, 0x6, 0x1d, &(0x7f0000000980)=""/4096, &(0x7f0000001980)=0x1000) bpf$OBJ_GET_PROG(0x7, &(0x7f0000001a00)={&(0x7f00000019c0)='./file0\x00', 0x0, 0x8}, 0x10) fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f0000001a40)) getitimer(0x3, &(0x7f0000001a80)) openat$rfkill(0xffffffffffffff9c, &(0x7f0000001ac0)='/dev/rfkill\x00', 0x88080, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000001b00)=0x0) sched_setparam(r6, &(0x7f0000001b40)=0x2) setsockopt$inet_sctp_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000001b80)=0x401, 0x4) openat$dir(0xffffffffffffff9c, &(0x7f0000001bc0)='./file0/file0\x00', 0x80000, 0x62) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000000, 0x30, r5, 0x0) fgetxattr(r0, &(0x7f0000001c00)=@random={'system.', ']md5sumbdevvmnet0]\x00'}, &(0x7f0000001c40)=""/162, 0xa2) ioctl$KDGKBMETA(r3, 0x4b62, &(0x7f0000001d00)) 07:13:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000000)="0f21d866f243d223b9c10200000f32c7442400bc000000c7442402b76a0000c7442406000000000f011c24260f017a84c74424002d77018fc744240200300000c7442406000000000f011c24660f388046c766b80f000f00d0c4c1fd5b1ab9800000c00f3235008000000f30", 0x6c}], 0x1, 0x0, &(0x7f0000000100), 0x0) mlock(&(0x7f0000000000/0x1000)=nil, 0x1000) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x4000, 0x0) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000100)) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 07:13:01 executing program 0: r0 = socket$inet6(0xa, 0x200000000003, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x102d}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000100)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffad, 0x0, 0x2}, [@ldst={0x7, 0x18d1fb, 0x0, 0x1d1}], {0x95}}, &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) 07:13:01 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00000001c0)={'tunl0\x00', @ifru_data=&(0x7f0000000180)="d61a072afa6a2e6e9105a65cf0b08be4d57565e1a85eff283ee23d954743a2e3"}) r1 = dup2(r0, r0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'team0\x00', 0x2000}) 07:13:01 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x0, 0x0) close(r1) 07:13:01 executing program 7 (fault-call:2 fault-nth:73): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:01 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40046208, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 224.551558] binder: release 13143:13146 transaction 328 out, still active [ 224.558564] binder: unexpected work type, 4, not freed [ 224.563885] binder: undelivered TRANSACTION_COMPLETE [ 224.573107] FAULT_INJECTION: forcing a failure. [ 224.573107] name failslab, interval 1, probability 0, space 0, times 0 [ 224.584441] CPU: 0 PID: 13153 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 224.592844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 224.602208] Call Trace: [ 224.604815] dump_stack+0x1c9/0x2b4 [ 224.608449] ? dump_stack_print_info.cold.2+0x52/0x52 [ 224.613635] should_fail.cold.4+0xa/0x11 [ 224.617765] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 224.622855] ? memcg_put_cache_ids+0x10/0x20 [ 224.627246] ? __list_lru_init+0x413/0x840 [ 224.631473] ? register_shrinker_prepared+0x15b/0x1c0 [ 224.636646] ? lock_downgrade+0x8f0/0x8f0 [ 224.640777] ? prealloc_shrinker+0x213/0x480 [ 224.645169] ? __init_waitqueue_head+0x9e/0x150 [ 224.649822] ? lock_acquire+0x1e4/0x540 [ 224.653778] ? fs_reclaim_acquire+0x20/0x20 [ 224.658084] ? lock_downgrade+0x8f0/0x8f0 [ 224.662216] ? check_same_owner+0x340/0x340 [ 224.666522] ? rcu_note_context_switch+0x730/0x730 [ 224.671436] ? string+0x225/0x2d0 [ 224.674873] __should_failslab+0x124/0x180 [ 224.679094] should_failslab+0x9/0x14 [ 224.682888] kmem_cache_alloc_trace+0x2cb/0x780 [ 224.687584] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 224.693104] ? bdev_name.isra.8+0x1a1/0x1f0 [ 224.697413] ? vfat_rename.cold.16+0x78/0x78 [ 224.701801] fat_fill_super+0xed/0x4400 [ 224.705756] ? netdev_bits+0xb0/0xb0 [ 224.709452] ? format_decode+0x1b1/0xaf0 [ 224.713499] ? fat_flush_inodes+0x1a0/0x1a0 [ 224.717804] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 224.723330] ? vsnprintf+0x20d/0x1b60 [ 224.727113] ? pointer+0x990/0x990 [ 224.730637] ? snprintf+0xae/0xe0 [ 224.734073] ? vsprintf+0x40/0x40 [ 224.737512] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 224.742512] ? set_blocksize+0x2c1/0x340 [ 224.746555] msdos_fill_super+0x2e/0x40 [ 224.750516] mount_bdev+0x314/0x3e0 [ 224.754133] ? msdos_mount+0x50/0x50 [ 224.757829] msdos_mount+0x3c/0x50 [ 224.761353] ? setup+0xe0/0xe0 [ 224.764530] legacy_get_tree+0x118/0x440 [ 224.768578] vfs_get_tree+0x1cb/0x5c0 [ 224.772357] ? vfs_set_fs_source+0x12c/0x180 [ 224.776760] do_mount+0x6c1/0x1fb0 [ 224.780283] ? kasan_check_write+0x14/0x20 [ 224.784503] ? copy_mount_string+0x40/0x40 [ 224.788719] ? kasan_kmalloc+0xc4/0xe0 [ 224.792593] ? kmem_cache_alloc_trace+0x318/0x780 [ 224.797422] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 224.802944] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 224.808463] ? copy_mount_options+0x285/0x380 [ 224.812949] ksys_mount+0x12d/0x140 [ 224.816557] __x64_sys_mount+0xbe/0x150 [ 224.820516] do_syscall_64+0x1b9/0x820 [ 224.824419] ? finish_task_switch+0x1d3/0x870 [ 224.828911] ? syscall_return_slowpath+0x5e0/0x5e0 [ 224.833822] ? syscall_return_slowpath+0x31d/0x5e0 [ 224.838731] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 224.843727] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 224.849249] ? prepare_exit_to_usermode+0x291/0x3b0 [ 224.854246] ? perf_trace_sys_enter+0xb10/0xb10 [ 224.858901] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 224.863729] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 224.868899] RIP: 0033:0x4584ea [ 224.872065] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 224.891234] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 07:13:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000040)=0x4c9c) [ 224.898923] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 224.906177] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 224.913429] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 224.920681] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 224.927944] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000049 [ 224.948841] binder_alloc: binder_alloc_mmap_handler: 13143 20001000-20004000 already mapped failed -16 07:13:02 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x27e) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@local={0xfe, 0x80, [], 0xaa}, @in6=@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6=@dev={0xfe, 0x80}, 0x0, 0x32}, 0x0, @in=@rand_addr}}, 0xe8) close(r2) close(r1) 07:13:02 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000013000)) r2 = gettid() r3 = dup(r1) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) socketpair$unix(0x1, 0x80000000000001, 0x0, &(0x7f0000e18ff8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000080)=0x3f) ioctl$int_in(r4, 0x5452, &(0x7f000005b000)=0x3) fcntl$setown(r4, 0x8, r2) readv(r5, &(0x7f0000000040)=[{&(0x7f0000fb6f9c)=""/25, 0x19}], 0x1) fcntl$setsig(r4, 0xa, 0x12) dup2(r4, r5) tkill(r2, 0x16) 07:13:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$unix(r1, &(0x7f0000000180)=@abs, 0x6e) syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x7, 0x10000) [ 224.977488] binder: BINDER_SET_CONTEXT_MGR already set [ 224.985220] binder_alloc: 13143: binder_alloc_buf, no vma [ 224.990877] binder: 13143:13175 transaction failed 29189/-3, size 24-8 line 2967 [ 225.009357] binder: 13143:13146 ioctl 40046207 0 returned -16 07:13:02 executing program 7 (fault-call:2 fault-nth:74): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$usbmon(&(0x7f0000000e00)='/dev/usbmon#\x00', 0x800, 0x40000) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000e40)={{0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, {0x306}, 0x32, {0x2, 0x4e21, @loopback=0x7f000001}, 'erspan0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5, 0x8, &(0x7f0000001000)=ANY=[@ANYBLOB="720af8ff40000000bfa100000000000007010000f8ffffffb702000000000000bf13000000000000850000002d000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00'}, 0x48) 07:13:02 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306202, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 225.061009] binder: send failed reply for transaction 328, target dead [ 225.072946] binder: undelivered TRANSACTION_ERROR: 29189 [ 225.135757] binder: release 13193:13194 transaction 333 out, still active [ 225.142807] binder: unexpected work type, 4, not freed [ 225.148157] binder: undelivered TRANSACTION_COMPLETE [ 225.162702] FAULT_INJECTION: forcing a failure. [ 225.162702] name failslab, interval 1, probability 0, space 0, times 0 [ 225.174098] CPU: 1 PID: 13197 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 225.182494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 225.191838] Call Trace: [ 225.194423] dump_stack+0x1c9/0x2b4 [ 225.198038] ? dump_stack_print_info.cold.2+0x52/0x52 [ 225.203214] ? alloc_page_buffers+0x1cd/0x680 [ 225.207694] should_fail.cold.4+0xa/0x11 [ 225.211736] ? ksys_mount+0x12d/0x140 [ 225.215521] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 225.220607] ? lock_downgrade+0x8f0/0x8f0 [ 225.224742] ? lock_release+0xa30/0xa30 [ 225.228700] ? memcg_kmem_get_cache+0x3a9/0x9d0 [ 225.233370] ? mem_cgroup_handle_over_high+0x130/0x130 [ 225.238635] ? lock_acquire+0x1e4/0x540 [ 225.242593] ? __find_get_block+0x79b/0xe60 [ 225.246898] ? lock_downgrade+0x8f0/0x8f0 [ 225.251033] ? kasan_check_write+0x14/0x20 [ 225.255249] ? __brelse+0x104/0x180 [ 225.258861] ? block_commit_write+0x30/0x30 [ 225.263183] ? do_raw_spin_lock+0xc1/0x200 [ 225.267409] ? __find_get_block+0x36d/0xe60 [ 225.271726] __should_failslab+0x124/0x180 [ 225.275946] should_failslab+0x9/0x14 [ 225.279729] kmem_cache_alloc+0x47/0x760 [ 225.283782] ? rcu_note_context_switch+0x730/0x730 [ 225.288692] ? wake_up_page_bit+0x5b0/0x5b0 [ 225.293008] ? mempool_free+0x370/0x370 [ 225.296971] mempool_alloc_slab+0x44/0x60 [ 225.301102] mempool_alloc+0x193/0x4b0 [ 225.304978] ? mempool_destroy+0x30/0x30 [ 225.309032] ? __find_get_block+0xe60/0xe60 [ 225.313351] bio_alloc_bioset+0x3a8/0x700 [ 225.317483] ? bvec_alloc+0x2d0/0x2d0 [ 225.321269] ? check_same_owner+0x340/0x340 [ 225.325578] submit_bh_wbc+0x14b/0x790 [ 225.329463] ? vfat_rename.cold.16+0x78/0x78 [ 225.333875] __bread_gfp+0x13f/0x310 [ 225.337585] fat_fill_super+0x353/0x4400 [ 225.341638] ? netdev_bits+0xb0/0xb0 [ 225.345342] ? format_decode+0x1b1/0xaf0 [ 225.349388] ? fat_flush_inodes+0x1a0/0x1a0 [ 225.353696] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 225.359235] ? vsnprintf+0x20d/0x1b60 [ 225.363024] ? pointer+0x990/0x990 [ 225.366551] ? snprintf+0xae/0xe0 [ 225.369994] ? vsprintf+0x40/0x40 [ 225.373435] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 225.378435] ? set_blocksize+0x2c1/0x340 [ 225.382478] msdos_fill_super+0x2e/0x40 [ 225.386435] mount_bdev+0x314/0x3e0 [ 225.390043] ? msdos_mount+0x50/0x50 [ 225.393741] msdos_mount+0x3c/0x50 [ 225.397264] ? setup+0xe0/0xe0 [ 225.400441] legacy_get_tree+0x118/0x440 [ 225.404489] vfs_get_tree+0x1cb/0x5c0 [ 225.408281] ? vfs_set_fs_source+0x12c/0x180 [ 225.412679] do_mount+0x6c1/0x1fb0 [ 225.416203] ? kasan_check_write+0x14/0x20 [ 225.420422] ? copy_mount_string+0x40/0x40 [ 225.424640] ? retint_kernel+0x10/0x10 [ 225.428512] ? copy_mount_options+0x1f0/0x380 [ 225.432999] ? __sanitizer_cov_trace_pc+0x48/0x50 [ 225.437834] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 225.443353] ? copy_mount_options+0x285/0x380 [ 225.447919] ksys_mount+0x12d/0x140 [ 225.451532] __x64_sys_mount+0xbe/0x150 [ 225.455492] do_syscall_64+0x1b9/0x820 [ 225.459375] ? finish_task_switch+0x1d3/0x870 [ 225.463851] ? syscall_return_slowpath+0x5e0/0x5e0 [ 225.468765] ? syscall_return_slowpath+0x31d/0x5e0 [ 225.473688] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 225.479381] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 225.484907] ? prepare_exit_to_usermode+0x291/0x3b0 [ 225.489907] ? perf_trace_sys_enter+0xb10/0xb10 [ 225.494566] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 225.499404] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 225.504574] RIP: 0033:0x4584ea [ 225.507740] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 225.526912] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 07:13:02 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast1=0xe0000001, @in=@broadcast=0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x0, 0xff}, 0x0, @in6=@dev={0xfe, 0x80}}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0xfa) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="020b0001020000000000400000000000c18c2467a49454f8d178d80d2f7ac9cdab131e64c7dc33832e9ae4e358a2575da93059b84416b8a90e32bc39eb01c617458527e12d4923c051095ea42bf0536dbd1b9b006bb373c129827c109eb8cb63a2c7049dc0a15f0c60"], 0x10}, 0x1}, 0x0) sendmsg$key(r1, &(0x7f00000040c0)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000003fc0)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) [ 225.534614] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 225.541867] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 225.549205] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 225.556457] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 225.563793] R13: 0000000000000000 R14: 00000000004d3d50 R15: 000000000000004a [ 225.583999] binder: 13193:13194 ioctl c0306202 200007c0 returned -22 [ 225.601339] binder_alloc: binder_alloc_mmap_handler: 13193 20001000-20004000 already mapped failed -16 [ 225.611829] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 225.624456] binder: BINDER_SET_CONTEXT_MGR already set [ 225.644103] binder: 13193:13194 ioctl 40046207 0 returned -16 [ 225.662227] binder_alloc: 13193: binder_alloc_buf, no vma [ 225.667910] binder: 13193:13203 transaction failed 29189/-3, size 24-8 line 2967 [ 225.681160] binder: 13193:13208 ioctl c0306202 200007c0 returned -22 [ 225.696989] binder: send failed reply for transaction 333, target dead [ 225.707892] binder: undelivered TRANSACTION_ERROR: 29189 07:13:02 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:03 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000240)='/dev/uinput\x00', 0x10000, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000280)={@mcast1, 0x0}, &(0x7f0000000300)=0x14) bind$packet(r0, &(0x7f0000000340)={0x11, 0x0, r1, 0x1, 0x1, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x14}}, 0x14) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x400, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000140)=0x1) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000440)=0x1000, 0x1) ioprio_set$uid(0x3, r3, 0x4) openat$cgroup_subtree(r2, &(0x7f00000000c0)='cgroup.subtree_control\x00', 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f0000000380)={'nat\x00'}, &(0x7f0000000400)=0x78) ioctl$RTC_AIE_ON(r2, 0x7001) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') r5 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x1, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x50000, 0x0) write$evdev(r5, &(0x7f0000000100)=[{}, {}], 0xff89) 07:13:03 executing program 7 (fault-call:2 fault-nth:75): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet(0x2, 0x200000002, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e21}, 0x10) recvmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000640), 0x0, &(0x7f00000000c0)=""/239, 0xef}, 0x2) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x0, 0x0) ioctl$RTC_UIE_OFF(r2, 0x7004) syz_emit_ethernet(0xfdef, &(0x7f00003f3fd5)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) sendto$inet(r1, &(0x7f0000000200), 0x0, 0x0, &(0x7f0000000240)={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) recvmsg(r1, &(0x7f0000000540)={&(0x7f0000000040)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f0000000400), 0x0, &(0x7f0000000440)=""/209, 0xd1}, 0x0) 07:13:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306209, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:03 executing program 1: r0 = socket$inet6(0xa, 0x202000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14}}}, 0x20) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/anycast6\x00') sendmsg$rds(r1, &(0x7f00000019c0)={&(0x7f0000000080)={0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f00000000c0), 0x0, &(0x7f0000001880)=ANY=[@ANYBLOB="580000000000000014010000060000000500000008000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="7f00000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="0300000000000000"], @ANYBLOB="0101000000000000ffffffff0000000000000000000000000400000000000000100000000000000000100000000000005800000000000000140100000800000006000000c25595f9", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="0500000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="0180000000000000"], @ANYBLOB="05000000000000007a1c000000000000810000000000000062ee0000000000000b0000000000000005000000000000001800000000000000140100000c000000010000000000000048000000000000001401000001000000b85eb90000000100", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="9b00000000000000", @ANYPTR=&(0x7f0000001a00)=ANY=[@ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="b100000000000000", @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="ac00000000000000", @ANYPTR=&(0x7f0000000440)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="ce00000000000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='1\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f00000005c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0010000000000000", @ANYPTR=&(0x7f00000015c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='r\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000001640)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="d600000000120000fdd23df257e946890a784770a45e929776bcfc2156fc659498f0e3fcaf4700ace8f394c5ba46b9e480e3f184f04e7616028ca55ab5", @ANYPTR=&(0x7f0000001740)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="1f00000000000000", @ANYPTR=&(0x7f0000001780)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB='#\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0a000000000000000c000000000000000600000000000000"], 0x110, 0x41}, 0x8000) 07:13:03 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3, 0x8000) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x0, 0x2000) fanotify_mark(r0, 0x12, 0x20018, r1, &(0x7f0000000100)='./file0\x00') mkdir(&(0x7f0000000380)='./file0\x00', 0xfffffffffffffffe) lsetxattr(&(0x7f0000000340)='./file0\x00', &(0x7f0000000300)=@known='user.syz\x00', &(0x7f00000000c0)='user.syz\x00', 0x0, 0x0) getxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000004fc0)=@known='user.syz\x00', &(0x7f0000005000)=""/171, 0xab) connect$llc(r0, &(0x7f0000000140)={0x1a, 0x30d, 0x2, 0x8, 0x7, 0x1000}, 0x10) getxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@random={'security.', '/dev/dsp#\x00'}, &(0x7f0000000200)=""/27, 0x1b) 07:13:03 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000348f88)={0x2, 0x78, 0x3e2}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='schedstat\x00') write$P9_RATTACH(r2, &(0x7f0000000080)={0x14, 0x69, 0x1}, 0x14) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2}, 0x0, 0xffffffffffffffff, r0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2401, 0x3) [ 225.924303] binder: release 13226:13230 transaction 338 out, still active [ 225.930883] QAT: Invalid ioctl [ 225.931349] binder: unexpected work type, 4, not freed [ 225.934928] QAT: Invalid ioctl [ 225.939811] binder: undelivered TRANSACTION_COMPLETE [ 225.954535] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 225.960282] binder: 13226:13230 ioctl c0306209 200007c0 returned -22 [ 225.967467] FAULT_INJECTION: forcing a failure. 07:13:03 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="025cc83d6d345f8f762070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x141641, 0x0) [ 225.967467] name failslab, interval 1, probability 0, space 0, times 0 [ 225.980695] CPU: 0 PID: 13232 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 225.989093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 225.990479] binder_alloc: binder_alloc_mmap_handler: 13226 20001000-20004000 already mapped failed -16 [ 225.998438] Call Trace: [ 225.998461] dump_stack+0x1c9/0x2b4 [ 225.998480] ? dump_stack_print_info.cold.2+0x52/0x52 [ 225.998496] ? __kernel_text_address+0xd/0x40 [ 225.998513] ? unwind_get_return_address+0x61/0xa0 [ 226.016997] binder: BINDER_SET_CONTEXT_MGR already set [ 226.019843] should_fail.cold.4+0xa/0x11 [ 226.019864] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 226.019886] ? save_stack+0xa9/0xd0 [ 226.024498] binder_alloc: 13226: binder_alloc_buf, no vma [ 226.029276] ? __lockdep_init_map+0x105/0x590 [ 226.029305] ? kasan_slab_alloc+0x12/0x20 [ 226.029328] ? kasan_check_write+0x14/0x20 [ 226.034787] binder: 13226:13244 transaction failed 29189/-3, size 24-8 line 2967 [ 226.038793] ? __init_rwsem+0x1cc/0x2a0 [ 226.038806] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 226.038827] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 226.044537] binder: 13226:13230 ioctl 40046207 0 returned -16 [ 226.047507] ? map_id_range_down+0x1ee/0x430 [ 226.047523] ? __put_user_ns+0x60/0x60 [ 226.047543] ? __lockdep_init_map+0x105/0x590 [ 226.047559] ? check_same_owner+0x340/0x340 [ 226.047577] ? lock_acquire+0x1e4/0x540 [ 226.053541] QAT: Invalid ioctl [ 226.057565] ? rcu_note_context_switch+0x730/0x730 [ 226.057582] ? lock_downgrade+0x8f0/0x8f0 [ 226.057598] __should_failslab+0x124/0x180 [ 226.057613] should_failslab+0x9/0x14 [ 226.057631] kmem_cache_alloc+0x2af/0x760 [ 226.062668] binder: 13226:13248 ioctl c0306209 200007c0 returned -22 [ 226.065972] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 226.065990] ? kasan_check_write+0x14/0x20 [ 226.066002] ? do_raw_spin_lock+0xc1/0x200 [ 226.066017] ? fat_i_callback+0x30/0x30 [ 226.066033] fat_alloc_inode+0x1b/0x70 [ 226.075109] binder: send failed reply for transaction 338, target dead [ 226.077501] alloc_inode+0x63/0x190 [ 226.077516] new_inode_pseudo+0x71/0x1a0 [ 226.077528] ? prune_icache_sb+0x1b0/0x1b0 [ 226.077542] ? _raw_spin_unlock+0x22/0x30 [ 226.077557] new_inode+0x1c/0x40 [ 226.193230] fat_fill_super+0x20b5/0x4400 [ 226.197378] ? fat_flush_inodes+0x1a0/0x1a0 [ 226.201684] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 226.207206] ? vsnprintf+0x20d/0x1b60 [ 226.210990] ? pointer+0x990/0x990 [ 226.214521] ? snprintf+0xae/0xe0 [ 226.217957] ? vsprintf+0x40/0x40 [ 226.221836] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 226.226836] ? set_blocksize+0x2c1/0x340 [ 226.230881] msdos_fill_super+0x2e/0x40 [ 226.234837] mount_bdev+0x314/0x3e0 [ 226.238446] ? msdos_mount+0x50/0x50 [ 226.242141] msdos_mount+0x3c/0x50 [ 226.245662] ? setup+0xe0/0xe0 [ 226.248847] legacy_get_tree+0x118/0x440 [ 226.252893] vfs_get_tree+0x1cb/0x5c0 [ 226.256673] ? vfs_set_fs_source+0x12c/0x180 [ 226.261067] do_mount+0x6c1/0x1fb0 [ 226.264598] ? check_same_owner+0x340/0x340 [ 226.268903] ? lock_release+0xa30/0xa30 [ 226.272863] ? copy_mount_string+0x40/0x40 [ 226.277082] ? kasan_kmalloc+0xc4/0xe0 [ 226.280968] ? kmem_cache_alloc_trace+0x318/0x780 [ 226.285794] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 226.291314] ? _copy_from_user+0xdf/0x150 [ 226.295447] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 226.300968] ? copy_mount_options+0x285/0x380 [ 226.305447] ksys_mount+0x12d/0x140 [ 226.309056] __x64_sys_mount+0xbe/0x150 [ 226.313022] do_syscall_64+0x1b9/0x820 [ 226.316906] ? finish_task_switch+0x1d3/0x870 [ 226.321382] ? syscall_return_slowpath+0x5e0/0x5e0 [ 226.326301] ? syscall_return_slowpath+0x31d/0x5e0 [ 226.331212] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 226.336212] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 226.341732] ? prepare_exit_to_usermode+0x291/0x3b0 [ 226.346731] ? perf_trace_sys_enter+0xb10/0xb10 [ 226.351383] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 226.356213] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 226.361383] RIP: 0033:0x4584ea [ 226.364549] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 226.383718] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 226.391414] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 226.398665] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 226.405917] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 226.413166] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 07:13:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc020660b, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 226.420417] R13: 0000000000000000 R14: 00000000004d3d50 R15: 000000000000004b [ 226.434325] binder: undelivered TRANSACTION_ERROR: 29189 [ 226.440007] QAT: Invalid ioctl [ 226.474244] netlink: 24 bytes leftover after parsing attributes in process `syz-executor0'. [ 226.487528] binder: release 13257:13258 transaction 343 out, still active [ 226.494601] binder: unexpected work type, 4, not freed [ 226.499907] binder: undelivered TRANSACTION_COMPLETE [ 226.541544] binder_alloc: binder_alloc_mmap_handler: 13257 20001000-20004000 already mapped failed -16 [ 226.552786] netlink: 24 bytes leftover after parsing attributes in process `syz-executor0'. [ 226.558063] binder: BINDER_SET_CONTEXT_MGR already set [ 226.567159] binder_alloc: 13257: binder_alloc_buf, no vma [ 226.572778] binder: 13257:13265 transaction failed 29189/-3, size 24-8 line 2967 [ 226.577367] binder: 13257:13258 ioctl 40046207 0 returned -16 [ 226.589227] binder: send failed reply for transaction 343, target dead [ 226.596442] binder: undelivered TRANSACTION_ERROR: 29189 07:13:03 executing program 6: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f00000001c0)) clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000080)) mknod(&(0x7f0000000040)='./file0\x00', 0x8100, 0x0) execve(&(0x7f0000000240)='./file0\x00', &(0x7f0000000040), &(0x7f0000001640)) r1 = syz_open_procfs(0x0, &(0x7f0000000680)="706572736f6e616c697479005d82a7336489ce5bda0a0fd81d814eb15432b3e583f4f58ba51cf65347e346e484375f3b177c09b3ee9b0c6ce0e3cc7e64c3c2f573c428867a4d951c87cc1fa9cae30a9ffbfbfacd2225d361be19813b9e68acf48d347c6b555a3e1966d01843c9d2ada1756f47af2b2c258d55e7f160c7de2af9fbec1f20bc0a3cc530f466713fdf5a6578d7861a5dae4285985a4a105addaf3169870d02f2cf8769d76091230874707ad3d5c6818d9477671c483acc99af30b48c4210512ee897a9e894cca176f070ec022efc6fe11517d648f1d3b6aa7d858f893e9cba3ca0c3a8c2be36dc48ae9de49f89152074f7604f276665c232239ad8af449406ea4d17fd30a4aca89fbf9f88b0b67958b80634f40914a58f7f8ce6a61075436e6b685d8b97b1fb09822e1e8f4447ec62e4be7a9a587364747c3714dd79dc90a8a33a14eb14cbbf1cb7d145e4d29ea11518ee5c397b1a0b38d412d7cdfb3e12dcd5f780aed68f35d04446834d8cfaab2b1c871f54662ebf30c892902b6338cfb706d8db7273d97a816b4c23910cc5794a") read(r1, &(0x7f00000000c0)=""/245, 0xf5) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="a3d3a48dabb0"], 0x1) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000480), &(0x7f0000000f40)) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000340)={0x0, 0x100000000, 0x6, 0xb4, 0xffffffffffffffe1, 0x1, 0x10000, 0x133328f8, {0x0, @in={{0x2, 0x4e20, @multicast1=0xe0000001}}, 0xfffffffffffff3d4, 0x6, 0x4, 0xfffffffffffffff9, 0x394}}, &(0x7f0000000280)=0xb0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000002c0)={r2, 0xf1c}, &(0x7f0000000400)=0x8) open$dir(&(0x7f0000000080)='./file0\x00', 0x289, 0x0) 07:13:03 executing program 7 (fault-call:2 fault-nth:76): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:03 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000001b80)='/dev/qat_adf_ctl\x00', 0x2, 0x0) accept4$alg(r2, 0x0, 0x0, 0x80000) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@mpls_getnetconf={0x14, 0x52, 0x0, 0x0, 0x0, {0x1c}}, 0xff76}, 0x1}, 0x0) 07:13:03 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb08004500003000000000002f9078ac2314bbac141400450000000000000000000000ac1414aaac1414000000000000000000"], &(0x7f0000000040)) 07:13:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'team_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000018c0)={&(0x7f00000002c0)={0x10}, 0xc, &(0x7f0000001880)={&(0x7f0000000000)=ANY=[@ANYBLOB="3400000013000501000000000000000000000000", @ANYRES32=r1, @ANYBLOB="400000000000000014002b00100001000c007fff73acd85717518e4af5d6d6589c702655e8942d42d85bb537b59aad0860309ed91ead66d1a1e633756a3c7179734f7952827785db4cc140903a91bba6685cf199778715e033ff70e4717ff1f198cefd8c063dec7269491d24e11c3b1c87acac416a669353d9a3e8135a857975f079d55e9822e2629def2bfa715eba0c75555f18f012880899c75018cbbea5a5c23c11b131f6f822dbdb1519ddb21e61163749b3225bcf16fc659734fafd5f7f4e1eb3d133397b8a820e8b3eb62021eef27e", @ANYRES32], 0x34}, 0x1}, 0x0) 07:13:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5421, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 226.682636] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 226.706108] FAULT_INJECTION: forcing a failure. [ 226.706108] name failslab, interval 1, probability 0, space 0, times 0 [ 226.717414] CPU: 1 PID: 13273 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 226.725902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 226.735256] Call Trace: [ 226.737849] dump_stack+0x1c9/0x2b4 [ 226.741479] ? dump_stack_print_info.cold.2+0x52/0x52 [ 226.746680] should_fail.cold.4+0xa/0x11 [ 226.750743] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 226.755846] ? lock_repin_lock+0x430/0x430 [ 226.760078] ? kasan_check_write+0x14/0x20 [ 226.764317] ? __schedule+0x884/0x1ed0 [ 226.768205] ? kasan_check_write+0x14/0x20 [ 226.772438] ? __sched_text_start+0x8/0x8 [ 226.776579] ? map_id_range_down+0x1ee/0x430 [ 226.780983] ? __put_user_ns+0x60/0x60 [ 226.784869] ? __lockdep_init_map+0x105/0x590 [ 226.789366] ? check_same_owner+0x340/0x340 [ 226.793685] ? lock_acquire+0x1e4/0x540 [ 226.797658] __should_failslab+0x124/0x180 [ 226.801894] should_failslab+0x9/0x14 [ 226.805699] kmem_cache_alloc+0x2af/0x760 [ 226.809860] ? do_raw_spin_unlock+0xa7/0x2f0 [ 226.814255] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 226.818830] ? fat_i_callback+0x30/0x30 [ 226.822792] fat_alloc_inode+0x1b/0x70 [ 226.826667] alloc_inode+0x63/0x190 [ 226.830276] new_inode_pseudo+0x71/0x1a0 [ 226.834321] ? prune_icache_sb+0x1b0/0x1b0 [ 226.838542] ? no_open+0x10/0x10 [ 226.841896] ? _raw_spin_unlock+0x22/0x30 [ 226.846037] new_inode+0x1c/0x40 [ 226.849388] fat_fill_super+0x2253/0x4400 [ 226.853520] ? fat_flush_inodes+0x1a0/0x1a0 [ 226.857824] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 226.863353] ? vsnprintf+0x20d/0x1b60 [ 226.867135] ? pointer+0x990/0x990 [ 226.870659] ? snprintf+0xae/0xe0 [ 226.874092] ? vsprintf+0x40/0x40 [ 226.877527] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 226.882522] ? set_blocksize+0x2c1/0x340 [ 226.886575] msdos_fill_super+0x2e/0x40 [ 226.890537] mount_bdev+0x314/0x3e0 [ 226.894150] ? msdos_mount+0x50/0x50 [ 226.897848] msdos_mount+0x3c/0x50 [ 226.901377] ? setup+0xe0/0xe0 [ 226.904551] legacy_get_tree+0x118/0x440 [ 226.908593] vfs_get_tree+0x1cb/0x5c0 [ 226.912383] ? vfs_set_fs_source+0x12c/0x180 [ 226.916783] do_mount+0x6c1/0x1fb0 [ 226.920314] ? check_same_owner+0x340/0x340 [ 226.924623] ? lock_release+0xa30/0xa30 [ 226.928584] ? copy_mount_string+0x40/0x40 [ 226.932798] ? kasan_kmalloc+0xc4/0xe0 [ 226.936669] ? kmem_cache_alloc_trace+0x318/0x780 [ 226.941502] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 226.947031] ? _copy_from_user+0xdf/0x150 [ 226.951171] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 226.956691] ? copy_mount_options+0x285/0x380 [ 226.961169] ksys_mount+0x12d/0x140 [ 226.964781] __x64_sys_mount+0xbe/0x150 [ 226.968752] do_syscall_64+0x1b9/0x820 [ 226.972626] ? finish_task_switch+0x1d3/0x870 [ 226.977119] ? syscall_return_slowpath+0x5e0/0x5e0 [ 226.982048] ? syscall_return_slowpath+0x31d/0x5e0 [ 226.986971] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 226.991975] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 226.997492] ? prepare_exit_to_usermode+0x291/0x3b0 [ 227.002488] ? perf_trace_sys_enter+0xb10/0xb10 [ 227.007139] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 227.011972] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 227.017138] RIP: 0033:0x4584ea [ 227.020315] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 227.039455] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 227.047153] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 227.054402] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 227.061651] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 227.068904] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 227.076157] R13: 0000000000000000 R14: 00000000004d3d50 R15: 000000000000004c 07:13:04 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:04 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) io_setup(0x8, &(0x7f0000000100)=0x0) r3 = socket$nl_xfrm(0x11, 0x3, 0x6) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) ftruncate(r0, 0x9) bind$packet(r3, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6}, 0x14) io_getevents(r2, 0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000)={0x0, 0x1c9c380}) io_submit(r2, 0x1, &(0x7f0000000600)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x800000000001, 0x8, r3, &(0x7f00000002c0)="41232a35cc928b74a2c69934913903510da421ccfb6ddce4e84d6b87c568f87359b426bbca1509d5c5e34fea4b109d386776eaf1c37008e48c991ae3a113f4349272101022df4ecca42ba5256085901b8ba3e9f174a618def4dcc7f05ce862155ecf4cbe044ae8b104a6a7b8b4b433d2862fe9ed1116a132c14b", 0x7a, 0x3}]) 07:13:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/ip_tables_targets\x00') ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000200)) [ 227.083835] netlink: 'syz-executor0': attribute type 1 has an invalid length. [ 227.101844] binder: release 13282:13283 transaction 348 out, still active [ 227.108871] binder: unexpected work type, 4, not freed [ 227.114166] binder: undelivered TRANSACTION_COMPLETE 07:13:04 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[0xfeffffff], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) clone(0x0, &(0x7f00000002c0), &(0x7f0000000100), &(0x7f00000001c0), &(0x7f0000000200)) ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae88, &(0x7f0000000040)) 07:13:04 executing program 7 (fault-call:2 fault-nth:77): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, 0x4, 0x0, 0xff, 0x0, 0x0, 0x1ff, 0xffffffff00000000}, 0x20) bind$alg(r1, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l-generic\x00'}, 0x58) dup2(r0, r1) syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x7ff, 0x131000) [ 227.146791] netlink: 'syz-executor0': attribute type 1 has an invalid length. 07:13:04 executing program 1: socket$inet6(0xa, 0x203000000802, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)='net/route\x00') [ 227.205065] binder_alloc: binder_alloc_mmap_handler: 13282 20001000-20004000 already mapped failed -16 [ 227.234057] binder: BINDER_SET_CONTEXT_MGR already set 07:13:04 executing program 6: pipe2$9p(&(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0x7, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000007002e2f66696c6530000000000000"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RREADDIR(r1, &(0x7f00000003c0)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RSTATu(r1, &(0x7f0000000540)={0x64, 0x7d, 0x1, {{0x0, 0x42, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x1, '+', 0x0, "", 0x9, 'trans=fd,', 0x5, 'wfdno'}, 0xd, 'security/em1@'}}, 0x64) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fdW,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',\x00']) getxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000300)=@known='security.evm\x00', &(0x7f0000000380)=""/19, 0x13) 07:13:04 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) memfd_create(&(0x7f00000000c0)='nodev\x00', 0x0) syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x6, 0x121006) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17, 0x0, "10dec303415fe113b503cf1ae125cffac7e0f30f657e036d8beab09fd20f016238cbff4c48bedba30ba1508f70d88ebe0a077b1bb29ee38b71b351d15ce4ec82", "c3174cfe994a28690400000062b7c9004aee287df2df38e5b25a3103f99993ff7f0000000000003ea7bee03ffb10bcdfd5757451a798594da244e7210c00", "a2b98fba2b259731fba7132ce30a6db82958009e4ff06da85422d63bc7d0db26"}) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "e1d3f877e5eae453e55d7d64d00d4901baed21f7de92a8669b38ccd6260857dbf5ae46354569636517b50f805ae208258dbb7d0abe8d208f0f1bcc885c8ba93c", "fe047b3177f4fc2eb04172daa8e7d1c4c4cf144a23173b6605afb988de9bbae0932dee7e07195d78f7ddd19a37cb5aa0a5629eef628582fba5bf4af44acfe059", "ee42e3ef1d1772a9432c220303b70b708ad791139c2982fccc5d747a3131995a"}) [ 227.254675] binder_alloc: 13282: binder_alloc_buf, no vma [ 227.260367] binder: 13282:13323 transaction failed 29189/-3, size 24-8 line 2967 [ 227.264993] binder: 13282:13283 ioctl 40046207 0 returned -16 07:13:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000001, 0x5) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8, 0x80000001, 0x7f, 0x8, 0x5}) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x0) fallocate(r1, 0x0, 0xb612, 0x3ff) write$cgroup_int(r1, &(0x7f0000000000), 0xfdaf) ioctl$fiemap(r1, 0xc020660b, &(0x7f00000001c0)=ANY=[@ANYBLOB="00800000000000003f0000000000000000000000000000000000000100000000f66f32c33d731505bc164147b1c80323d81fbc3fe9348c1e8852c4b5b941608279e9ba3f6830adcf3aec00e89fac44093498f0dae3c6c483d5bbbaf99ff5e1d181de74421e8ba5e1a6d428410906283c41dc9eef730d7de1922723e1b75d4b40e57d433b9b6f179e3dc4b1f02174f45609be4e590a42bb82651e9319245fe76c512da3bb144cfae8c36846f6b4756155cb4fc989"]) 07:13:04 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)="02") getgroups(0x7, &(0x7f0000000040)=[0xee00, 0xee01, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xee01]) setgroups(0x40000000000001d8, &(0x7f0000000080)=[r1, r2, r2, r0]) socketpair$inet(0x2, 0x2, 0x1, &(0x7f0000000280)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffff9c, 0x28, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={r3, 0x100000000, 0x8}, 0xc) 07:13:04 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x3, &(0x7f00009ff000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [], {0x95}}, &(0x7f00002bf000)='syzkaller\x00', 0x1, 0xb7, &(0x7f0000000440)=""/183}, 0x48) r2 = socket$kcm(0x29, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={r0, r1}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000004640)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000004600)={&(0x7f0000000640)=ANY=[@ANYRES16=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0x3}, 0x1}, 0x0) sendmsg$FOU_CMD_GET(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x0, 0x0, 0x0, 0x0, {0x3}}, 0x14}, 0x1}, 0x20044000) recvmmsg(r3, &(0x7f00000001c0)=[{{&(0x7f00000005c0)=@hci, 0x80, &(0x7f00000049c0), 0x0, &(0x7f0000004a40)=""/241, 0xf1}}], 0x70, 0x0, &(0x7f0000000200)={0x77359400}) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000500)={&(0x7f0000000240)={0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, 0x0, 0x0, 0x0, 0x0, {0x2}}, 0x14}, 0x1}, 0x0) sendmmsg(r3, &(0x7f0000000540)=[{{&(0x7f00000002c0)=@nl=@kern={0x10}, 0x80, &(0x7f0000000500)}}], 0x1, 0x0) [ 227.303052] 9pnet: Could not find request transport: fdW [ 227.341791] 9pnet: Could not find request transport: fdW [ 227.347828] binder: undelivered TRANSACTION_ERROR: 29189 07:13:04 executing program 0: mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x2000004, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0xef) r1 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x3) r2 = memfd_create(&(0x7f0000000000)='lo\x00', 0x0) r3 = dup2(r1, r2) shutdown(r2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r3, 0x119, 0x1, &(0x7f0000000080)=0x3f, 0x4) sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYRESHEX=r3], 0x3}, 0x1}, 0x0) socketpair$packet(0x11, 0x40003, 0x300, &(0x7f0000000280)) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000000100)={0x0, {{0xa}}}, 0x88) fremovexattr(r2, &(0x7f00000000c0)=@known='system.advise\x00') 07:13:04 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket(0x11, 0x4000000000080003, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x1, 0x80, 0x0, 0x1, 0x4}, &(0x7f00000000c0)=0x14) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r2, 0x8, 0x0, 0xfffffffffffffffc, 0x429, 0x7f}, 0x14) sendmmsg(r1, &(0x7f0000003e80)=[{{&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000340), 0x2}}, {{&(0x7f0000000040)=@nfc={0x27, 0x9}, 0x80, &(0x7f0000000e40), 0x0, &(0x7f00000002c0)}}], 0x2, 0x0) [ 227.353638] binder: send failed reply for transaction 348, target dead 07:13:04 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000002c0)={0x1, &(0x7f0000000000)=[{0x6}]}, 0x10) r1 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x88) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x0, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1a, &(0x7f0000000340)=""/232, &(0x7f0000000300)=0xe8) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x3) 07:13:04 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306225, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 227.456528] FAULT_INJECTION: forcing a failure. [ 227.456528] name failslab, interval 1, probability 0, space 0, times 0 [ 227.467808] CPU: 0 PID: 13342 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 227.476205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 227.480214] binder: release 13370:13371 transaction 353 out, still active [ 227.485544] Call Trace: [ 227.485566] dump_stack+0x1c9/0x2b4 [ 227.485583] ? dump_stack_print_info.cold.2+0x52/0x52 [ 227.485604] ? __perf_event_task_sched_out+0x2f0/0x1a60 [ 227.492621] binder: unexpected work type, 4, not freed [ 227.495092] should_fail.cold.4+0xa/0x11 [ 227.495114] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 227.498722] binder: undelivered TRANSACTION_COMPLETE [ 227.503886] ? perf_event_update_userpage+0xd30/0xd30 [ 227.503908] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 227.539495] ? __perf_event_task_sched_in+0x24f/0xbb0 [ 227.544798] ? lock_acquire+0x1e4/0x540 [ 227.548820] ? __find_get_block+0x79b/0xe60 [ 227.553288] ? lock_downgrade+0x8f0/0x8f0 [ 227.557515] ? kasan_check_write+0x14/0x20 [ 227.561798] ? __brelse+0x104/0x180 [ 227.565475] ? block_commit_write+0x30/0x30 [ 227.569847] ? do_raw_spin_lock+0xc1/0x200 [ 227.574242] ? __find_get_block+0x36d/0xe60 [ 227.578620] __should_failslab+0x124/0x180 [ 227.582941] should_failslab+0x9/0x14 [ 227.586801] kmem_cache_alloc+0x47/0x760 [ 227.590945] ? rcu_note_context_switch+0x730/0x730 [ 227.595980] ? check_same_owner+0x340/0x340 [ 227.600361] ? mempool_free+0x370/0x370 [ 227.604503] mempool_alloc_slab+0x44/0x60 [ 227.608735] mempool_alloc+0x193/0x4b0 [ 227.612735] ? mempool_destroy+0x30/0x30 [ 227.617086] ? __find_get_block+0xe60/0xe60 [ 227.622111] ? __lockdep_init_map+0x105/0x590 [ 227.626644] bio_alloc_bioset+0x3a8/0x700 [ 227.630779] ? __mutex_init+0x1f7/0x290 [ 227.634735] ? generic_make_request+0x1800/0x1800 [ 227.639556] ? bvec_alloc+0x2d0/0x2d0 [ 227.643342] ? check_same_owner+0x340/0x340 [ 227.647656] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 227.652657] submit_bh_wbc+0x14b/0x790 [ 227.656542] __bread_gfp+0x13f/0x310 [ 227.660240] fat_fill_super+0x1418/0x4400 [ 227.664375] ? fat_flush_inodes+0x1a0/0x1a0 [ 227.668679] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 227.674205] ? vsnprintf+0x20d/0x1b60 [ 227.677988] ? pointer+0x990/0x990 [ 227.681515] ? snprintf+0xae/0xe0 [ 227.684947] ? vsprintf+0x40/0x40 [ 227.688392] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 227.693388] ? set_blocksize+0x2c1/0x340 [ 227.697435] msdos_fill_super+0x2e/0x40 [ 227.701402] mount_bdev+0x314/0x3e0 [ 227.705013] ? msdos_mount+0x50/0x50 [ 227.708713] msdos_mount+0x3c/0x50 [ 227.712235] ? setup+0xe0/0xe0 [ 227.715412] legacy_get_tree+0x118/0x440 [ 227.719456] vfs_get_tree+0x1cb/0x5c0 [ 227.723239] ? vfs_set_fs_source+0x12c/0x180 [ 227.727630] do_mount+0x6c1/0x1fb0 [ 227.731153] ? kasan_check_write+0x14/0x20 [ 227.735373] ? copy_mount_string+0x40/0x40 [ 227.739587] ? kasan_kmalloc+0xc4/0xe0 [ 227.743459] ? kmem_cache_alloc_trace+0x318/0x780 [ 227.748294] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 227.753813] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 227.759332] ? copy_mount_options+0x285/0x380 [ 227.763811] ksys_mount+0x12d/0x140 [ 227.767422] __x64_sys_mount+0xbe/0x150 [ 227.771381] do_syscall_64+0x1b9/0x820 [ 227.775250] ? syscall_slow_exit_work+0x500/0x500 [ 227.780076] ? syscall_return_slowpath+0x5e0/0x5e0 [ 227.784998] ? syscall_return_slowpath+0x31d/0x5e0 [ 227.789927] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 227.795448] ? prepare_exit_to_usermode+0x291/0x3b0 [ 227.800461] ? perf_trace_sys_enter+0xb10/0xb10 [ 227.805123] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 227.809952] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 227.815127] RIP: 0033:0x4584ea [ 227.818311] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 227.837484] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 227.845350] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 227.852612] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 227.859864] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 227.867203] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 227.874815] R13: 0000000000000000 R14: 00000000004d3d50 R15: 000000000000004d [ 227.885591] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 227.898045] binder: 13370:13371 ioctl c0306225 200007c0 returned -22 [ 227.938607] binder_alloc: binder_alloc_mmap_handler: 13370 20001000-20004000 already mapped failed -16 [ 227.958569] binder: BINDER_SET_CONTEXT_MGR already set [ 227.963978] binder_alloc: 13370: binder_alloc_buf, no vma [ 227.968377] binder: 13370:13371 ioctl 40046207 0 returned -16 [ 227.969599] binder: 13370:13376 transaction failed 29189/-3, size 24-8 line 2967 [ 227.984747] binder: 13370:13376 ioctl c0306225 200007c0 returned -22 [ 227.992620] binder: send failed reply for transaction 353, target dead [ 227.999661] binder: undelivered TRANSACTION_ERROR: 29189 07:13:07 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:07 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0xc0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000040)={{0xffffffffffffffff, 0x3, 0x6, 0x0, 0x2}, 0x1, 0x401, 'id0\x00', 'timer0\x00', 0x0, 0x1, 0x5b, 0xbabc, 0x10001}) unshare(0x20000000) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000240)=0x8) clone(0xa0718a6924206ffc, &(0x7f0000001ffa), &(0x7f00000002c0), &(0x7f0000000280), &(0x7f0000000140)="10b92381d054e48ec9583f5bb423e8d098626b7744d036881471291d4e098ceb8600f780b892473f498201086a81b4a51c42cd67956da5046e4fb932072bccfa98c8bb98427247f06c2e5fc6e84934bb8adade89f4d0f326550d49ae67e0e55e1d7c9a088a0d422e65d9ec18b74a4357b99082d542cc50fd29273f3db8be1f61c41f1fe3b166c83419e17b559a91694108c657475198436f66d2651c7c662e6bdc7209") 07:13:07 executing program 5: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syslog(0x3, &(0x7f0000000080)=""/89, 0x59) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"866a4fd292cd217f2be76fbb003d4fa2", 0x800000001}) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x13) 07:13:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGPTPEER(r0, 0x5435, 0x8) 07:13:07 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x42) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000400)) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='GPLbdeveth0&\x00'}, 0x10) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000200)) 07:13:07 executing program 3: r0 = socket(0x1e, 0x2, 0x0) sendmsg(r0, &(0x7f0000db5fc8)={&(0x7f00004aeb5c)=@generic={0x10000001001e, "030000000000000000000001e526cc573c5bf86c483724c71e14dd6a739effea1b48007be61ffe06d79f00000000000000076c3f010039d8f986ff01000000000000af06d5fe32c419d67bcbc7e3ad316a198356edb9b7341c1fd45624281e27800ece70b076c3979ac40000bd767e2e78a1dfd300881a1565b3b16d7436"}, 0x80, &(0x7f00000004c0), 0x25, &(0x7f000016cf61)}, 0x0) r1 = socket(0x9, 0x80005, 0x1) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) 07:13:07 executing program 7 (fault-call:2 fault-nth:78): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:07 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0045878, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:07 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) open_by_handle_at(r1, &(0x7f0000000200)={0x8, 0x6}, 0x2) fcntl$setstatus(r0, 0x4, 0x2000) [ 230.200751] binder: release 13391:13392 transaction 358 out, still active [ 230.207920] binder: unexpected work type, 4, not freed [ 230.213224] binder: undelivered TRANSACTION_COMPLETE 07:13:07 executing program 6: socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000740)=@nat={'nat\x00', 0x19, 0x3, 0x3e0, [0x20000dc0, 0x0, 0x0, 0x20000df0, 0x20001038], 0x0, &(0x7f0000000700), &(0x7f0000000dc0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x5, 0x0, 0x0, 'ipddp0\x00', 'ip6_vti0\x00', 'ipddp0\x00', 'dummy0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xf0, 0xf0, 0x128, [@helper={'helper\x00', 0x28, {{0x0, 'sip-20000\x00'}}}, @state={'state\x00', 0x8}]}}, @snat={'snat\x00', 0x10, {{@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}}}, {{{0x11, 0x0, 0x0, 'ip_vti0\x00', 'bond_slave_0\x00', 'bond_slave_0\x00', 'team_slave_0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0xb8, 0xb8, 0xf0, [@ip={'ip\x00', 0x20, {{@multicast1=0xe0000001, @remote={0xac, 0x14, 0x14, 0xbb}}}}]}}, @arpreply={'arpreply\x00', 0x10}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'syzkaller1\x00', 'ip6gretap0\x00', 'bond_slave_0\x00', 'rose0\x00', @link_local={0x1, 0x80, 0xc2}, [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0x70, 0xf0, 0x138}, [@common=@NFQUEUE0={'NFQUEUE\x00', 0x8}, @common=@log={'log\x00', 0x28, {{0x0, "db4a5fba094ac2ac05a304d7b73b2427adfe7bdf9e15cd157aded7884b0e"}}}]}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00'}}}}]}]}, 0x458) [ 230.249319] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 230.276603] FAULT_INJECTION: forcing a failure. [ 230.276603] name failslab, interval 1, probability 0, space 0, times 0 [ 230.287943] CPU: 1 PID: 13401 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 230.288857] binder_alloc: binder_alloc_mmap_handler: 13391 20001000-20004000 already mapped failed -16 [ 230.296347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 230.296353] Call Trace: [ 230.296374] dump_stack+0x1c9/0x2b4 [ 230.296393] ? dump_stack_print_info.cold.2+0x52/0x52 [ 230.296416] should_fail.cold.4+0xa/0x11 [ 230.296436] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 230.335696] ? __sched_text_start+0x8/0x8 [ 230.339856] ? lock_downgrade+0x8f0/0x8f0 [ 230.344012] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 230.349554] ? __disk_get_part+0x1ec/0x320 [ 230.353801] ? submit_bio+0xba/0x460 [ 230.356314] binder: BINDER_SET_CONTEXT_MGR already set [ 230.357528] ? generic_make_request+0x1800/0x1800 [ 230.357547] ? trace_hardirqs_on+0x10/0x10 [ 230.357566] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 230.372057] QAT: Invalid ioctl [ 230.376870] ? bio_add_page+0xf9/0x130 [ 230.376890] ? lock_acquire+0x1e4/0x540 [ 230.376905] ? fs_reclaim_acquire+0x20/0x20 [ 230.376918] ? lock_downgrade+0x8f0/0x8f0 [ 230.376933] ? __brelse+0x104/0x180 07:13:07 executing program 3: r0 = creat(&(0x7f0000000340)='./file0\x00', 0x0) getpeername(r0, &(0x7f0000000040)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @rand_addr}}}, &(0x7f0000000100)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000140)={{{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000240)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f00000002c0)={@dev={0xfe, 0x80, [], 0x1c}, r1}, 0x14) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) fchmodat(r3, &(0x7f00000000c0)='./file0\x00', 0x0) 07:13:07 executing program 0: capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000804000)={0x0, 0x5, 0x0, 0x0, 0x4}) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f00000002c0)={0x0, 0x0}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x480, 0x0) ioctl$TIOCGETD(r2, 0x5424, &(0x7f0000000240)) get_robust_list(r1, &(0x7f00000001c0)=&(0x7f0000000180)={&(0x7f00000000c0), 0x0, &(0x7f0000000140)={&(0x7f0000000100)}}, &(0x7f0000000200)=0xc) 07:13:07 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f}}, 0x20) r2 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0xa4) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f00000004c0)=[{0x2b}], r1, 0x1, 0x1, 0x48}}, 0x20) [ 230.376951] ? check_same_owner+0x340/0x340 [ 230.389812] xt_helper: cannot load conntrack support for proto=7 [ 230.392258] ? rcu_note_context_switch+0x730/0x730 [ 230.392277] __should_failslab+0x124/0x180 [ 230.392295] should_failslab+0x9/0x14 [ 230.392309] kmem_cache_alloc+0x2af/0x760 [ 230.392327] alloc_vfsmnt+0xe8/0x9a0 [ 230.396873] binder_alloc: 13391: binder_alloc_buf, no vma [ 230.400069] ? delayed_free_vfsmnt+0x20/0x20 [ 230.400088] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 230.400102] ? vsnprintf+0x20d/0x1b60 [ 230.400120] ? lock_acquire+0x1e4/0x540 [ 230.400134] ? lockref_get+0x42/0x50 [ 230.400147] ? lock_downgrade+0x8f0/0x8f0 [ 230.400165] ? vfs_get_tree+0x36d/0x5c0 [ 230.404492] binder: 13391:13407 transaction failed 29189/-3, size 24-8 line 2967 [ 230.410593] ? lock_downgrade+0x8f0/0x8f0 [ 230.410604] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 230.410624] ? kasan_check_write+0x14/0x20 [ 230.417900] binder: 13391:13392 ioctl 40046207 0 returned -16 [ 230.419743] ? do_raw_spin_lock+0xc1/0x200 [ 230.419761] ? _raw_spin_unlock+0x22/0x30 [ 230.419777] ? lockref_get+0x42/0x50 [ 230.419793] ? mount_bdev+0x81/0x3e0 [ 230.419810] vfs_create_mount+0xe3/0x610 [ 230.419829] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 230.427873] binder: send failed reply for transaction 358, target dead [ 230.431429] ? may_umount+0xb0/0xb0 [ 230.431444] ? mount_too_revealing+0x124/0x5e0 [ 230.431467] ? security_sb_mountpoint+0x94/0xc0 [ 230.431484] do_mount+0x7dd/0x1fb0 [ 230.431498] ? check_same_owner+0x340/0x340 [ 230.431515] ? lock_release+0xa30/0xa30 [ 230.437151] QAT: Invalid ioctl [ 230.441439] ? copy_mount_string+0x40/0x40 [ 230.441478] ? kasan_kmalloc+0xc4/0xe0 [ 230.441499] ? kmem_cache_alloc_trace+0x318/0x780 [ 230.565515] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 230.571036] ? _copy_from_user+0xdf/0x150 [ 230.575166] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 230.580689] ? copy_mount_options+0x285/0x380 [ 230.585170] ksys_mount+0x12d/0x140 [ 230.588779] __x64_sys_mount+0xbe/0x150 [ 230.592737] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 230.598260] do_syscall_64+0x1b9/0x820 [ 230.602131] ? syscall_slow_exit_work+0x500/0x500 [ 230.606961] ? syscall_return_slowpath+0x5e0/0x5e0 [ 230.611875] ? syscall_return_slowpath+0x31d/0x5e0 [ 230.616807] ? prepare_exit_to_usermode+0x291/0x3b0 [ 230.621808] ? perf_trace_sys_enter+0xb10/0xb10 [ 230.626488] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 230.631320] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 230.636503] RIP: 0033:0x4584ea [ 230.639672] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 230.658859] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 230.666553] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 230.673806] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 230.681059] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 230.688322] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 07:13:07 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5460, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 230.695581] R13: 0000000000000000 R14: 00000000004d3d50 R15: 000000000000004e [ 230.703490] xt_helper: cannot load conntrack support for proto=7 07:13:07 executing program 6: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="45965a5c4f0f0000000030e1290fc622c476120f3c58ad9d2c9868"], &(0x7f0000000000)="47504c00bc3047eb525f484f89fc96dd6ca64da40ff023122e66f6", 0x0, 0xce, &(0x7f0000000300)=""/206}, 0x48) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000540)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000005c0)={0x0, 0x20, &(0x7f0000000580)=[@in={0x2, 0x4e23, @broadcast=0xffffffff}, @in={0x2, 0x4e20, @rand_addr=0x7f}]}, &(0x7f0000000600)=0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000c00)=ANY=[@ANYRESOCT=r1, @ANYRESDEC=r0, @ANYRES16=r1, @ANYPTR=&(0x7f0000000ac0)=ANY=[@ANYPTR64=&(0x7f0000000a40)=ANY=[@ANYRES64=0x0, @ANYBLOB="39c13fa542730195bbb5a46d629c324d728a1b9b01ac0be5423857562e2d17a319eb8084a088d2eb61d1f3067f4887f13ecc8033dbde5830335458579756e67dbf2ebe374d8c28c57f5860bdb09f4345de8057c932998d23a516c46980ef63"], @ANYRES16=r0, @ANYRESDEC, @ANYBLOB="0143a6fed8543a586a1f12f6314599c8ba605f522f591704d82e04b1beca65f29e0a686de8b3cce0e972d293c054866f467e819b6ddb76b62e1ebb115a9bb1dc24be4a6d2b053687f7840c2dc7f14b6211b111f6b5677d942c87cbc4ef84038a0bf98392d6ef1836e58811eac2b3258030802f3b69bce2f3e5cf19dac6736318538e07dcdb5faa2b7a3f9465bf88e07fd6f3e21997c39da69900c4d422b5bff8d751667015620a06372fc231", @ANYBLOB="e3b14c69f35514838762b8998a20dfb26c1118abe4353209f6b23e50da9122b900ba3719a9de7e11c6df1774432d303358f12506d41bcd2b2ae22429fde2ebf96c2314a547c2b27e471c63b5e4"], @ANYBLOB="96c8b6a2bee35ef8e5ccf0bd0e7644861eaa7093172fb934068329c35499f4"], &(0x7f0000000700)=0x5) linkat(r1, &(0x7f0000000880)='./file0\x00', r1, &(0x7f00000008c0)='./file0\x00', 0x1000) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0xce, &(0x7f0000000180)=""/206, 0x40f00}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xd, 0x5, &(0x7f0000000040)=@framed={{0x18}, [@jmp={0x5}], {0x95}}, &(0x7f0000000200)='syzkaller\x00', 0x9, 0x20d, &(0x7f0000000300)=""/187}, 0x48) socket$inet_udplite(0x2, 0x2, 0x88) signalfd(r2, &(0x7f0000000500)={0x3000}, 0x8) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000007c0)={'gretap0\x00', 0x400}) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x1, &(0x7f0000000900)=0x6e, 0x4) getsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000740), &(0x7f0000000780)=0x4) preadv(r2, &(0x7f00000009c0)=[{&(0x7f0000000940)=""/69, 0x45}], 0x1, 0x0) r3 = syz_open_dev$adsp(&(0x7f0000000280)='/dev/adsp#\x00', 0x1000, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r3, 0x0, 0x487, &(0x7f0000000800), &(0x7f0000000840)=0x30) getsockname(r3, &(0x7f0000000480)=@ethernet={0x0, @random}, &(0x7f00000002c0)=0x80) 07:13:07 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000c75ff7)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x80000040045010, &(0x7f0000789000)) ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000000)) [ 230.770606] binder: release 13438:13439 transaction 363 out, still active [ 230.777650] binder: unexpected work type, 4, not freed [ 230.782988] binder: undelivered TRANSACTION_COMPLETE [ 230.787211] binder: undelivered TRANSACTION_ERROR: 29189 [ 230.795836] binder_alloc: binder_alloc_mmap_handler: 13438 20001000-20004000 already mapped failed -16 [ 230.833371] binder: BINDER_SET_CONTEXT_MGR already set [ 230.839825] binder_alloc: 13438: binder_alloc_buf, no vma [ 230.845533] binder: 13438:13441 transaction failed 29189/-3, size 24-8 line 2967 [ 230.850705] binder: 13438:13439 ioctl 40046207 0 returned -16 [ 230.892306] binder: send failed reply for transaction 363, target dead [ 230.905717] binder: undelivered TRANSACTION_ERROR: 29189 07:13:10 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:10 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f00000000c0)) r1 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100), &(0x7f0000000140)=0x4) setsockopt$sock_void(r1, 0x29, 0x400000032, 0x0, 0x13000000) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000180)={0x8001, 0x3ff, 0x800, 0x4}, 0x8) r2 = getpid() prctl$setptracer(0x59616d61, r2) dup2(r1, r1) dup2(r1, r1) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xe0000, 0x200) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x80002, 0x0) 07:13:10 executing program 7 (fault-call:2 fault-nth:79): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:10 executing program 0: r0 = socket$kcm(0x11, 0x3, 0x300) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000040)=@l2={0x1f, 0xffffdd86, {0x1}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000001b00)="c3e43ffd4056ed231d3ef9225b989eaa0f6c4d552ca38e0766a0f2a1b83d8ad6c47e75f88d07a5b35f16d47e7cf2dd1b977b74723fcfd222f6d099d733f0e6960f7ed4e42de2ba837f795cbe011699f9d0a1a7fce4048c5f4eeceafe25c1a8145dc3895c6c8a51fad53d5bbd694a11de33a5320c0e567a1119978b2597ede6cecdf811a859bf254a10e8a4e213330b09c78f0b91c30baf7489c50ed28a4a730993851ff508c6da45630d3aefe6e68e0670b0821e1a8673d7467105e48915dc14f0e2f07caeecf695ce1ad31e0dbd20e041c42a92bb4af4c35f4146d1ff2260be297149468a838fea62565c030792d39b515ff05b60f5dbaeb79f03f5ce2ac8fecc94a3fcfa442325cc3db10bbad4d72f569fce5c7cf812de469614cdcb1cbe1d49683b8afcaba32816f2aff78721531722f32c1396a9331c288e1349fc98fb1530d692d588942270baaca2a37bc5eb15b9b74a68e4a2f6ad371143aa0e14eb41b58bbeb69224515f47bb789ace2e37360566836bc7933370858380bf38b2b78ab9735d8aac5abccc94eb190cf6f89f7267c6f6f437740f87a5d8dca55cccd3a6a1b132de6fab92487938f06782ddd26e72e5704726311d360fd84d7d9021f77135666b1c0a667efc5ba1923d127f04a01f909125bcb3c2a9bee922638682814da71d434b8d78f398bbb4ea5812a59b5263eadd02aa932550c2d298223d516a98db664b54ad6007eaafe86e4bc3a338ad9ee46f4febb2e0f5b07dae061264c25e0d836e144a4b6cc1d2a9b84c695400344dd6e58a864edb5dfb424cc0bd844d0060306d803c7e28841998f9ba2553439b6faad5dffe7c293944f454f6722fc0affaf9b58abfd1c514ec31339f42acbefaae02e02459212cb700395c31d85805fbb57a5f11736d4692875901fcb115ce4e052de69c597e7db29d2dc34dfcdd8faff03caa24d6f1f88e000197ddbcf6c5a34748ae16e3fb0ae035633715292bf22f31fc42ddd2772cf2746b95b7c8a1002a176872797285779794e7c62a2af94ed1983139eae5e2fdd39162cb3596918c49dcb3ae07563dec7d5eca8774a385af2ed882dfe6c884d8885dfcc17f08cb57da485e8466db20384e5bb4ccf7619fb8288f8f611e3be247af0f849bbbc43244042237152a5e3e0ecb03197ab76fc91229a6961d700e16393eb457465452901f9f5f508bce75172cdf231d8dc7e4ee51103013a7d02321a1f676f6ff0ecb4a5e164ec9563282d1b00caa00ffffbb00ca0762e98cddcffd4a43aaaf30e4522b6f28efe18ef5baa78a6e209aa3fe95ac2bff2597036e307cee385f3fd03e12e7f249663ba58ec7cd9f309f44aca5f1a7387a2f06ff403b345b519cadfe05446061f796b568097005e8b276f42acd6a7f2bb99d74f21fd42e520b83aef3bd23ca6bb6978f25705ff46aa3ac6d08280169372efa0e911eb2e88565b64e320a5175f3211448ca0617e6bbe760ab7a51a1003c8d41b47a8fcd591d94efeef1df776540d7b921b41ed1fe8b059831e7213e4680eb216682a3a251d7ca80ee728c5c0a1b76148498c8033467fc104d7a83a5bc29fb05aba5392e7d02dcc89269506b1d9bf0f49f6393820317517324fc12728da86c99bcdda07dee9383b6624d6854bc3517de4774132cab5a4586f670ed689f2cd0585d61ca73e32ca4061a55c951d9489baafa7701ea5ab5332db336426dd296ed421bc564608ce18b61d3e3ee52b0a1e67d0f2b596268ec5b8bf8dfd65e495c1672f6c6dc77b697700c77f05a000000000000004c9d52e1ef3946fbef9ab2795cf342b3fb6257826ba5434bc41ec70d7f77a8257419bdc9bbc9ee635c3544a5251e56259d7e44d92f52f56343f3a12a53f5b42eec1444f1b27bb6181cd8c637d808f20c9a00cfd21d6764677eb2ca8f5c9ed06dd8e08fcf3595076215120b39f4f9f36a614ddcbcc5f9d2cc834efd9771598a11805a66cb5d90958acaf023462b7f55be9f75c9b326d60fe0c045b692cba3afe63bde8cba979c3019bc3167e5dbaefcb8832a66ea0e9dcc4bc27e883e8c21e42bd7e2a0c250c194e23ab7a3e978af51ca9a238b512b292dc2018dcce9e5b7984e483610998c8c60d29eef1db803d00aedfb56adac960bbbdd3202ce724cf800eb81830224b80baf7686880e37f2c9eaf241c88b8a402e09850dd68dfbe09798d07bc9018722af51e93c6c56423c8676e961a8750f6569c7f3a8bd963b3cda866095a266f64f237dc3cec21f5bc8c8e8d3021a675074606e733be6437ccf672d636b8e6a727e8a708c69e7eaf88a6b30ee20c166f58583c811b48a062d4d3cc4fa824708c41d7173246d838b8ad925d41adeda77fabb4b8274023031faff4c34738f9e01cf4c58bd301e07c5a2b3312652898db5573a850ebd76c74ddef96047c4bbb79162fb5c1750f07fa7844437c61d5954e47c8ae22be54d575393dd1812e54d9e3addc450263f348f363882a19439cb36c9944feedac8275b2435964b451e1aa6b1f2328d7ba946d12e9ecaa959cb5f64b0a62bd26079c75fd1a9e2ed40ecdd9b7dbfb8f4644cf3e06d7a3efb5dfd3107aa8ce9f5923f3bed0e3dbf4cb1d04cc994d09a5e489e52f219adae32a163d84b3ad702c71459a5079050424cd8347054fc568abb5b5d0eee60a070111b29c5c310d617c1d535ab30f46a6f3391a407dd8a21be73e62447f8302b4ca4626178c620371613d5b6180eaedf7f8d53c02f23cc297571649f4cc8670903f259ce745f701e36b0c03ce3e9972240839fff32185ceaec42e723d0820041d8edcaa8129874565bcd289b9eed1719decf484777c020410d206df5d6709d7e1333d6b25b175161b4d431e784eb2101dc3188d01757f16030800896fa8f4000e39303c8488091c08fffd83e28ce10babfaed431adff270067c0b59a306a48495833b8da0f68eda9e8e5b666dabfc95232d749a53342a1371949c8312e59a5110dc939ac26f9752bdc563b7aa0206466a5af1e23e7da70f3e2b23d9ae2b33e83192c3f1afcfcdf3c85944169349be9403708e296f2c64b328568ab12a1017231f0e61df24d7cecf08b86678ee1de346c06d205f704dfbd705b94d6a379376a77a7676056db9673418ae4e5a085904536713055c45cded1efa9a73d2923cde2218e7072bfc0990de26eb4549caed6b04e7d9ce74df01a5c92c8cff2951f2a78f03fb2e92721eebadb8d8f946f26076b9ccb48a666505ce69dba71044fee4a8dd5330284125dcdae2be63f3e7f5d476d3a602a58bf80dae28c1ca74fc9bed05355f186cb2e85917cb2e392a502f283fe26626b1906784a46b2fa0f25ebf510f84cf4c61015dbfcd6f126f312ef8c538e3c5d52e75453d8eca8b857ff824ccebf2e0fff7a7d8797819cc6432c04fab35d21705a191cb679bb9731eae03449a116273c9406139e9d53342818a8e6ffaf3e327da2b66abce24d864ed424b980fb8be39fa836dd433eb6c03770ed7caa0a88acc4809bd1abd7ecfefde641f48ee630b5488d5a1b886db5e9b17fdce859183752551f15799c4abbcc5654d99b94de02fcf3dffe5f13115273a59d860aa4ce0af77e9272184aee18304df22ee1378d106e8f24161bc5c17b1d4d7aaee839856cce59d201b72abab79b6dce630e015e8845282bd36a57f5313e5a4443eeb7d5e931243acd43eea5d389d250887b738f02115a391d741dcaabfa862bf6a9d61611d47e7d97276dcc5d07712e8a0c7fcd5472cf611b30d4e4987ca7919628505d897edde330287daf97e85c7bde5c6e43fdb65429342985a323a47de750bbf313f448fe8639395540d46c7ef049d640a5c14cfcb74edd64320d2adc8a4ec4d9e5613192bdcb1db8b4319973740acf30e98da2d9049a98ce8a1371923e4f768f772668be2a244ce1d3a03a525c927deacc492838731163f6893b4652bde3ba79c94b08cef8d7023fd181ae077c40ff420e45b15fdfe94eaebe2fa3143292b4727dc4829fe5e973f997b024c48ba3d1b51ba7fa3fcb92c150389c2650c16a11e4b1ac06e20f78c385b487f90d4cda62182fc628e30e61ef32a881601967bfae82de2cce59009f6ed00467656c8b7be4f464ec44d6028ff5f51bf84346b0aee754ec07b59d27209b0ab770b523f75a54f8a4b27b05a912b6b9f9617a7b027dd0e06c6a5f216d2fad73cc551db4a2d345cbec5fe90f0e9b15352c31fa6090e0d62acfe11e9ee40ba2b650dac681dc0c9b93991370310d3a53b53951f7dd9f7805838d0afefcf22051118a22455b73729918a69f62fcc43ec3e93507c852fa43922d29fec7caefddcd454410891a777764b505acebb005d51b41f591b81ef5f9eb0acabb0a32fbb094259bbc2c895627209aa2320c0ff90071e1af8161a4a173fdeaed6dfc1a54452e0c0b04f27b295dfff0e6ad9fe6e16f8cd4d7272d9694577f30232644bb5627acdd4ad9ce524748f73c934dbcf3701b652f4b22b5e01a73b46a60334517d7b9b9afacb76611aabeb046dc3230e0709178903bf5cafa67e5112ae2d5d7b5d2ec005c8c8333cb047df060e37ec4993fe14d781fc7dc49aa4caa5cddc0dd66a63608e29333a329ea9d5fa37e41b180b914df864fcc825718055df81c17f1546235b7024c22ad72bbfce74881445f28311ba6f4352ea02cac2e66ad0cef9ee836fd9403bda285b89cd18337ef75fa7e18cd4100536eed14693b514917363fa87c238ecf738f052c28c529d4976c940ecd937e1e390d4e6ad9ccb698c00af1373445e14581e9d3bd361f5eca3415a6702cb73bb8475256b05ee4d6c83cef7c97bde3af5d56852eaad794998d76d48623a4a4d66a0ceeee01e5fcba750016eca1dce415fce070e64084ec29d0115b7211a9990af24cd307287cbca362f2e2143f5934162c18340317d4c9fe40f00bb9e617c21ea9dded9c9a8ab300ce8cb1d8c538aeb251df853467c48f400e482296e0f59b2b24dad67a54d7d2f14cab33dfd8a0551f97f704f079b16cfd02ab971c9a6619efb163c79eaff08cdc54b2e165cd57df8f734a52e34200f1fa520cf6feac834b33c035b802169972fc52190e14de89ba8392da19f0c99a7212c685f5591ee3cfd8c7206a6ca4a52e48b7df9668872f1ea508417e69c1dd73e55d372307b575f72f164c4a3cce01c84c87c8fbdf954efafd80c8d16dcd27c39adb74279f826dd825a4ef0ea423a3c29e6349800782d438c971273977442806965da70d26e5a14ec5c47e411488b481d7163d0e76c756d8a616f63f4e31857bac8a1092c9f5afe609ee5345cb976e53fa216735c6100dc39f6982ac40e4e382ef941c48a448e19dddfe7395654fda79faa1418e396e99af4bd8db41e824128718ce7edb144f6a19e65a8cc2fe575ec396e0d7834def8667757b349792a22de0ecc0d3777aa5afa457ae3a269b8d8eaa4dd713ea5ca5e38c2dc6f4d9e1edb3f8167a94ca8ecef36941d25e5c7008ce7ffeec014edcca829bd225eacedd27a08d76c9fb3ebe9aa3d613da37e1ab15f04420c1524eaf0c1bfa469cab6506574010722a1cdc74268a005556247b45d8e6bef5fe1af07860388f65747ea4c6e3ac63a1b31a6298c8059fafdaaa88a95a3404d5d3556826eafb78f0915ed4da18e8c1c917ae8db61ac2cd49495e1dc945ac4a83a082ecac5b241f5a31fa22250d29b7ba47d378b59aa3657a73375b825f82aab3fe495c91ae9e8baaa93c532343a225f5acd96c18ac31a5742bfaf50057f5cfddc8b0256da3", 0xff0}], 0x1}, 0x0) r1 = creat(&(0x7f00000001c0)='./file0\x00', 0x100) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000200)={@remote, @loopback, 0x0}, &(0x7f0000000240)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000280)={'vcan0\x00', r2}) stat(&(0x7f0000000100)='\x00', &(0x7f0000000140)) 07:13:10 executing program 3: clock_adjtime(0x0, &(0x7f0000000040)={0xb7, 0x0, 0x200000000000000}) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) 07:13:10 executing program 5: syz_emit_ethernet(0x42, &(0x7f0000000100)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @local={0xac, 0x14, 0x14, 0xaa}, {[@timestamp={0x44, 0x18, 0x7, 0x3, 0x0, [{}, {}, {[@empty]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1=0xe0000001}}}}}, &(0x7f0000000000)={0x0, 0x0, [0x0, 0x1000000000]}) 07:13:10 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x0) tee(r2, r2, 0x7, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000698000)=0x11) ioctl$TIOCSLCKTRMIOS(r2, 0x8910, &(0x7f0000000000)) 07:13:10 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40049409, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:10 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x181200, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000080)=[@in={0x2, 0x4e22, @multicast2=0xe0000002}, @in={0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e23, 0xffffffff, @empty, 0xfffffffffffffff9}, @in6={0xa, 0x4e20, 0x3ff, @dev={0xfe, 0x80, [], 0x15}, 0x20}, @in={0x2, 0x4e24, @rand_addr=0x5}, @in6={0xa, 0x4e22, 0xcd, @mcast1={0xff, 0x1, [], 0x1}}], 0x84) clock_nanosleep(0xfffffffffffffffe, 0x0, &(0x7f0000000040)={0x77359400}, &(0x7f0000000280)) [ 233.215415] binder: release 13463:13465 transaction 368 out, still active [ 233.222493] binder: unexpected work type, 4, not freed [ 233.227828] binder: undelivered TRANSACTION_COMPLETE 07:13:10 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x8) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000140)={0x0, 0x1, 0x5}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000240)=@sack_info={r3, 0x400}, &(0x7f0000000380)=0xc) setsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f00000001c0)={r3, 0x400, 0x0, 0x1000}, 0x10) r4 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x6, 0x20002) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f00000002c0)={r3, @in={{0x2, 0x4e24, @loopback=0x7f000001}}}, &(0x7f0000000000)=0x84) write$P9_RLINK(r4, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7) readahead(r4, 0x7f, 0x2b) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000016000)=[{0x28, 0x0, 0x0, 0xfffffffffffff030}, {0x6}]}, 0x10) 07:13:10 executing program 1: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'veth0_to_bridge\x00', 0x0}) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/42, 0x2a, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x10000, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000140)={0x0, 0x0, @ioapic={0x102000, 0xfffffffffffff19f, 0x8e6, 0x6, 0x0, [{0xfffffffffffffff8, 0x2, 0x9, [], 0xffffffffffffff7f}, {0xff, 0x2, 0x7, [], 0xc5}, {0x3, 0x8001, 0x5, [], 0x8}, {0x100000001, 0x0, 0x100000001, [], 0x1000}, {0x2, 0x401, 0xa9, [], 0x5}, {0x6, 0xff, 0x174c, [], 0x1}, {0x1000, 0x7, 0x80000000, [], 0x3}, {0x9, 0x59bf, 0x8422, [], 0x9}, {0x8, 0x4, 0x20, [], 0x3}, {0x0, 0x6d, 0x3, [], 0x8}, {0x1f, 0x7, 0x1, [], 0x1}, {0x4, 0x5, 0xffffffffffffff80, [], 0x5}, {0x3, 0x3, 0x9, [], 0x7}, {0x7fff, 0xe4ad, 0x2, [], 0xffffffff}, {0x9, 0xfffffffffffffff9, 0x7ff, [], 0x25}, {0xc6f000000000, 0x8, 0x10000, [], 0xffffffff}, {0x2, 0x2, 0x8000, [], 0x1ff}, {0xffff, 0x2324, 0x0, [], 0x7ff}, {0x1, 0x6, 0x8, [], 0x2}, {0x4, 0x1, 0x7ff, [], 0x800}, {0x3, 0x80, 0x200, [], 0x4}, {0x8, 0x7, 0x8, [], 0x3}, {0x4, 0x9, 0x7fff, [], 0xfffffffffffffff7}, {0x80000001, 0x0, 0x8000, [], 0x10001}]}}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000008c0)={r1, 0x1, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x10) pread64(r2, &(0x7f0000000080)=""/52, 0x34, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000240)={r0, 0x1, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x10) 07:13:10 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local={0xfe, 0x80, [], 0xaa}, 0x7fff, 0x2, 0x3, 0xd, 0x8, 0xff, 0x3}, &(0x7f0000000040)=0x20) rt_sigprocmask(0x0, &(0x7f0000037ff8)={0xfffffffffffffffe}, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='comm\x00') ftruncate(r1, 0x100000000) [ 233.258059] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 233.351875] FAULT_INJECTION: forcing a failure. [ 233.351875] name failslab, interval 1, probability 0, space 0, times 0 [ 233.363346] CPU: 0 PID: 13469 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 233.371760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 233.380610] binder_alloc: binder_alloc_mmap_handler: 13463 20001000-20004000 already mapped failed -16 [ 233.381116] Call Trace: [ 233.381137] dump_stack+0x1c9/0x2b4 [ 233.381157] ? dump_stack_print_info.cold.2+0x52/0x52 [ 233.402435] ? __kernel_text_address+0xd/0x40 [ 233.406978] ? unwind_get_return_address+0x61/0xa0 [ 233.411948] should_fail.cold.4+0xa/0x11 [ 233.416140] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 233.419370] binder: BINDER_SET_CONTEXT_MGR already set [ 233.421285] ? save_stack+0xa9/0xd0 [ 233.421305] ? __lockdep_init_map+0x105/0x590 [ 233.421323] ? kasan_slab_alloc+0x12/0x20 [ 233.438854] ? kasan_check_write+0x14/0x20 [ 233.443107] ? __init_rwsem+0x1cc/0x2a0 [ 233.447194] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 233.452233] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 233.457276] ? map_id_range_down+0x1ee/0x430 [ 233.461711] ? __put_user_ns+0x60/0x60 [ 233.465630] ? __lockdep_init_map+0x105/0x590 [ 233.465796] binder_alloc: 13463: binder_alloc_buf, no vma [ 233.470140] ? check_same_owner+0x340/0x340 [ 233.470158] ? rcu_note_context_switch+0x730/0x730 [ 233.470174] ? lock_acquire+0x1e4/0x540 [ 233.470189] __should_failslab+0x124/0x180 [ 233.470210] should_failslab+0x9/0x14 07:13:10 executing program 0: r0 = socket(0x1e, 0x4, 0x3) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000000)={0x3c, @rand_addr=0xdaf, 0x4e21, 0x1, 'sed\x00', 0x5, 0x1800000, 0x26}, 0x2c) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000180)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x6100, 0x0) fanotify_mark(r2, 0x2, 0x2, r2, &(0x7f0000000100)='./file0\x00') close(r0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0x7fffffff, @dev={0xfe, 0x80, [], 0x13}, 0x8}, @in={0x2, 0x4e21, @loopback=0x7f000001}, @in={0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e21, 0x2, @empty, 0x10000}], 0x58) 07:13:10 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000180)="910000001f160677671070") r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendto$inet(r1, &(0x7f00000002c0), 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) getsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f0000000080), &(0x7f00000001c0)=0x4) sendto$inet(r1, &(0x7f0000000140)="88", 0x1, 0x8000, &(0x7f0000000000)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp\x00') r3 = socket$inet(0x2, 0x802, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000280)={{{@in6=@ipv4={[], [], @loopback}, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}}}, &(0x7f0000000380)=0xe8) getsockname$packet(r2, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000400)=0x14) accept$packet(r2, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000480)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000600)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000640)={'team0\x00', 0x0}) getsockname$packet(r2, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000740)=0x14) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000a40)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000780)={0x280, r4, 0x400, 0x70bd2a, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x218, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r6}}, {0x8, 0x7}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xfc}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x52a}}, {0x8, 0x6, r7}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x14, 0x4, 'activebackup\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x37b4}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x34, 0x4, [{0x7, 0x401, 0x0, 0x4}, {0x800, 0xbe, 0x81, 0xffffffff}, {0x7ff, 0x1, 0x37, 0x7}, {0xb2c, 0x7, 0x4, 0x400000000000000}, {0x32b, 0x100, 0x1, 0x50264a98}, {0x6, 0x0, 0x8000, 0x7f}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r9}}, {0x8, 0x7}}}]}}, {{0x8, 0x1, r10}, {0x44, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r11}}, {0x8, 0x7}}}]}}]}, 0x280}, 0x1, 0x0, 0x0, 0x4008001}, 0x1) sendfile(r3, r2, &(0x7f0000000040)=0x42020, 0x80000003) 07:13:10 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x5, 0x0) r2 = socket(0x10, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000800)={'veth1_to_bond\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c000104000000000000000002000000", @ANYRES32=r3, @ANYBLOB="000000000c0001000180c20007000000"], 0x28}, 0x1}, 0x0) sendto$inet6(r0, &(0x7f00000001c0)="5abb29b3fd19f644fe123bfc2684620e16c9b1cb37917a1bec3ff3a4aab1cd5355e8aae2d0240754c598b2bc46ab8239e6fbce0733e83e0ef6a4b5063b2af378a6a11ca444f0f4bc1e8c0dccf209c118984657644e6b6743a5ca8af8d2f814bc195899c2df18204f091f00e03920691817646e2e187c49a71e0ced38f89ccf0aaf9cf00e373be6faa98e85353c4f222e8c82711b512fc7ca744161d9d8417d6001185d8ac995c6623921faea7a06ec", 0xaf, 0x800, &(0x7f00000000c0)={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, [], 0x1e}, 0x8}, 0x1c) sendmmsg$alg(r2, &(0x7f0000000140)=[{0xc, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) 07:13:10 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fe1fe4)={0x6, 0x4, 0x84, 0xf}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r0, &(0x7f0000000040), &(0x7f00000001c0)="8b83af5da28d0795f4acc7d5e507cab45b7891044f1835638e77994e0768ceb4a184d537b217d79a3ef83815816de3a4bdf945768b94c515f37d5e97c925c81eaa4f7f0e38d05d2f7f09f02dbf19474e3ea7d8d6dca4e45cae0294510e89e4fa1a755b4fd2a97452c9ac9998d0b7757cbd36b836281e8d821ee528c5eff0e26e2173518e32f11cbeba7c70274f90f3fee7bd8f27db", 0x3}, 0x3) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000040)={0xfffffffffffffe01, 0x3ff, 0x5, 0xc}, 0x10) socket$inet(0x2, 0xa, 0x2) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={r0, &(0x7f00000000c0)="bc6c0aabd5cd23a8be0fa102b4fc198cad37e5f17ff081658579b11f99de69a51907c40eb82856"}, 0x10) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x8102, 0x0) [ 233.475794] binder: 13463:13510 transaction failed 29189/-3, size 24-8 line 2967 [ 233.480062] kmem_cache_alloc+0x2af/0x760 [ 233.480076] ? do_raw_spin_unlock+0xa7/0x2f0 [ 233.480087] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 233.480106] ? fat_i_callback+0x30/0x30 [ 233.521733] fat_alloc_inode+0x1b/0x70 [ 233.521749] alloc_inode+0x63/0x190 [ 233.521761] new_inode_pseudo+0x71/0x1a0 [ 233.521772] ? prune_icache_sb+0x1b0/0x1b0 [ 233.521785] ? no_open+0x10/0x10 [ 233.521800] ? _raw_spin_unlock+0x22/0x30 [ 233.521812] new_inode+0x1c/0x40 [ 233.521823] fat_fill_super+0x2253/0x4400 [ 233.521840] ? fat_flush_inodes+0x1a0/0x1a0 [ 233.521858] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 233.521869] ? vsnprintf+0x20d/0x1b60 [ 233.521883] ? pointer+0x990/0x990 [ 233.521898] ? snprintf+0xae/0xe0 [ 233.521910] ? vsprintf+0x40/0x40 [ 233.521923] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 233.521936] ? set_blocksize+0x2c1/0x340 [ 233.521950] msdos_fill_super+0x2e/0x40 [ 233.521965] mount_bdev+0x314/0x3e0 [ 233.521977] ? msdos_mount+0x50/0x50 [ 233.521992] msdos_mount+0x3c/0x50 [ 233.522007] ? setup+0xe0/0xe0 [ 233.522024] legacy_get_tree+0x118/0x440 [ 233.522040] vfs_get_tree+0x1cb/0x5c0 [ 233.522055] ? vfs_set_fs_source+0x12c/0x180 [ 233.522072] do_mount+0x6c1/0x1fb0 [ 233.522090] ? kasan_check_write+0x14/0x20 [ 233.522107] ? copy_mount_string+0x40/0x40 [ 233.522120] ? kasan_kmalloc+0xc4/0xe0 [ 233.522135] ? kmem_cache_alloc_trace+0x318/0x780 [ 233.522150] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 233.522165] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 233.522177] ? copy_mount_options+0x285/0x380 [ 233.522192] ksys_mount+0x12d/0x140 [ 233.522206] __x64_sys_mount+0xbe/0x150 [ 233.522221] do_syscall_64+0x1b9/0x820 [ 233.522233] ? finish_task_switch+0x1d3/0x870 [ 233.522247] ? syscall_return_slowpath+0x5e0/0x5e0 [ 233.522261] ? syscall_return_slowpath+0x31d/0x5e0 [ 233.522274] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 233.522288] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 233.522301] ? prepare_exit_to_usermode+0x291/0x3b0 [ 233.522314] ? perf_trace_sys_enter+0xb10/0xb10 [ 233.522328] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 233.522344] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 233.522354] RIP: 0033:0x4584ea [ 233.522357] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 233.522561] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 233.522574] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 233.522582] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 233.522589] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 233.522596] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 233.522603] R13: 0000000000000000 R14: 00000000004d3d50 R15: 000000000000004f [ 233.609816] binder: 13463:13465 ioctl 40046207 0 returned -16 [ 233.613754] binder: send failed reply for transaction 368, target dead [ 233.613884] binder: undelivered TRANSACTION_ERROR: 29189 07:13:13 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1000000000013) 07:13:13 executing program 5: r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(r1, 0x89f2, &(0x7f0000000100)={'ip6gre0\x00', @ifru_settings={0x0, 0x0, @fr=&(0x7f0000000140)}}) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x3, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 'syz_tun\x00'}}, 0x1e) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000340)=0x1dd, &(0x7f0000000380)=0x1) ioctl$PPPIOCSFLAGS(r1, 0x40047459, &(0x7f0000000080)=0x4000) r2 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_pts(0xffffffffffffffff, 0x800) ioctl$TIOCGLCKTRMIOS(r3, 0x5456, &(0x7f00000000c0)={0x5, 0x9, 0x7fff, 0x0, 0x1000, 0x5cbe, 0x6, 0x9, 0xe3, 0x7, 0xff, 0xb5}) connect$pppoe(r2, &(0x7f0000000180)={0x18, 0x0, {0x3, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 'syz_tun\x00'}}, 0x1e) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 'bond_slave_0\x00'}}, 0x1e) r4 = syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0xfffffffffffffffc, 0x20000) ioctl$EVIOCGMASK(r4, 0x80104592, &(0x7f0000000300)={0x0, 0x9b, &(0x7f0000000240)="fea168676ddcc6d6afa5696952a10d7c938b4a6d4d7cd14254fb0118c700754569008ab63426018fff83c4eb7e4568f7da75914eb6343482b2df6c7ed78101e2b6f18cb4dbba99d0dc65cf354df94e8e89bc922affa3e80e5760eb0658bb13061ad7638a76aeebc0b0d4d0877ebddfcdf734ded3fb5633a56287976b0679e1ffec8ca2e2246a55f3cbe07cc5baa6a4f3e73bb1ddbbf5e3c4165afe"}) 07:13:13 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x40000010}]}) 07:13:13 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x200000, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xffffffff, 0x101002) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000000c0)={0x42, 0xc, 0x1, r0}) mremap(&(0x7f0000001000/0x1000)=nil, 0x7ffffffff000, 0x1000, 0x0, &(0x7f0000000000/0x1000)=nil) 07:13:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306263, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:13 executing program 1: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_udplite(0x2, 0x2, 0x88) accept$inet(r1, &(0x7f0000000100)={0x0, 0x0, @multicast2}, &(0x7f0000000140)=0x10) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="02030000160000000000000000000000040003000000000000000000000000000000000000000000000000000000000005000600000000000a0000000000000000000000000000000000000000000000000000000000000004000400000320000000000000000000000000000000000000000000000000000200010000000000100000000000000005000500000000000a00000000000100fe8000000000000000ff01000000000000e1c07c580fff08d42ffb63b56555d9b7220f3b1c32fa2205c24bd0d907e2c7a4fdf5d445b541e3ec21cada3233376b64d1fa091e5b0bf23a40030000000000000000"], 0xb0}, 0x1}, 0x0) 07:13:13 executing program 7 (fault-call:2 fault-nth:80): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:13 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000001380)='./file1\x00', 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f00000001c0)) r1 = semget$private(0x0, 0x0, 0x509) semctl$IPC_STAT(r1, 0x0, 0x2, &(0x7f0000000040)=""/139) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000200)) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000100)={{0xfff, 0x1f}, {0x3, 0x7ff}, 0x9, 0x7, 0x1}) 07:13:13 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x305, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) close(r0) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) write$P9_RGETLOCK(r1, &(0x7f0000000080)={0x3b, 0x37, 0x1, {0x0, 0x8, 0x8, r2, 0x1d, ',posix_acl_accessvmnet0cpuset'}}, 0x3b) [ 236.289154] binder: release 13561:13563 transaction 373 out, still active [ 236.296179] binder: unexpected work type, 4, not freed [ 236.301499] binder: undelivered TRANSACTION_COMPLETE [ 236.319945] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 236.333230] FAULT_INJECTION: forcing a failure. [ 236.333230] name failslab, interval 1, probability 0, space 0, times 0 [ 236.344568] CPU: 0 PID: 13570 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 236.352995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 236.362361] Call Trace: [ 236.364944] dump_stack+0x1c9/0x2b4 [ 236.368562] ? dump_stack_print_info.cold.2+0x52/0x52 [ 236.373743] ? __kernel_text_address+0xd/0x40 [ 236.378222] ? unwind_get_return_address+0x61/0xa0 [ 236.383146] should_fail.cold.4+0xa/0x11 [ 236.387200] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 236.392295] ? save_stack+0xa9/0xd0 [ 236.395912] ? __lockdep_init_map+0x105/0x590 [ 236.400408] ? kasan_slab_alloc+0x12/0x20 [ 236.404547] ? kasan_check_write+0x14/0x20 [ 236.408766] ? __init_rwsem+0x1cc/0x2a0 [ 236.412723] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 236.417731] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 236.422736] ? map_id_range_down+0x1ee/0x430 [ 236.427130] ? __put_user_ns+0x60/0x60 [ 236.431022] ? __lockdep_init_map+0x105/0x590 [ 236.435506] ? check_same_owner+0x340/0x340 [ 236.439819] ? rcu_note_context_switch+0x730/0x730 [ 236.444747] ? lock_acquire+0x1e4/0x540 [ 236.448717] __should_failslab+0x124/0x180 [ 236.452938] should_failslab+0x9/0x14 [ 236.456726] kmem_cache_alloc+0x2af/0x760 [ 236.460863] ? do_raw_spin_unlock+0xa7/0x2f0 [ 236.465276] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 236.469850] ? fat_i_callback+0x30/0x30 [ 236.473822] fat_alloc_inode+0x1b/0x70 [ 236.477699] alloc_inode+0x63/0x190 [ 236.481312] new_inode_pseudo+0x71/0x1a0 [ 236.485360] ? prune_icache_sb+0x1b0/0x1b0 [ 236.489625] ? no_open+0x10/0x10 [ 236.492977] ? _raw_spin_unlock+0x22/0x30 [ 236.497109] new_inode+0x1c/0x40 [ 236.500636] fat_fill_super+0x2253/0x4400 [ 236.504773] ? fat_flush_inodes+0x1a0/0x1a0 [ 236.509101] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 236.514625] ? vsnprintf+0x20d/0x1b60 [ 236.518420] ? pointer+0x990/0x990 [ 236.521963] ? snprintf+0xae/0xe0 [ 236.525405] ? vsprintf+0x40/0x40 [ 236.528851] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 236.533867] ? set_blocksize+0x2c1/0x340 [ 236.537914] msdos_fill_super+0x2e/0x40 [ 236.541882] mount_bdev+0x314/0x3e0 [ 236.546984] ? msdos_mount+0x50/0x50 [ 236.550691] msdos_mount+0x3c/0x50 [ 236.554219] ? setup+0xe0/0xe0 [ 236.557430] legacy_get_tree+0x118/0x440 [ 236.561476] vfs_get_tree+0x1cb/0x5c0 [ 236.565273] ? vfs_set_fs_source+0x12c/0x180 [ 236.569673] do_mount+0x6c1/0x1fb0 [ 236.573203] ? kasan_check_write+0x14/0x20 [ 236.577425] ? copy_mount_string+0x40/0x40 [ 236.581654] ? kasan_kmalloc+0xc4/0xe0 [ 236.585529] ? kmem_cache_alloc_trace+0x318/0x780 [ 236.590356] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 236.595882] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 236.601416] ? copy_mount_options+0x285/0x380 [ 236.605897] ksys_mount+0x12d/0x140 [ 236.609514] __x64_sys_mount+0xbe/0x150 [ 236.613476] do_syscall_64+0x1b9/0x820 [ 236.617441] ? finish_task_switch+0x1d3/0x870 [ 236.621927] ? syscall_return_slowpath+0x5e0/0x5e0 [ 236.626843] ? syscall_return_slowpath+0x31d/0x5e0 [ 236.631766] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 236.636785] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 236.642313] ? prepare_exit_to_usermode+0x291/0x3b0 [ 236.647324] ? perf_trace_sys_enter+0xb10/0xb10 [ 236.651989] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 236.656837] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 236.662018] RIP: 0033:0x4584ea [ 236.665187] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 07:13:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fchmod(r1, 0x49) r2 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x3, 0x200) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f00000002c0)={0x2, {{0xa, 0x4e21, 0xfffffffffffffffd, @mcast1={0xff, 0x1, [], 0x1}, 0x3}}}, 0x88) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000040)={0x8, 0x47c, 0x9, 0x0, 0x2, 0x1, 0xf0000000, 0x2945, 0x7fffffff, 0x1, 0x8}, 0xb) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000240)="640fbe0af0f75100ba420066ed360faa66b9800000c00f326635000800000f308221990fc71e27000f216d260f2134baf80c66b82735ea8166efbafc0cb06cee", 0x40}], 0x1, 0x8000000022, &(0x7f00000000c0)=[@cr4={0x1, 0xb987a233691e0619}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x10004, 0x0, 0x0, 0x2000, &(0x7f0000017000/0x2000)=nil}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 07:13:13 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xd, 0x4, 0x4, 0x100000001, 0x0, r0}, 0x2c) r2 = socket(0x3, 0x2, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000080)={r3, @in6={{0xa, 0x4e21, 0x1ff, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x10}}, 0xffff}}, 0x9, 0x7e4ae9a6, 0x400, 0x4, 0x40}, 0x98) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r1, &(0x7f00000001c0), &(0x7f0000000080)}, 0x20) [ 236.684367] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 236.692069] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 236.699322] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 236.706577] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 236.713839] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 236.721093] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000050 [ 236.734216] binder: 13561:13563 ioctl c0306263 200007c0 returned -22 07:13:13 executing program 6: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001600)='/dev/vga_arbiter\x00', 0x212002, 0x0) getsockopt$inet_int(r0, 0x0, 0x15, &(0x7f0000001640), &(0x7f0000001680)=0x4) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000040)) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000100), &(0x7f00000001c0)=0x4) 07:13:14 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x90, 0x8000) mq_notify(r1, &(0x7f0000000200)={0x0, 0x2b, 0x2, @thr={&(0x7f0000000040)="3217774752dbb903bd28e7af7ce24a171edb9d6627e7b47cc317c105bff0d140909aaf2e22fca6a2c23ff2e79715b597762c683c3099c75797186bb1fc86d2fe9121db0b3b8ef0c90c576fdc83b7f756af979c9fffb449bee1ebfe8626f263f7be7ca74b3381eff579a62216421052b031a665f1f68a5c9511c8d6dbfbb5f59ba7c1ee5ea1fd7016afe5da6826eb9e793285e3791318819a6b77045e57787e87560f1a7884489d35400150394cdf144d230a06cdd6a3", &(0x7f0000000100)="1e5aa585f2e515f84f951c1f36e8502e2f9ff80977392931a42ba878e3416bda4c6bfa458f7ea6c01116e382386616e022bbd2f5894a6e80ece1d9a3733af0a7e3cb55f58b264f287b74ff228942c92fd2ac9c391098315af48f987420564d03a6df401375075f2aa223dec7d2dd8078ebcf2691e4f1ed1d5a0454ce2218099a36c1b375accb6d60d5e7002680fb40bb56b54a9796d3bf87f2f0a822ed54f7f58947f0f6c46fe3e2bb16c81b0e19b8d46d84d706d0c1dedd981d01847879034337750e81e67032fb12dc90fee8792868653eb7a8a93f41e7d17f4a5501a9"}}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000013000)={0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000004ff0)={0x2, &(0x7f0000002fe8)=[{0x7}, {0x6}]}, 0x10) pread64(r0, &(0x7f0000000240)=""/56, 0x38, 0x0) [ 236.782301] binder_alloc: binder_alloc_mmap_handler: 13561 20001000-20004000 already mapped failed -16 07:13:14 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r2 = socket(0xa, 0x1, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$bt_hci(r3, 0x65, 0x5, &(0x7f0000000080)=""/244, &(0x7f0000000000)=0xf4) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x88) setsockopt$sock_int(r0, 0x1, 0xc, &(0x7f0000000280), 0x4) 07:13:14 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) [ 236.846847] binder: BINDER_SET_CONTEXT_MGR already set 07:13:14 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000600)='/dev/vcsa#\x00', 0xfffffffffffffffd, 0x400000) ioctl$SG_SET_TIMEOUT(r2, 0x2201, &(0x7f00000003c0)=0x5130) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2}}, 0x20) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000440)={'team0\x00', {0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}}) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f00000002c0)={0x2, 0xffffffffffffffd0, 0xfa00, {0x0, {0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, [], 0x11}, 0x2}, r3}}, 0x30) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000280)=0xc) perf_event_open(&(0x7f0000000200)={0x3, 0x70, 0x7, 0x0, 0x3f, 0x1fbc, 0x0, 0x40, 0x40000, 0x2, 0x7, 0xfff, 0x0, 0x2, 0xba2, 0x3, 0x8, 0x88, 0x8, 0xd3, 0x0, 0x1, 0x7, 0x400, 0x2, 0x7, 0x9, 0x6, 0x5, 0xfff, 0x8001, 0xfff, 0x5, 0x9, 0x7, 0x2, 0x20, 0x5, 0x0, 0x4, 0x5, @perf_bp={&(0x7f0000000100), 0x2}, 0x8, 0x5, 0x80, 0x5, 0x716, 0xff, 0xb2f}, r4, 0xb, r0, 0x1) r5 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x2, 0x84000) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f0000000640)=""/67, &(0x7f0000000380)=0x43) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r5, 0xc1105518, &(0x7f00000004c0)={{0x2, 0x3, 0xbcd1, 0x10000, 'syz1\x00', 0x4}, 0x0, 0x10000313, 0x6, r4, 0x3, 0xffffffff, 'syz0\x00', &(0x7f0000000300)=['@vmnet1%proceth1cpuset\x00', '/dev/infiniband/rdma_cm\x00', '/dev/infiniband/rdma_cm\x00'], 0x47, [], [0x5d, 0x3, 0x4, 0x6]}) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000400)={'ip_vti0\x00', {0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}}) [ 236.870164] binder_alloc: 13561: binder_alloc_buf, no vma [ 236.875839] binder: 13561:13583 transaction failed 29189/-3, size 24-8 line 2967 [ 236.901234] binder: 13561:13563 ioctl 40046207 0 returned -16 [ 236.922650] binder: 13561:13615 ioctl c0306263 200007c0 returned -22 [ 236.923428] binder: undelivered TRANSACTION_ERROR: 29189 [ 236.960621] binder: send failed reply for transaction 373, target dead 07:13:14 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1000000000013) 07:13:14 executing program 7 (fault-call:2 fault-nth:81): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100)="bd", 0x1, 0xfffffffffffffffe) keyctl$get_keyring_id(0x0, r1, 0x0) keyctl$get_security(0x11, r1, &(0x7f0000000140)=""/185, 0xb9) 07:13:14 executing program 0: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x2) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000040)={0x3, 0x1, 0x4, 0xffff, 0x3, 0x3, 0x5, 0x7, 0x8, 0x3, 0x7, 0x7fffffff}) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x7, @local={0xfe, 0x80, [], 0xaa}, 0x4f6}, 0x1c) r1 = socket$nl_crypto(0x10, 0x3, 0x15) mmap$xdp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x8010, r0, 0x0) getpeername$llc(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10) connect$bt_sco(r0, &(0x7f00000001c0)={0x1f, {0x7, 0x8, 0x5, 0x1, 0x3f, 0x81}}, 0x8) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000200)=0x1, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240)={0xffffffffffffffff}, 0x113, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r0, &(0x7f00000002c0)={0x4, 0x8, 0xfa00, {r2, 0x40}}, 0x10) ioctl$RTC_PIE_OFF(r0, 0x7006) ioctl(r0, 0x7, &(0x7f0000000300)="5a4abf58c0b69380beff422602d48ab28d6158f491c6e882f7fb6b6021cd495503e1cf0a397c4725c5a7d0da7d0ce33cfde5e1be27528e2c11d557bdebcdcc637b1337a9e705b8fa1c2a7b2406628df0707092b052ea5366a2902ec51fa493544592b5bf606f1e35f8a6774f5a733d38239570397a065b786aff87e4ff1f0642b3930bacafcf6674b39190155e52bc036a7365f6ffcceb6ce32be8c54bd33410747a9ddb658eb7f4d576cf1861bdd6cd626e5a1e0c4b") ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000800)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000840)={'team0\x00', r3}) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000880)={0x0, 0x4ce7, 0x1ff, 0xe1f00000000, 0xffffffff, 0x9, 0xdc, 0x9, 0x8, 0x2}) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f00000008c0)) fcntl$setstatus(r1, 0x4, 0x44000) accept4$packet(r0, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000940)=0x14, 0x800) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) exit_group(0x0) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000980)={0x4}) ioctl$TCSETS(r0, 0x5402, &(0x7f00000009c0)={0x5, 0x1, 0x4, 0x8, 0x0, 0xfffffffffffffffc, 0xfff, 0xffff, 0xe982, 0x89b600000, 0x9, 0xa00000}) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000a00)) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000a40)={0x1000, "8a0341f041a65fca108bb8b5a68acbb48d6602d5aa8584c9473cad9614c9e0de0e7693aa5d1dc413b6b1bfe20888343205d4e026b29c839454f9f5a5b4c81a470ac3503327f4bf03ab356371e9464025712bca848d0af3c86d9ccceb66c05a1fccfd9ea5792e2de008b8ba0ac9ba95d366d2e16ec587a8fb8f2459858826dd41c51f6043a65b8aa70f8560f950d46ed6de6cdf7471f3fcdd19d6f3ace6727e431b7b585deb7d14b6c52fc3afe5b0d53a0ead220fa823b88a6fe1500cc2880e5904378a4fbfaa5912dc806126603240dd0d6d214c842862ef2db28f2c6f6c6293cea18ebc5c6575b541a15ed3d9f747ff878d2efa18e1ef5e76662453206d1a4e6298e88285f37605063656f230fbe59105a90984a4d5b10b7ae0f22c69371ae013df2206401eeb7ac81327197a40b1a529e2aaa41ed8bba0784568b4b77f574d93c3abae8920f6a2a0a0218b87028256ed2047c78a27929349429d6bb0237c059937b1bdbbccd70eb6b91e7dbe6f785ad8ba1646adb5d946913e1063177c70b4587ba456c46a4f34d9c3c4b8f41d1903d7316d93f893a9d861b6fe9b20ff1c6ab4b0318d4bf6885353fceb5da294255b699692e85eed5f908a306fb8271ff818a1a776294534577b598483fb1496642b6a9947cfb7e9d2296ffa756e093551adb6cc84ca890981824f59da02678c85086279ffaa781e99dd906e8e143eb3e427d8413170e3981755685d6305919ff445f5755aadf9d9a8a5d80086b2dc511c85e5efb21eafea1b5ee2ab323414d80059e2dfcb17e9440da185354a8e32b4a79a40cfb5fadebdedb2a6966d2e57b7887df8dd2509b455ac279c1b661de834080d5a2e11896ee9f2a21f02f744f57bd8096c9b0c5c423f951e4a635032469e4e87d06c65746472c890f7512119ec4caf768939a156f247fea32ecf6879810e6524c628649487b897550ec428e7e261258e967f34be983ebef5f020e8521dfdb3f158083b0c178bce6849453b3972bcf25fea83163bb1ee30e6a0b30a0c21f1d82a4bcbdcee2b4290e1aecff4c643780c30199541f5bd86e69a584206c074e6d0a083bad6ea288cd55e0d541d74c413eef3d4fa51da949b238637b869258d9ff8f87d7fc51a5853ec84253926e6e41d2f2af2073c364712d9481071d8a2a1776ccefa709b277d5ef94f42e409238679b42e286ecacedbce1c6418cae98e9c7205eb15e05faafc2b5ab35ef30e9718cec50eb763b2b55e1ff56c83112f617b0f5cece98ea24d7a2db95d32727cca72f84477697b10834c1f1241d55f06d999449a423934e82b76e9e99f434f5af07c046552440ef0eebc194be197ab2fd80b5e67bec5483cef8b6f4c74af0e9da6c295578bac6f4ee9c1f0d260a759a853b6e3714bda8fd9daa5002309a9656cfe293bf4b05bb95fd482d41af198ad6b15c660e3c1e04b228cec45d93a97449fa85599413a3716a235d8871c5f8f7d0d4493bd2c8f9b4b24970fec177d0abbb37dbcf2cb6391c54e7c032a7c5b7f9aa8301b36cae5f776d1c53fc89428a1ea743f2e277fce48f91b1446173c8abdd1f847d66ba18c705adfad67f22484c27ccf7a2d90b8fa61708e5984a4d032b3e4a5eae83553abfd698262a0797dd818b546443a7c683ecbb4a68b9287cf3f927d00af7f1a9384471e75ef413ad2b8d8428e5e9021c1921f5f3d9c80231086bbaa6c43258411bf8155985ed8afbc6ae38ef02554e468d35ad2a47f2e208e97d70041e445101c27f811e4b25c8a81c9b2c873949f6559fa857ce5cc22a4a451d912deee0d8f5fbbd8c04de68c192929b6c0954d76ebee7940140abacbaa3bca5b7f97bca5098b9a427222b9c1a7f065a5cbb68001861d1612b186d5853fd3b73115c7d56f951c162f6eb37abe930c2b2b7361eca92766e47a386c8e4c2663ed6aa7abe826ffc703891fe443a01b7649dfdb45bd5bc45e7687c13474488a785c3c2ba15c1a2688367a268ae6ac7129f56cdaca8a07185f45b23aa0c97479c28e4af058e8bba64b63ae66dc24e98cd611239ca087283349bbf312ec50be5d9feb83c1d12ad0950dd6737f093ac8dad66e79c9418511ea92c823340af77dce1b3f7c13ef6b35b0d05162fc201face87dc00954cbb3dd898885a3089530d26fcc5628b8a10dd83aa7932f6da75cb50c44e7a133035af272e2a3cac8ae0a00d8fac0d5e699a1acdea9b4c27d04952a181eebd9f9255952fc953809905ce4aa930797bf4e1e6c6372d2f7a6ec8c2cd5a8497d1d9d14f111644578cf8e43354ed985a4d89689274c8ce847309cc558d42561fa320a4f01826739fe1a2c54bccbbd7b06c6ec20d97b8754fac1ab58436060088317f0a95e4ee5891afbc9a38e1129cda890150be6c0d2fd57bc8300e09209a26379be30860f3b75935cca7a223b261694e31be377f2cac0b916d3bf5443e2e26167523cfebb89906e4702d88edf980d8a531fb32aba64969032a596ab71fba634f5c2572ae89eee9b060988b2a77b28103d0a034ace710ed0a418f8d66ba427a499b716312f9accc7f26d09287fc592ff920e7628df043263f9622787b9bd43de4fc50bed8515b2048666fc33b5b8aff6eb1add6b696f248d4aee43b86e2c5cb95f33e2bed2bc6c57748bb8aed179f9228ffb8c2180711f1e381d75cf4f78023c656ee400123b06295b3a57910310f0bc79c9c7f40a0d027b713de61663bb2320d17d6c2160989e67ab4780de8333173998dec618f36bfcb988af4361221d55f81cf101b50e27b6779029124c07f5f70d0a25a75686d73efeb2410d1b3eb270f56f29d83e3c5140477b4a4708debc3f1f8d09af572444bf0a95d2e985ff088e7a641daabb421aaa48cad26f0a24338af1254daa12d033019d02e22e723e7e8d4bacde912c7e172d02e29169b6340a90ab666ae1e7c73c704046fca7d10355340cc9d393871272cc5597045aa455d5fcbff13f31409e56671401a686a91c3379b94ab7cebbf5f2f5c795df1e15283a8285720040bbf87a509cc41ce76dbb15619a5692567e946215eae7e72775a84a39d722fe0f90debcefc8a760cf81a921fbcab59f231af19f460c0cce2190a96b52e36ef0eacf93328f445338745686cdb034d7acd0d77d39e4cc47cbe5923ba8c22e8fa5184e41f76ee7145582e67268f029175a2629bebfd5592a07fdd8d9b9b836e2900353c5904b01f2d38ea768e73f560f3667fe3cae5ebad33860faafccb11e9070046b8d3f7167cccbb20214c79604af55d4ba4d46c65d677d05699855127067905584f63ed043d5a2e5ad99166cf7fea3689d7157aab8421f8a866a10df872c7cfd4deca902fefb2eafcba0fc09f282496919df8df16d1e89592e254444b7c34e019c2c03c299e08eb68aba4fdf1b3c89326f55c5414309ce4467334e15f3a8ccba3582c6c60e4d0e6ee032eb28899d2eec94a690c0762fa493853a5918e7e5930b8d89162c90fa50878fbd0625b21651afbc8c008904cf0ce745d080ef403063ce50499d571de9bc9b340b3ee4279c74a52b894821ca216ce785f662256af3df4f3037c03a4796101d6193fcda8ab34eb163ec64f7f74972b212da8021d835d64f5b693967e76a179a831804c5cd109225129244b70190df17baf70bd4a12957ac5a918c44799f7599431b084a829a40cf91d537854c8e1cabc469d835f900adfa8de13062408a2ba48a8ef98b44a5d737406796f2cdd16a39d3ff2aed2e402d5c3a4ce02af4504cfb97acb38ff095557b80b45a05a42b4a44eb944bfb45851e71f9acc605873fb09f47bc685adfc73c54cda74f1c5e12a7b3c4b62fab1ac9ce6f8bea0da5c11cb64eafb8b412639eb34f007f7eddc2701866afca3f8c98b3570da736dd9c4d20b779a25b311b46d287e263b35e873f041132447e44150726ab0584e77810c82af0ee90a7f22dda0a17f940cf7dcc4715b8a1c7cce6e0497a9e1e45967ba84a2fbdc939df8ab5f88505adcc944e05aeb34faad52bda32557329e0670a012bcc5713c58922e835ecfb4f806b1967e56f809c4d72fdd43f2d129d9494222039771f1dc314aba82f452f68ac363c3feb3578eb26535640181bb4a942c57fd9fdbf98846c4d9a962f9c8414e7a980123e927155b694ecbf24f681ebd971be849dda4711f7de010042f9e8eebbe250577f48a7ca370a589cf0875bc4894077aa4d178cc17353c0bf222d6432e74e18dc7ac44b75e473f3fc6bd6b1a0507c034118be5026a220ffa95bc821e5c7636d7820a51c651eadf07125c4128dbc642a796dd44d73f2642fa6ceb2361340ab14a8ee3f6cbe7529e9bfd9126e15a48257fc0ec7979d475ecdf298f79b295aab45207f7756160399b9cfcae65c5356f769ec6bef6b4e83b5130f02cfc9185469af2bcc4c393e98bcec475228cb4b80b82c54ae7c809efee16fd75ef37cc40180f8191782ead22f9e94cc80641b7fc3166fa327554d126f3e581c0d28addabcd50937db8e9eb03e64586f3758f3306f7836c58cdd070a98d29c3742be37507daea943d12cf7f2d560b737f943a7e27c9c12b29709744b54c603e4e1955e9304f1d669781f82c595727eadee625bc06d332f43d1ca10460d902783ed012b2c2004d609e643089511376bfaeee1e793de732a73ff6056bbacdb164b50ec00665b64b346d77f7b0137a894dbc19780a69e2bb8ba6a0bf5ba6e2eddfc2378c6bd15230034be7ee0fd4c129e5a8a4b4ea9d19188e26ea02fd0b95ecbd5159d6d3eb70a55f12b70009d9201fa2917287ace9c3be2bff4f73d27cf40ae19225d40c48c5036f89bc4342265cbc74f21d8919a0997fba1644740b30b0e284ac5066ac94c57647552daa4f7e79a198a7180518e41c6d6340432a16439604d8d5b33a8749c89df1b350c7a557d95a6dc64555bcbe59fcfe2bbf049ba068109e67d29ab5319b8dcfee80ff59a9fab061b00963fa05984cad42811a3ef123008ae4a72774269ee466dd64220c6daf9504b7a6eed059ede8974e42d5400741338aef3d7cfa2752fcaa9bba72a8ec6057806d3acb18aa6d30f015e6441ef55f768b60925ca68f4b707337eb581da2e622a48d2d418163a196519f30fa5821e4bbbf923ab30160d3e09a9888a054e7eaad0f19a272b2aa3e183c2c578e3f302c2a8c8dc4d3cba7ab1e3d1ff60b5b350b9ff882b9172e446e34c44c033627c8133bd6046bc02eb464fb77b19bb5d444dc5ddf330225ac1c0b543d064be2927acfbaa1c593a99a6f7f0f2a2813d713a2026a8a0b6267e282dc8de8e98b6aa7836ec6d04cfe0195c4bdeb9e765a5c278589b4e8a4b98a96e69895b0353362164d9f7c71444ad70fc7662bca563c7c1e2546a9f40063ea3e6bb9fb4d24ade4db99977319209b1bf6ab348225aa1db202a602b4b32f19bba4c3f88e261b32ff27e54c9e9599c3140b67b7d3c8821e029d661d3a5561864e5379b23fad8fe8ffc8f6a55e51849fd01381b11224c5cfca5b7ba8946aada0a3e0f8937b10909df45b22995f520dd9b8e878e57285b42417a1b9c969d6a5f5cf3dbe6326c4dddf51b23e12db52300f14f870847180bc3a030ae8e1f8d47ab9565d37dce32251c488c17a3199af2919e6011cb16a76e40655bbc29a624c145d40936e1daafe699be64407acf3fcbfdf6ea0b7863c17953ccd81043fe3b8edd607b23f4477f1e2ea659ce8781e51490b662f5c6cdfeaeddf72d09fff3823894953cb1c34c97c0d8052bfb43a1f8fa73aeb23f6f9bbbeadfc433ca4e3f5396e7657ca40a832bdd4bea"}) connect$bt_sco(r0, &(0x7f0000001a80)={0x1f, {0x631, 0x6, 0x6, 0x3, 0x4}}, 0x8) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) accept4$packet(r0, &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000001b00)=0x14, 0x80000) bpf$OBJ_GET_MAP(0x7, &(0x7f0000001b80)={&(0x7f0000001b40)='./file0\x00'}, 0x10) semget(0x3, 0x7, 0x100) 07:13:14 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc018620b, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:14 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x101000, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000200)='/dev/cuse\x00', 0x8201, 0x0) fanotify_mark(r0, 0x21, 0x1, r1, &(0x7f0000000240)='./bus\x00') sched_setscheduler(0x0, 0x2, &(0x7f0000000140)=0x8) mknod(&(0x7f0000000ffa)='./bus\x00', 0x1000, 0x0) r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000080)) fstat(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() fchownat(r2, &(0x7f0000000000)='./bus\x00', r3, r4, 0x1100) open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) getpeername$packet(r2, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f00000002c0)=0x14) 07:13:14 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047", 0x3b}], 0x1, 0x0, &(0x7f0000000080), 0x0) r4 = dup2(r0, r1) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r4, 0x40485404, &(0x7f0000000140)={{0x1, 0x3, 0x7f}, 0x2, 0x401}) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f00000002c0)=ANY=[@ANYBLOB="0100000000000040010000000000000018000000ff"]) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000001e00fb034d564b0000000001"]) ioctl$KVM_GET_CPUID2(r4, 0xc008ae91, &(0x7f0000000300)={0x6, 0x0, [{}, {}, {}, {}, {}, {}]}) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f00000001c0)={0x2, 0x0, [0x48b, 0x0, 0x400000b0]}) 07:13:14 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) mlock2(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1) bind$alg(r1, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha1\x00'}, 0x58) r2 = accept4(r1, 0x0, &(0x7f0000000380), 0x0) close(r2) [ 237.310120] binder: release 13644:13645 transaction 378 out, still active [ 237.311451] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 237.317191] binder: unexpected work type, 4, not freed [ 237.330807] binder: undelivered TRANSACTION_COMPLETE [ 237.332585] FAULT_INJECTION: forcing a failure. [ 237.332585] name failslab, interval 1, probability 0, space 0, times 0 [ 237.347207] CPU: 1 PID: 13636 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 237.355616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 237.364975] Call Trace: [ 237.367575] dump_stack+0x1c9/0x2b4 [ 237.371221] ? dump_stack_print_info.cold.2+0x52/0x52 [ 237.376428] ? __kernel_text_address+0xd/0x40 [ 237.380939] ? unwind_get_return_address+0x61/0xa0 [ 237.385887] should_fail.cold.4+0xa/0x11 [ 237.389995] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 237.395099] ? save_stack+0xa9/0xd0 [ 237.398716] ? __lockdep_init_map+0x105/0x590 [ 237.403200] ? kasan_slab_alloc+0x12/0x20 [ 237.407348] ? kasan_check_write+0x14/0x20 [ 237.411568] ? __init_rwsem+0x1cc/0x2a0 [ 237.415527] ? do_raw_write_unlock.cold.8+0x49/0x49 [ 237.420530] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 237.425542] ? map_id_range_down+0x1ee/0x430 [ 237.429953] ? __put_user_ns+0x60/0x60 [ 237.433830] ? __lockdep_init_map+0x105/0x590 [ 237.438312] ? check_same_owner+0x340/0x340 [ 237.442617] ? rcu_note_context_switch+0x730/0x730 [ 237.447531] ? lock_acquire+0x1e4/0x540 [ 237.451491] __should_failslab+0x124/0x180 [ 237.455712] should_failslab+0x9/0x14 [ 237.459498] kmem_cache_alloc+0x2af/0x760 [ 237.463636] ? do_raw_spin_unlock+0xa7/0x2f0 [ 237.468033] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 237.472606] ? fat_i_callback+0x30/0x30 [ 237.476567] fat_alloc_inode+0x1b/0x70 [ 237.480450] alloc_inode+0x63/0x190 [ 237.484060] new_inode_pseudo+0x71/0x1a0 [ 237.488105] ? prune_icache_sb+0x1b0/0x1b0 [ 237.492324] ? no_open+0x10/0x10 [ 237.495676] ? _raw_spin_unlock+0x22/0x30 [ 237.499809] new_inode+0x1c/0x40 [ 237.503159] fat_fill_super+0x2253/0x4400 [ 237.507297] ? fat_flush_inodes+0x1a0/0x1a0 [ 237.511604] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 237.517123] ? vsnprintf+0x20d/0x1b60 [ 237.520907] ? pointer+0x990/0x990 [ 237.524439] ? snprintf+0xae/0xe0 [ 237.527875] ? vsprintf+0x40/0x40 [ 237.531316] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 237.536320] ? set_blocksize+0x2c1/0x340 [ 237.541587] msdos_fill_super+0x2e/0x40 [ 237.545559] mount_bdev+0x314/0x3e0 [ 237.549175] ? msdos_mount+0x50/0x50 [ 237.552875] msdos_mount+0x3c/0x50 [ 237.556409] ? setup+0xe0/0xe0 [ 237.559587] legacy_get_tree+0x118/0x440 [ 237.563636] vfs_get_tree+0x1cb/0x5c0 [ 237.567422] ? vfs_set_fs_source+0x12c/0x180 [ 237.571828] do_mount+0x6c1/0x1fb0 [ 237.575354] ? kasan_check_write+0x14/0x20 [ 237.579574] ? copy_mount_string+0x40/0x40 [ 237.583795] ? kasan_kmalloc+0xc4/0xe0 [ 237.587668] ? kmem_cache_alloc_trace+0x318/0x780 [ 237.592507] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 237.598036] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 237.603576] ? copy_mount_options+0x285/0x380 [ 237.608172] ksys_mount+0x12d/0x140 [ 237.611785] __x64_sys_mount+0xbe/0x150 [ 237.615748] do_syscall_64+0x1b9/0x820 [ 237.619625] ? finish_task_switch+0x1d3/0x870 [ 237.624113] ? syscall_return_slowpath+0x5e0/0x5e0 [ 237.629031] ? syscall_return_slowpath+0x31d/0x5e0 [ 237.633963] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 237.638976] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 237.644520] ? prepare_exit_to_usermode+0x291/0x3b0 [ 237.649525] ? perf_trace_sys_enter+0xb10/0xb10 [ 237.654176] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 237.659012] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 237.664185] RIP: 0033:0x4584ea [ 237.667353] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 237.686525] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 237.694323] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 237.701575] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 07:13:14 executing program 0: r0 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x2, 0x40a100) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl=@kern={0x10}, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f0000000400)}, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) ioctl$EVIOCSABS0(r0, 0x401845c0, &(0x7f0000000080)={0x3ff, 0x0, 0x5, 0x6, 0xffffffffffffff0b, 0x8}) 07:13:14 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000080)="b8010000000f01d90f22db0f20d835080000000f22d8f26db9004d564bb84b000000ba000000000f30ea00300000a6000fc72d0000000026f30f01c966b850008ee0b8070000000f23d00f21f8353000000a0f23f8", 0x55}], 0x1, 0x0, &(0x7f0000000000), 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000200)=ANY=[@ANYBLOB="c523e341fdf3988e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x0) readlinkat(r3, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/44, 0x2c) [ 237.708836] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 237.716087] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 237.723346] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000051 07:13:15 executing program 5: mkdir(&(0x7f0000000080)='./file1\x00', 0x0) getxattr(&(0x7f0000000180)='./file1\x00', &(0x7f00000001c0)=@random={'user.', 'em0-]wlan0!vmnet0ppp1}em0\x00'}, &(0x7f00000003c0)=""/140, 0x8c) mkdir(&(0x7f0000000000)='./file1\x00', 0x148) [ 237.752313] binder_alloc: binder_alloc_mmap_handler: 13644 20001000-20004000 already mapped failed -16 [ 237.781754] binder: BINDER_SET_CONTEXT_MGR already set [ 237.796473] binder: 13644:13645 ioctl 40046207 0 returned -16 07:13:15 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) r3 = fcntl$dupfd(r0, 0x406, r1) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000000)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000080)=0x2c) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f000086c000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0xfffffffffffffffd}) munmap(&(0x7f0000000000/0x3000)=nil, 0x3000) read(r1, &(0x7f0000465f8e)=""/114, 0x47) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x40082406, &(0x7f0000000040)) close(r1) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000c22ff0)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 237.808306] binder_alloc: 13644: binder_alloc_buf, no vma [ 237.813968] binder: 13644:13666 transaction failed 29189/-3, size 24-8 line 2967 07:13:15 executing program 7 (fault-call:2 fault-nth:82): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:15 executing program 5: rt_sigreturn() r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000ffc), 0x4) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040), 0x4) 07:13:15 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00009f3fa8)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x40) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003c1000), 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000002580)=[{{&(0x7f0000000f00)=@vsock={0x28, 0x0, 0x0, @my}, 0x80, &(0x7f00000013c0)=[{&(0x7f0000001140)="16d351bc550975782cb75fc7d528119c7dea5a21cfc21de7599ab6315eb5b21be1c8a68a1719442fd41540fa31bd61d5cab2ad7eb6ae1b0a6875e96b52b3811d6d870e54ef1ad52deaad721dfaa52f998475bb13c2997be51b0d1240d28e029ba224453de555aa28bdffd38500e99b82ce1a8ca901c2e5c64781c9ccd275deb68d5754fab44a10f3d61bd06d0d5de63a778b1ec5783825a4ebfcae912588835a5e2ed98f6e4698bec68182d1be6cce0c", 0xb0}, {&(0x7f00000012c0)="8d9e56a40c7650de22e2e61bf3dc9a0d8b02639164f93c3cfd27d17aa71b157f5c3d098f641e9bc614b7f4789b077cf6c15836447311b5e1a726840544", 0x3d}], 0x2, &(0x7f0000001440)=[{0x1010, 0x10f, 0x40, "01e287c3bb3957a44ee3154edd3fc9f58a951e906b3a1e397b0130e92d8ec2ec3acf05c58c2775669e3ad38e679820a13fca40b5aa0ef8c33d1d44590a8353564156a68fe816463dbe12d442119c517530c25cee8473cfa94276a3cc8266a5fb7d536eb2b71b95919449aa92816c91ec63a3ab0aff80002bc30db36aead98fa94d87e8e33d5a1705104eb007cfd013adfd46b85bd27eea9ea7ad5aa26e3aa3257d1f261d5112dc8f29e4b83eeef06a74e8073e88893160a9856ad69edd16c52c798a4e01d2d2e3cb1e7fda5de93b51478a53be038dfff0b85a4aa6958275456c256aa9d0e434119b522678acaf5aec9c2abc47972410ad83e948e5a9b70d4222f1996a70a75bc39c9f49be820ce3b62b2f9bfd8df2bc52db800cad590feb542f631d8c2456be696f8c63df8c2067cb215c67544584b35d18a9a968c853c7f189f2459281d231b5445607b2951a815aec7fb119a8efb581e6541c48d7d8414dc867d93a5de15e8c1fc358527538652bfcd48b80ce51f5a834e8385521e35f8f74d27e9688a40d0b028e5472aca626d7b67ac72e03f8bcb7550fa0b3cea396e5cba176e1c0d7c83f43d5ec216b584fe2c9aa836425b83d778cb546aa110e40d82804e6f47db626f3d2bacb0e724830b823565df42419ee47afad0cc3026fd353d1b8645c6f1bb6c7e786a565e6835ee270bd26ea4e9f1677badc05f7a49eeb1d4fefb698e7d24513bdfc594d6c009dee0eaa71e96a9506ab360455b3c683d7d00f29b4780370ff30e822426e710075a16e8435e85a030f9d9476b168742418126d9cb8f5ce08de7a2febe286d0744b3061b6bb7ef52aa39413552fc4879da5125ccf0675d4e14759cfc96a6a2617a137d85d856aa597ff970721f4428003fb5166cbda510df5c75b476ebbc7bdb90300cf3e123441969dd0491fd2ae7d30f97d180c2157161a3ef97668e3e2c46af40c158efe646633a67282b979b8a3d1fd4a5f1c19351b414ecf0cd660d92b7ea02c3ccbb0f1f4feb751b7e06d35f84cd8da06aa3e40317f31f458fe5e1392d28281511771bf2eed05556e94e048d32027845f90e4433b607ba5a09f9443e595096005572d3e221932ef9827d2f82a83c6ca6899f873bc3c78d2cab5dfb39c01d41f5a63e7b8050261b88b33c9d7f1e645e2c7d82e05cc8e14abefbbef5e17ce11b53d2ae44f1adfb5626377d18c3eddb76d22fa212c2551ed3f335c13b1d06a53d042f7cc9467913422dadc77c47a126cd19bf6eaa9c164016f236a008062e8ce1cadce2020d5c052df05f1d7831b84aa8df314d09407724ce12750d267c9ff8be5fcca26c946cc9c254e92b1bbbb06b8bd73eec85b46c4bfc636db0ceef108fdf91feb9de78710ea82b7452c81bc8a0d14ffba6238960209badf0c531adc1f238e55ced94239ee368603f9b22cb729b84e22c7f93197f62d492a5bb54ba02302f02ee3f409fc79d8085be649a651266d3164ec4babf5480d04a9633545405b3ce920c58e1c8daa842880d679e1237055a6d8bebf57d3bcca483e3098af5b4fc8b69feec37ca5e305cf87f4b293fc02eb60a4f3c2cb215ff2725ebdc53e8ddcccc61893e48bc12bfd24448910da34a83a63f9f76fcf0467c21c451c4be9c4f0b3db56d0de44add00196e5d5d275a47bfb3cb966c3ee28b43a81cbe877a7f866b40b44ae92c6beaa066037561559056e11e7b50340fbab8d256ceeb9fdd8d25c3d901bf9596df3465cc7e82a1e8df2ec5964c5fa3dabdd4e6c31f1730ce93ac08bdc5211efa3cf33d352d9b2bbd04bd59d3b9b7625f05d78e8acefe6dc7797ab36cddc212c5f653e68b003a313581d9e6e620d47180f4a4a48e4debbbf7524f152a9fd15dd40a9ac9ac4e517992e92183542945f06c09bbe9edd27deea0cb4a6f1a7bd497eee44d91238dc1e786ccf82d328468332fedc2189a56e1c3898280662f1b7d132e5e5544e8b9a31b5efc253a634601007a0c83afdc7d9243daddb09c895c7e1af75d2651f4d500ef43ccf0ad27bb384d6abd3c17bf151d533ea43b53038669db6ddcedd179ef99d74b685afd4d60665dab817acea3abd4b08e6c3593e54df8197a88cdfb0ff49667d77ea3e2dd98606a21ad2f4b58031e8ab8075c1090632e51a136b302e7122c8f6276de44e7ef023a6f6161c15faa3ab1984cfd6bb9906c1406cbcf99d373fa0a1977d4f69a9bca47c722425049f8c109204601b988e4eab2fa02034cc002a0a3d7cff31065164604e7442b36679d13832754db5a78b106ea140aed245a1d6d90aa1356cf4146fb67a15e472223d94926a1990d273010b3a8d2e77b429e48cb8c28abe9638c7de037c272ef259f8efd077f64afe3cc6faee2c954b4d627d9d5305601e31afa054863882329cad5d7ee8bd4f8c98c0726976007c8ed89103e6046930ed2f16d52c2969d83dc150755cbedc01925176ec6aeaf19ce414d02ec4cd253c8efebc384b4f519c0f4ffcf51c944f42689e1983aa654a4febd38a9b55045e4ffc70fdc26df6d442c7a6b2f9599a70ef8e22f0922d83e964a01d7c4c50b9051ff3e1bd709d46bcebfae1658cf03d7874f3bbe085a3151170b880ececc9aa9d84f1ba7f5d888c560def8c66bd7337f4773d8b0e596353041da71506402c8c097d4bebf14201365efeb8977f3488b250a14d6c3ad0359b16e0534d2325e0a7ea88b7ff358149244ad878c09908a04c2de67c113f36dcbc4325d4c8b73e1089fe090f8041d12600afc853e92a8a5c875fb90610d86dead2747d5b44d58a7cf7558dd25fc006f69b75dc9d177e001f1f9c92374f21cda65e0e4e2c8c4ceaa712ae9e543886d6fd728bbad6e2dcaa53017b014656948319fac423012e9c4c0310d11f4c3a19cd0781101d1167c5dc7089eea2052da9646023d4a21fde44ab97ce51f59f62f9f7f8073c01118a583997589fc87832369cf235ee49caaae1aff36eb562b22194678b4530e3656d011dd5742b1345fac1b242a29fc13d1dfe89866a5e625c8b09ff7c094a1b39bc10a9ec4510d8530785f70442a31af856cebfd42949cef1b616f674b20e3a0558ecaf3672ac4ba3508d842c79c56a0d45c0c413ddc82d188262a4962a3086d93b42887742fe4cbeb70b513fc7405e9a998b006366299426fa24472465e859ef7d81691ce610e5604661cc4183caed91c7fc0ab8e1a95b286f1700d123863c4185853cbb1f09f89d91ff80c52907d60739607afd58619933f6f7e80a527cf7bfaf8c1b35c1605db70cad834408fd9ff6a26aace1d9badbd11b02d58dc9fb11637054a06a73d0e347154f64e1eaa42016e1b91d07bd952ec7356a81eb43d1fe98c7a0fd4443b11d00cca53fcdd6951cb7f008562233c4278342bd2ea816e46668ef175823f659ed854d1e3683666eea38b6096063f16404ba1077223ec12d9dfc5ee2bffc4c9d3d89d23cb90c8623c6bbf145b659d3f79e0522ad15108386b4f6730334fb075506b826dcc6f79a48d79cdf7b6e1480c04a37b0f90d889dc6f9f51acd13b2b408760060cb5ae33b453ba713a36211076fc8e495c7abf08b5b43ad2bcf9c56e6c7266c68a5f4bc15495a05f8c495c5b9281979de63258174f25bbf32c3bc015c1268a90b64e2bb7fcfd83c953909128b4e33bd7813a31ebae59ab774a289cb7d6bf12bf3e9a9339c18279eb05bfcb31812241ccdec4cd76da47a02f28b0c1e82bfdc855bb9847cb066d22d3514a30e1562fd571a9aadc0def4a6837dcd79e010d5c9552da61d517db90445ac9baf2674ecf9507e44173ebf677f7591efa1b802badc36f0ad69572d0bf848de0dd62eb1af505f1e3ac7fe3d6a8934bc0f1a2b84e63c99c7d5efb8af45c3d2f5fc899e5a69b191c22558d042b68294ac8868b425591351bca8fe4f2bb8bf4fc4d9a23dfc82fa2d1657400cf1754b9493c2d9d5be5312187219f424b5f568886eefe37a1f13e0a9cf0c3c1fed9b229647813bd8c306e7d08530a2edc2d28df44b3227232bf13862cd538847a3d8bf56beff56f02270af791e445526e8a77661b47e5b6b74d8946042f4baccbad959ad23ec161bbc11afb61b4eb176df43acb4626c8965801bf2d27c44c3d6f9a72681b9504a646e731a0a049ddeb5bd7dea49ed29ae529beba7e5580234e74d8f1d759a4d0522f658340e9fe32501e2df7d612faef65f4e308112a07298ac282ba4bfe8db5119dfceb01d045d079e945922793d13314eefac6a7f57f57d069d16adb3ea4d2080f847eefeb0f9a9be3e2cee399e0dec5918291424c9dfe6c07dc8b41d3283d5eedb390ccc69cf63c630b8303cd94a1badcc5d5935c6882a77ab6aecdc8ba3eaeacf25cc06859504d667c4380112b596bc980e3d97ca93b840b4bbc8a7c25ee5db2ba1f2982e2836c38ddf80d2fa20105d5feb554440ca34e0822c55a23151d541339a45fc0636b0cf1614de5271b8b2d044d58b8d1941cf26683b03de771f6ee577e8c4fe365fff43a6d1e4bcbbc262d5b3a131931ea8bc999a58355feb77f42cbe8c179bce0136d0ff752dcdd096001e351b7401fbecbb93a65de270ec3ccd791e2ab5dccb25ee4913fb58d9d38bea677cdc26cab7b11de5923adca046b6f34224b90297267447fbbfa15c594e9973956df1976d42c7386826bea280283fc6ee14f56004d1333614cb7510922a08b1879e2c992b0631cea131b9eded4cf475a09309f6200ab640dabc6e3ce1d81542445480b78f2cdd65468cea59e58a7a69bb15ab5ffa40c8e3e3f8730b8c81649ce15e26ce08ef6e352839d8731495d3f6cfb17104c75e35eeead6ebb4c49114cbf5551343140942559d6b38ab25d3ac9176d62ba510bdbc2f91f8f6304e119f4299d6af4b9251bfa6a31c6627a2bb11b28546621b50d773cea54011bae9dd47e2690552ed598f89cef0a9582250bae7b1bd30e4d2904fac629bd6531144dd76a24d9410fd32218efce8f13a7d122a1df058db97e72b689667db637d83cacaf4098f2ecc9f5a9a5a5c948adc16f6a754bc6aeda100375168c91b47a41fd22e1f9f141f950800776ae05f406f35f96e7c2290554e499d880ecf62fa54322b007e43654dfe884e1588bcddf06922272ef9963a8c437f6889d59ca4737b23f8f276d482e529d028d9278860acad903d105653771b6bf337d8533565e16a154d5eb181c32c0aa7ca4f89ac9954c3c740677cff9a1b2219c9a90e19bd62a43abddb6a68298413c36fa376fce34cc09df2adf67b6d3bc84879bb888333829c3921c3cb6f11709ba75c1a0c5451d196b3ec3bb38916044a4ff4904058e40587ab93096cb7f592bb72ecd21fd2cbd6d93189644b5b1936590f349120d1a3b9d5f638d58df3a4fa0c2a05d3242f023398dc6f42be21c81b45676d5cd12b5b0ab7aae78ca772f18662a2fb230cfb707829140c0ffb98bd3ed572d32666b3f35b9949088558e49e6d7c19014fa6f3619dd7f479e2f4c0671f5096afc35c837c7f4dc370c0a28e032c23b1c230c13dc36316fc4c38b865e878452ea25b103b53d5bd40bb46c2def1a3b496fa68a7f4661ece576141d45215cc232ab1809063680891a4a055aac1541bd3b246a70f54a6a8bc89c43745257ed5e30e03388659f556584d1f5649d8d99409d138e7f0b1bd0bf6b0cff5b99a20837563069108f62a3c865a450106a8df29485e5836e6dec41db0ad7f409ae28d2138cc30a801b0cbc106274328a6e532c981ec60f338c3ed0ae178b14a88133907155c0178a2ca7013ee82bab72528261b099ff7f62bc2d4"}, {0x28, 0x102, 0x2, "20fb12faa7e9776c468a44033b7dba9984d4ae"}], 0x1038, 0x40000}, 0x56}], 0x1, 0x0) r2 = request_key(&(0x7f0000000180)='blacklist\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000200)='&,', 0xfffffffffffffff9) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000080)="bd7a48901e8088b7401d8a2f4d6003fde64b43d450066c7410b50072e470a67b0c96df6125473058812504d2be4dac4596d7e9bd79b9c05c0460f060d550db36d6f4cfa2dde31ca443c1feb241bfbd2b1b8518a62db1bd45f12312e0a19afdadcc1f3390056e1bab6a0bb60941d64f37f27f50526950c857ee73604ce95e9b75e99e2e40e6fda3348e0ab75eb34da8c52713879c0e930e1072e5d4795b57698227831a6cd10701745224d69732c70122d25d52b8b25d3297687cb9532b3c6d5856bf9d9430ad7ff9e3136d812b911036faffb84c82dc69eaa970ad3871e3082a0a2387cb4366785ee1d665aa", 0xec, r2) recvmsg(r1, &(0x7f0000003580)={&(0x7f00000003c0)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003440)=""/112, 0x200034b0}], 0x1, &(0x7f0000003500)=""/106, 0x6a}, 0x0) 07:13:15 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0xfffffffffffffd08) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) writev(r1, &(0x7f0000000500)=[{&(0x7f0000000400)="7f453542966e4b0913d51d95578c776bfbde8b14b8ad09c6a0a35504f6ecf224bd", 0x21}], 0x1) [ 237.862299] binder: send failed reply for transaction 378, target dead [ 237.875106] binder: undelivered TRANSACTION_ERROR: 29189 [ 237.957131] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 237.986254] FAULT_INJECTION: forcing a failure. [ 237.986254] name failslab, interval 1, probability 0, space 0, times 0 [ 237.997657] CPU: 0 PID: 13686 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 238.006071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 238.015430] Call Trace: [ 238.018036] dump_stack+0x1c9/0x2b4 [ 238.021688] ? dump_stack_print_info.cold.2+0x52/0x52 [ 238.026951] ? lock_acquire+0x1e4/0x540 [ 238.030925] should_fail.cold.4+0xa/0x11 [ 238.035060] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 238.040164] ? locked_inode_to_wb_and_lock_list+0x3fe/0xac0 [ 238.045867] ? lock_downgrade+0x8f0/0x8f0 [ 238.050006] ? lock_release+0xa30/0xa30 [ 238.053972] ? kasan_check_read+0x11/0x20 [ 238.058100] ? do_raw_spin_unlock+0xa7/0x2f0 [ 238.062490] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 238.067071] ? wb_wakeup_delayed+0xa7/0xf0 [ 238.071291] ? lock_downgrade+0x8f0/0x8f0 [ 238.075426] ? __queue_delayed_work+0x255/0x390 [ 238.080081] ? do_raw_spin_unlock+0xa7/0x2f0 [ 238.084481] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 238.089072] ? wb_wakeup_delayed+0xa7/0xf0 [ 238.093292] ? trace_hardirqs_on+0xd/0x10 [ 238.097424] __should_failslab+0x124/0x180 [ 238.101676] should_failslab+0x9/0x14 [ 238.105471] kmem_cache_alloc+0x47/0x760 [ 238.109524] ? rcu_note_context_switch+0x730/0x730 [ 238.114465] ? mempool_free+0x370/0x370 [ 238.118448] mempool_alloc_slab+0x44/0x60 [ 238.122597] mempool_alloc+0x193/0x4b0 [ 238.126495] ? mempool_destroy+0x30/0x30 [ 238.130570] ? trace_hardirqs_on+0xd/0x10 [ 238.134725] ? __unlock_page_memcg+0x53/0x100 [ 238.139223] ? lock_downgrade+0x8f0/0x8f0 [ 238.143383] ? end_buffer_read_nobh+0x30/0x30 [ 238.147869] bio_alloc_bioset+0x3a8/0x700 [ 238.152004] ? bvec_alloc+0x2d0/0x2d0 [ 238.155800] ? check_same_owner+0x340/0x340 [ 238.160185] submit_bh_wbc+0x14b/0x790 [ 238.164060] __sync_dirty_buffer+0x1ab/0x3e0 [ 238.169197] ? sync_mapping_buffers+0x190/0x190 [ 238.173854] sync_dirty_buffer+0x1a/0x20 [ 238.177899] fat_set_state+0x241/0x330 [ 238.181780] fat_fill_super+0x2b6c/0x4400 [ 238.185940] ? fat_flush_inodes+0x1a0/0x1a0 [ 238.190248] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 238.195777] ? vsnprintf+0x20d/0x1b60 [ 238.199562] ? pointer+0x990/0x990 [ 238.203092] ? snprintf+0xae/0xe0 [ 238.206534] ? vsprintf+0x40/0x40 [ 238.209969] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 238.214971] ? set_blocksize+0x2c1/0x340 [ 238.219025] msdos_fill_super+0x2e/0x40 [ 238.222989] mount_bdev+0x314/0x3e0 [ 238.226604] ? msdos_mount+0x50/0x50 [ 238.230302] msdos_mount+0x3c/0x50 [ 238.233823] ? setup+0xe0/0xe0 [ 238.236998] legacy_get_tree+0x118/0x440 [ 238.241064] vfs_get_tree+0x1cb/0x5c0 [ 238.244843] ? vfs_set_fs_source+0x12c/0x180 [ 238.249244] do_mount+0x6c1/0x1fb0 [ 238.252767] ? kasan_check_write+0x14/0x20 [ 238.256984] ? copy_mount_string+0x40/0x40 [ 238.261201] ? kasan_kmalloc+0xc4/0xe0 [ 238.265072] ? kmem_cache_alloc_trace+0x318/0x780 [ 238.269909] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 238.275430] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 238.280949] ? copy_mount_options+0x285/0x380 [ 238.285425] ksys_mount+0x12d/0x140 [ 238.289039] __x64_sys_mount+0xbe/0x150 [ 238.293023] do_syscall_64+0x1b9/0x820 [ 238.296900] ? finish_task_switch+0x1d3/0x870 [ 238.301393] ? syscall_return_slowpath+0x5e0/0x5e0 [ 238.306321] ? syscall_return_slowpath+0x31d/0x5e0 [ 238.311245] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 238.316256] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 238.321774] ? prepare_exit_to_usermode+0x291/0x3b0 [ 238.326781] ? perf_trace_sys_enter+0xb10/0xb10 [ 238.331441] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 238.336271] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 238.341450] RIP: 0033:0x4584ea 07:13:15 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1000000000013) 07:13:15 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5452, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:15 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)={0xaa}) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000012000/0x3000)=nil, 0x3000}, 0x2002001}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local={0xac, 0x14, 0x14, 0xaa}, @rand_addr}, 0xc) setsockopt$inet_tcp_int(r4, 0x6, 0x8, &(0x7f0000000000), 0x4) close(r4) modify_ldt$read_default(0x2, &(0x7f0000000040)=""/4, 0x4) r5 = socket$inet6(0xa, 0x3, 0x1) ioctl(r5, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x96, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) dup3(r1, r2, 0x0) 07:13:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x2f84) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000140)=@ethtool_link_settings={0xe}}) close(r2) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000000)=0x0) prctl$setptracer(0x59616d61, r3) close(r1) 07:13:15 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x2, 0x0) setsockopt$llc_int(r0, 0x10c, 0x7, &(0x7f0000000140), 0x4) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x0, 0x0) pipe2(&(0x7f0000000100), 0x80000) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/qat_adf_ctl\x00', 0x400, 0x0) fcntl$dupfd(r1, 0x406, r1) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dsp\x00', 0x404200, 0x0) dup(r2) dup(r1) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000040)=0xffffffffffffffe0, 0x4) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000180)={0x9, 0x7, 0xfffffffffffffffd, 0xff, 0x3, 0x8, 0x10000, 0x4cc, 0x1, 0x6720d7aa, 0x1}, 0xb) r4 = syz_open_dev$mice(&(0x7f0000000340)='/dev/input/mice\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r4, 0x5386, &(0x7f0000000380)) setsockopt$llc_int(r1, 0x10c, 0x7, &(0x7f0000000000)=0x80000000, 0x4) 07:13:15 executing program 6: r0 = socket(0x10, 0x3, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={&(0x7f0000000340)={0x10}, 0xc, &(0x7f0000000480)={&(0x7f00000002c0)=ANY=[@ANYBLOB="240000002d000104000000000000000100010000", @ANYRES32=r2, @ANYBLOB="000000000000e0ff0000f1ff"], 0x24}, 0x1}, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x100000000000010, 0x4) 07:13:15 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@ethernet, 0xfffffd91) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000002fd8)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000000)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000ef80)={0x1, 0x802, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "790eaada477f17eb046695eea58af88d0ba3b8f5ca34f33a9a82d81e455bc6ca3479893215467e3bb85ea1247aafde2b17277187bd8fc023bb972d19343108b0"}}, 0x80}, 0x1}, 0x0) [ 238.344618] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 238.363754] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 238.371446] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 238.378699] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 [ 238.385963] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 238.393230] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 238.400489] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000052 07:13:15 executing program 7 (fault-call:2 fault-nth:83): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:15 executing program 6: r0 = epoll_create1(0x0) fcntl$lock(r0, 0x7, &(0x7f0000000000)) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x2, 0x0, 0x1}) [ 238.454253] binder: release 13709:13711 transaction 383 out, still active [ 238.461333] binder: unexpected work type, 4, not freed [ 238.466643] binder: undelivered TRANSACTION_COMPLETE 07:13:15 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x101000, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) splice(r1, &(0x7f0000005dc0), r1, &(0x7f0000007780), 0x8d, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000000380)={{0x5}, 'port1\x00', 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') recvmmsg(r1, &(0x7f00000075c0)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000340)=[{&(0x7f0000000280)=""/114, 0x72}, {&(0x7f0000000300)=""/34, 0x22}, {&(0x7f0000000440)=""/244, 0xf4}], 0x3, &(0x7f0000000540)=""/4096, 0x1000, 0x8}, 0x20}, {{&(0x7f0000001540)=@generic, 0x80, &(0x7f0000002940)=[{&(0x7f00000015c0)=""/225, 0xe1}, {&(0x7f00000016c0)=""/45, 0x2d}, {&(0x7f0000001700)=""/29, 0x1d}, {&(0x7f0000001740)=""/144, 0x90}, {&(0x7f0000001800)=""/20, 0x14}, {&(0x7f0000001840)=""/4096, 0x1000}, {&(0x7f0000002840)=""/62, 0x3e}, {&(0x7f0000002880)=""/160, 0xa0}], 0x8, &(0x7f00000029c0)=""/4096, 0x1000, 0x1}, 0x1}, {{&(0x7f00000039c0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000003b80)=[{&(0x7f0000003a40)=""/108, 0x6c}, {&(0x7f0000003ac0)}, {&(0x7f0000003b00)=""/121, 0x79}], 0x3, &(0x7f0000003bc0)=""/153, 0x99, 0x7ff}, 0x1}, {{&(0x7f0000003c80)=@xdp={0x0, 0x0, 0x0}, 0x80, &(0x7f0000005ec0)=[{&(0x7f0000003d00)=""/4096, 0x1000}, {&(0x7f0000004d00)=""/60, 0x3c}, {&(0x7f0000004d40)=""/4096, 0x1000}, {&(0x7f0000005d40)=""/72, 0x48}, {&(0x7f0000005dc0)}, {&(0x7f0000005e00)=""/176, 0xb0}], 0x6, &(0x7f0000005f40)=""/61, 0x3d, 0x10001}, 0x6}, {{&(0x7f0000005f80)=@ethernet={0x0, @local}, 0x80, &(0x7f0000007180)=[{&(0x7f0000006000)=""/178, 0xb2}, {&(0x7f00000060c0)=""/4096, 0x1000}, {&(0x7f00000070c0)=""/33, 0x21}, {&(0x7f0000007100)=""/46, 0x2e}, {&(0x7f0000007140)=""/64, 0x40}], 0x5, &(0x7f0000007200)=""/224, 0xe0, 0x49700000}}, {{0x0, 0x0, &(0x7f00000074c0)=[{&(0x7f0000007300)=""/244, 0xf4}, {&(0x7f0000007400)=""/169, 0xa9}], 0x2, &(0x7f0000007500)=""/140, 0x8c, 0x7fff}, 0x100000001}], 0x6, 0x40002000, &(0x7f0000007740)={0x0, 0x989680}) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000007880)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f0000007980)={&(0x7f00000077c0)={0x10, 0x0, 0x0, 0xa020000}, 0xc, &(0x7f0000007940)={&(0x7f00000078c0)={0x54, r5, 0x20, 0x70bd29, 0x25dfdbff, {0x1}, [@FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xc}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xbb}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}]}, 0x54}, 0x1}, 0x4000) getdents(r1, &(0x7f0000003ac0)=""/53, 0x35) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000007800)={@ipv4={[], [], @remote}, 0x0}, &(0x7f0000007840)=0x14) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000007c00)={@remote, @broadcast, 0x0}, &(0x7f0000007c40)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000007d40)={{{@in=@multicast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000007e40)=0xe8) accept4(r2, &(0x7f0000007a40)=@hci={0x0, 0x0}, &(0x7f0000007b00)=0x80, 0x80800) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000008040)={@local, 0x0}, &(0x7f0000008080)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000080c0)={'ip6gretap0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000008100)={{{@in6, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000008200)=0xe8) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f000000d280)={'veth1_to_bridge\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f000000d2c0)={'team0\x00', 0x0}) getsockname$packet(r2, &(0x7f000000d3c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f000000d400)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f000000d880)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x7d04240c}, 0xc, &(0x7f000000d840)={&(0x7f000000d440)={0x3ec, r3, 0x100, 0x70bd29, 0x25dfdbfc, {0x1}, [{{0x8, 0x1, r4}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r6}, {0x4, 0x2}}, {{0x8, 0x1, r7}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r8}, {0x1ec, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x10, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r10}}, {0x8, 0x7}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r11}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x5}}, {0x8, 0x7}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x14, 0x4, [{0x6, 0x81, 0x1, 0x10001}, {0x5, 0x9, 0x10000, 0x8}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7fffffff}}}]}}, {{0x8, 0x1, r12}, {0xc0, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3ff}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x1c, 0x4, [{0x1b0, 0x86, 0x81, 0xfffffffffffffff7}, {0x1ff, 0xfcf, 0x7fff}, {0x10001, 0x0, 0x2, 0x3}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r13}, {0x80, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r15}}}]}}]}, 0x3ec}, 0x1, 0x0, 0x0, 0x800}, 0x80) r16 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r16, 0x1274, 0x0) 07:13:15 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x200, 0x2) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000100)={r1, 0x8}, &(0x7f0000000140)=0x8) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000013c0)='/group.stat\x00', 0x2761, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40087602, 0x0) [ 238.509296] binder_alloc: binder_alloc_mmap_handler: 13709 20001000-20004000 already mapped failed -16 [ 238.534917] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 238.554995] FAULT_INJECTION: forcing a failure. 07:13:15 executing program 6: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RLERRORu(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1400000007ffff"], 0x7) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) write$P9_RSETATTR(r1, &(0x7f00000001c0)={0x5, 0x1b}, 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x101000, 0x10) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x3aa) r3 = fcntl$getown(r2, 0x9) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000240)=0x0) kcmp$KCMP_EPOLL_TFD(r3, r4, 0x7, r2, &(0x7f0000000280)={r2, r2, 0x100000001}) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000640)="2f70726f632f7379732f6e65742f69114b342f76732f73796e635f726566726573685f706572696f640027477398622dd4d18c33a79c2e47d8315985fb66a7855316d5e89148e21255fdf3c5139cc2821ac34936a4a2f66772673feac8fad145211486bc98ba1475beecbeab556be497047ba8a24e9cc5c4b91de6226f1641b6fbac6d28be8403580aaf836748f48da9eeb5085765df2281894b0a31da8afff3870b979cb9eb91765d304f63d1a2eb855011b0d3be5c87e7a9230acdf645270447a7c895fba329b6630641e27e69470428fd1242882d3e12812aa709da05df7a1b34ebe1623070b666a91c97fd38503736801cdda32e2197e03cf783c86a", 0x2, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000040)={0x7, 0x1b, 0x2}, 0x7) setsockopt$RDS_RECVERR(r5, 0x114, 0x5, &(0x7f0000000140), 0x4) mount$9p_fd(0x0, &(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)='9p\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="2c7766646e241270f4bdfd9e8fa0343b29b864b4ed6f3d", @ANYRESHEX=r1, @ANYBLOB="2c91657273696f6e3d3970323030302e752c00c252c10e0bfc06f46a0319bc1b646ea8e82243449e1cda62aab0a92677ac6dae6c6cd0bcd2bf4ffc4c"]) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r5, 0x40045542, &(0x7f0000000200)=0x5) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f0000000180)={'bridge_slave_0\x00'}) [ 238.554995] name failslab, interval 1, probability 0, space 0, times 0 [ 238.567192] CPU: 0 PID: 13726 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 238.575618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 238.584977] Call Trace: [ 238.587576] dump_stack+0x1c9/0x2b4 [ 238.591244] ? dump_stack_print_info.cold.2+0x52/0x52 [ 238.593172] binder: BINDER_SET_CONTEXT_MGR already set [ 238.596447] should_fail.cold.4+0xa/0x11 [ 238.596466] ? unwind_get_return_address+0x61/0xa0 [ 238.596482] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 238.596503] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 238.610792] 9pnet: Insufficient options for proto=fd [ 238.615834] ? xas_find_tagged+0x45d/0x13d0 [ 238.615854] ? save_stack+0x43/0xd0 [ 238.615873] ? ida_alloc_range+0x5d0/0xc70 [ 238.615890] ? lock_downgrade+0x8f0/0x8f0 [ 238.615909] ? generic_make_request+0x1800/0x1800 [ 238.622935] binder_alloc: 13709: binder_alloc_buf, no vma [ 238.627320] ? lock_acquire+0x1e4/0x540 [ 238.627335] ? fs_reclaim_acquire+0x20/0x20 [ 238.627349] ? lock_downgrade+0x8f0/0x8f0 [ 238.627369] ? do_raw_spin_lock+0xc1/0x200 [ 238.627383] ? check_same_owner+0x340/0x340 [ 238.627400] ? kfree+0x15e/0x260 [ 238.631767] binder: 13709:13727 transaction failed 29189/-3, size 24-8 line 2967 [ 238.635340] ? rcu_note_context_switch+0x730/0x730 [ 238.635356] ? ida_alloc_range+0x911/0xc70 [ 238.635376] __should_failslab+0x124/0x180 [ 238.640176] binder: 13709:13711 ioctl 40046207 0 returned -16 [ 238.643826] should_failslab+0x9/0x14 [ 238.643841] __kmalloc_track_caller+0x2c4/0x760 [ 238.643855] ? kasan_kmalloc+0xc4/0xe0 [ 238.643873] ? kstrdup_const+0x66/0x80 [ 238.643887] kstrdup+0x39/0x70 [ 238.643902] kstrdup_const+0x66/0x80 [ 238.643915] alloc_vfsmnt+0x189/0x9a0 [ 238.643931] ? delayed_free_vfsmnt+0x20/0x20 [ 238.652435] binder: send failed reply for transaction 383, target dead [ 238.654390] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 238.654405] ? vsnprintf+0x20d/0x1b60 [ 238.654424] ? lock_acquire+0x1e4/0x540 [ 238.654440] ? lockref_get+0x42/0x50 [ 238.654451] ? lock_downgrade+0x8f0/0x8f0 [ 238.654470] ? vfs_get_tree+0x36d/0x5c0 [ 238.768195] ? lock_downgrade+0x8f0/0x8f0 [ 238.772326] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 238.776895] ? kasan_check_write+0x14/0x20 [ 238.781111] ? do_raw_spin_lock+0xc1/0x200 [ 238.785351] ? _raw_spin_unlock+0x22/0x30 [ 238.789483] ? lockref_get+0x42/0x50 [ 238.793183] ? mount_bdev+0x81/0x3e0 [ 238.796885] vfs_create_mount+0xe3/0x610 [ 238.800941] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 238.806460] ? may_umount+0xb0/0xb0 [ 238.810071] ? mount_too_revealing+0x124/0x5e0 [ 238.814642] ? security_sb_mountpoint+0x94/0xc0 [ 238.819319] do_mount+0x7dd/0x1fb0 [ 238.822859] ? kasan_check_write+0x14/0x20 [ 238.827092] ? copy_mount_string+0x40/0x40 [ 238.831310] ? kasan_kmalloc+0xc4/0xe0 [ 238.835184] ? kmem_cache_alloc_trace+0x318/0x780 [ 238.840023] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 238.845551] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 238.851073] ? copy_mount_options+0x285/0x380 [ 238.855551] ksys_mount+0x12d/0x140 [ 238.859167] __x64_sys_mount+0xbe/0x150 [ 238.863136] do_syscall_64+0x1b9/0x820 [ 238.867010] ? finish_task_switch+0x1d3/0x870 [ 238.871494] ? syscall_return_slowpath+0x5e0/0x5e0 [ 238.876407] ? syscall_return_slowpath+0x31d/0x5e0 [ 238.881320] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 238.886328] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 238.891862] ? prepare_exit_to_usermode+0x291/0x3b0 [ 238.896863] ? perf_trace_sys_enter+0xb10/0xb10 [ 238.901524] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 238.906377] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 238.911563] RIP: 0033:0x4584ea [ 238.914732] Code: b8 a6 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8f fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ba 8f fb ff c3 66 0f 1f 84 00 00 00 00 00 [ 238.933902] RSP: 002b:00007f8974a89a88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 238.941604] RAX: ffffffffffffffda RBX: 00007f8974a89b30 RCX: 00000000004584ea [ 238.948864] RDX: 00007f8974a89ad0 RSI: 00000000200003c0 RDI: 00007f8974a89af0 07:13:16 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_ifreq(r0, 0x40000089f1, &(0x7f00000006c0)={'bond0\x00', @ifru_names='ip6gretap0\x00'}) r1 = gettid() ioprio_set$pid(0x3, r1, 0x0) 07:13:16 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x5451, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 238.956116] RBP: 00000000200003c0 R08: 00007f8974a89b30 R09: 00007f8974a89ad0 [ 238.963367] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000015 [ 238.970620] R13: 0000000000000000 R14: 00000000004d3d50 R15: 0000000000000053 [ 238.978555] binder: undelivered TRANSACTION_ERROR: 29189 [ 238.987995] 9pnet: Insufficient options for proto=fd 07:13:16 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = fcntl$getown(0xffffffffffffff9c, 0x9) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000040)=r1) r2 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) 07:13:16 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000180)='/dev/audio#\x00', 0x86, 0x2042) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f00000001c0)={'sit0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = accept4$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, @remote}, &(0x7f0000000080)=0x10, 0x80000) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f00000000c0)=""/65, &(0x7f0000000140)=0x41) ioctl$KVM_SMI(r3, 0xae80) r5 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000016) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x311640, 0x0) [ 239.019504] binder: release 13747:13749 transaction 388 out, still active [ 239.026587] binder: unexpected work type, 4, not freed [ 239.031911] binder: undelivered TRANSACTION_COMPLETE [ 239.098162] binder_alloc: binder_alloc_mmap_handler: 13747 20001000-20004000 already mapped failed -16 [ 239.109704] binder: BINDER_SET_CONTEXT_MGR already set [ 239.116384] binder_alloc: 13747: binder_alloc_buf, no vma [ 239.121878] binder: 13747:13749 ioctl 40046207 0 returned -16 [ 239.122093] binder: 13747:13760 transaction failed 29189/-3, size 24-8 line 2967 [ 239.138051] binder: send failed reply for transaction 388, target dead [ 239.145577] binder: undelivered TRANSACTION_ERROR: 29189 07:13:16 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) 07:13:16 executing program 7 (fault-call:2 fault-nth:84): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:16 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="e52f5d7a1f16f47767fc6f9adb5d4516252ad53cf6ed3c22b6959ca3b2c2d6a1fc38fa0c45a1b397267a67e95a92a3b75a650b75616014cb496a79103ad1a06b24c085f952239ac3b9bd08c021ddd840f4f3bb31ec35aac38f819af5d3c0a0b794e7d0a845575b1aaa1bae613ff5f51c3ccf5d035c75b6541388a4637353e2af9d585dabf7e27806d06c16b1b3c990a5d1dfe067a38ec02d5807b497fb42395279dec9c8c24980296b54b07d") r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r1, 0xffffffffffffff7f) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000180)={0x0, 0xfffffffffffffffd, 0x10}, 0xc) sendto$inet6(r2, &(0x7f0000000000)="d2", 0x1, 0x0, 0x0, 0x0) 07:13:16 executing program 6: r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x1, 0x40001) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f00000002c0)={0x6, {{0xa, 0x4e23, 0x6, @mcast2={0xff, 0x2, [], 0x1}, 0xc}}, 0x1, 0x7, [{{0xa, 0x4e23, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x3}}, {{0xa, 0x4e21, 0x6, @loopback={0x0, 0x1}, 0x7}}, {{0xa, 0x4e22, 0xea7, @empty, 0xf0c}}, {{0xa, 0x4e23, 0x10001, @dev={0xfe, 0x80, [], 0xa}, 0x2}}, {{0xa, 0x4e20, 0x6, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x9}}, {{0xa, 0x4e22, 0x5, @empty, 0x1}}, {{0xa, 0x4e22, 0x18, @dev={0xfe, 0x80, [], 0xd}, 0x7}}]}, 0x410) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x3}, 0x1c) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0xe, &(0x7f0000000100), 0x36b) ioctl$FICLONE(r1, 0x40049409, r1) 07:13:16 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0045878, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:16 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, "d879c138a9faaa20657b4fd143f25235fe5daa3b676d4960f7bc24651de7d348c60966bbc7159a157ced33939695ea6cf8e9040bdb62bbb9bd1faed78bcba7cc", "f4e94f8905182eba2dec81b762efad4a9056e2d3f1e54ad65877250ec181152923ee9d15b55f897c6c0aba7f5cd09aa5374a216c66989fb26e1a2779e430119d", "e600e4815b91b6b23eb2c1092bcde6aa54f261eebbce85715ba555c206854ff4"}) accept4$inet6(r1, &(0x7f0000000040), &(0x7f00000001c0)=0x1c, 0x80800) 07:13:16 executing program 6: mkdir(&(0x7f0000000380)='./file0\x00', 0xfffffffffffffffe) lsetxattr(&(0x7f0000000340)='./file0\x00', &(0x7f0000000300)=@known='user.syz\x00', &(0x7f00000000c0)='user.syz\x00', 0x0, 0x0) getxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000004fc0)=@known='user.syz\x00', &(0x7f0000000100)=""/171, 0xab) rt_sigpending(&(0x7f0000000580), 0x8) syz_mount_image$btrfs(&(0x7f0000000040)='btrfs\x00', &(0x7f0000000080)='./file0\x00', 0x9, 0x4, &(0x7f00000004c0)=[{&(0x7f00000001c0)="3a4a1eaa17834d67e255f8007aa796a2965e153e3b989df9e2", 0x19, 0x24000000}, {&(0x7f0000000200)="3f4c7c78ad43312ab594e23e16d9add37781d3eefbf2faf68cf25dc118bc1342380f818f12856acda6e7297f25d23ac50ead8afb439f25ba2b5592bd6053aebf5983a169e5219a387fb5d40fa2133e581dd7b4557e8f912a7ef341a409280347b240663455f3a0478208f87fdf3ed6", 0x6f, 0x100000000}, {&(0x7f0000000280), 0x0, 0x1000}, {&(0x7f00000003c0)="daf9fe001fcf364f8310d11707ac7ee8fd7133114230f0b5399f9fdfa4e0a7c3ed06ba6a27c390a639e6670f5c253fa109a40ae7c1b05925d30a9c338a7235279634822e084d3d42793204096ea220daa5c5b80a12dc20ac007840f4023143c57574c75ec5bf02ef003c17172eeafb7c850b07f16a66809a99bf697fffb9b7d2c7a8ce0afc38372c99172953f436c07920fc100abf57d271bac6cb781a6affe8d519304c47b15a3dfd4ac2673c81cd0ccb45ca3fb9210d491aeb0e39c22ef61cb341c72b64abefe9acff95f0b71ce4ca006a8c10d015523e7305480dc1feca35534774ce2ca7", 0xe6, 0x920}], 0x1101804, &(0x7f0000000600)=ANY=[@ANYBLOB="736b69705fe2616c616e63652cff8118d5052734cc0800"]) r0 = syz_open_dev$midi(&(0x7f0000000280)='/dev/midi#\x00', 0xf1ed, 0x500) setsockopt$nfc_llcp_NFC_LLCP_RW(r0, 0x118, 0x0, &(0x7f0000000540)=0x7, 0x4) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f0000000640)=0x2) [ 239.460683] sock: process `syz-executor6' is using obsolete setsockopt SO_BSDCOMPAT [ 239.462678] binder: release 13779:13780 transaction 393 out, still active [ 239.475583] binder: unexpected work type, 4, not freed [ 239.480901] binder: undelivered TRANSACTION_COMPLETE [ 239.494821] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 07:13:16 executing program 5: r0 = socket$inet(0x2, 0x6, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x0, 0x400) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000180)="bb592a3013d150d6293b9f80ab1a68cf7fb6098950d6513071dc372b886546e9fea0285db64938a1d85e321ddea8fc7c3d70276d337c7e5ea2383107dd4d7e2b6f02af15591a30619310ae95b30ae628ea98ba0ba9a360872d77e92ea67e087692d66eeed4e416a866daded877e239b38b440191223ca3c4a2ad076ab32074a750ec32a7a0dd8bff08a9bdc485f8c1c657ee56aec8583a571a5d5f65696e8d88168331b932f5003a400eb5d3f7ad38cc1be044dca9f097be98f0ce47df0622de00ed77a2b807e3a3078ec40ca9051b97e1838d2b2776a7a20609b32107d370fe16949d37701cc4071f52eedd50228dd4f7f6bb85eb8447177c3ac82ec68d7cec") ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="001c00f38756c0ccd881f90000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="8a3306c1ff89dc4c757e80d0315b4a2db9e79b19b5ecb25a086114d303b2da0b0b4ffbe79be4417acf507964e5ed968233f63cb394"], @ANYBLOB="0008090098751f0021a0000005000000d4d4ab71c5d984ca626754f3ad82f46944394e7e0d2761e7004192481c5709af978e7e8d3a870ee03da36c1da48d3c183a520972df56f934d79c687efd641a96938919f8d772b269db86cd90c9eeea43fae144be7fc29c939db153b155aa49018758c911c61a8b578a51c02484b09dd24af6acf84f8bb9273f18d11b6a9a41e8d0f7495d30292340eb5d92878e82b4c5f96cfb111a74d38e1d3d33cc98c63fab816c42c0334b89a2e56cbe9f46dac3c1383bf5cdf53a7fa3fe7569ef57a3eb2625262ba97ea142bea8399d558c1d91043c7bec5f6360bbc172ada50a7e1fe5ddf746d9a51af9670d4c77386c295b02225bf47f"]) setsockopt$inet_buf(r0, 0x0, 0x400000000020, &(0x7f0000000400)="2820eaad11ac8d1703828467", 0x5) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x8, 0x9, 0x4, 0x1, 0x23, 0xffffffffffffffff, 0xfffffffffffffff9}, 0x2c) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r2}, 0x10) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f00000003c0)) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000380)={0x2}, 0xffffffffffffffad) 07:13:16 executing program 0: openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x100, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x20002200, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x0) dup2(r0, r1) [ 239.516502] binder_alloc: binder_alloc_mmap_handler: 13779 20001000-20004000 already mapped failed -16 [ 239.527939] binder: BINDER_SET_CONTEXT_MGR already set [ 239.535164] binder: 13779:13780 ioctl 40046207 0 returned -16 [ 239.553008] binder_alloc: 13779: binder_alloc_buf, no vma [ 239.558866] binder: 13779:13793 transaction failed 29189/-3, size 24-8 line 2967 [ 239.594550] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.604182] binder: send failed reply for transaction 393, target dead 07:13:17 executing program 3: r0 = socket$kcm(0x2, 0x3, 0x84) r1 = dup3(r0, 0xffffffffffffff9c, 0x0) ioctl$KDSETMODE(r1, 0x4b3a, 0xff) sendmsg(r0, &(0x7f0000000340)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000001740)=[{&(0x7f0000000000)="61fdcd0829fd8a188cad6f8c", 0xc}], 0x1, &(0x7f0000000380)}, 0x0) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, &(0x7f00000002c0)=0x9, 0xced4, 0x1) getresgid(&(0x7f0000000200)=0x0, &(0x7f0000000240), &(0x7f0000000280)) write$FUSE_ENTRY(r1, &(0x7f0000000380)={0x90, 0x0, 0x4, {0x5, 0x2, 0x7, 0x100000000, 0x1, 0x6000000000, {0x3, 0x1ff, 0x3, 0x5, 0x5, 0x2, 0x80000000, 0xa14c, 0x9, 0xffff, 0x100000001, r2, r3, 0x7fff, 0x1}}}, 0x90) r4 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 07:13:17 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:17 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000580)={0xffffffffffffffff}, 0x13f}}, 0x20) fcntl$setflags(r0, 0x2, 0x1) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000800)={0x14, 0x88, 0xfa00, {r1, 0x10, 0x0, @ib={0x1b, 0xff, 0xbbf, {"e5f3584f4c2e19a3395bb22fa4daf2f5"}, 0x5, 0xff, 0x1}}}, 0x90) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) 07:13:17 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x4020940d, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:17 executing program 6: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000380)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x80047210, &(0x7f0000000040)={0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 'bcsh0\x00'}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000080)) 07:13:17 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000001fee)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffc, 0x400801) ioctl(r0, 0x200000004112, &(0x7f0000008000)) [ 239.815307] raw_sendmsg: syz-executor3 forgot to set AF_INET. Fix it! [ 239.827595] binder: release 13829:13830 transaction 398 out, still active [ 239.834650] binder: unexpected work type, 4, not freed [ 239.839956] binder: undelivered TRANSACTION_COMPLETE [ 239.846844] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 239.891498] binder_alloc: binder_alloc_mmap_handler: 13829 20001000-20004000 already mapped failed -16 [ 239.929632] binder: BINDER_SET_CONTEXT_MGR already set [ 239.952072] binder: 13829:13830 ioctl 40046207 0 returned -16 [ 239.971927] binder_alloc: 13829: binder_alloc_buf, no vma [ 239.977569] binder: 13829:13844 transaction failed 29189/-3, size 24-8 line 2967 [ 240.002243] binder: send failed reply for transaction 398, target dead [ 240.012601] binder: undelivered TRANSACTION_ERROR: 29189 07:13:17 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x42, 0x400202) r1 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) r2 = socket$bt_hidp(0x1f, 0x3, 0x6) r3 = inotify_init1(0x80000) r4 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x18}, 0x10) ppoll(&(0x7f00000000c0)=[{r0, 0x1280}, {r1, 0x4004}, {r2, 0x6000}, {r3, 0x4000}, {r4, 0x20}], 0x5, &(0x7f0000000100), &(0x7f0000000140)={0x3}, 0x8) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000180)=0x0) sched_setscheduler(r5, 0x3, &(0x7f00000001c0)=0x10000) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000200)=0x4) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000240)='/dev/hwrng\x00', 0x1, 0x0) recvfrom$inet(r6, &(0x7f0000000280)=""/4096, 0x1000, 0x2000, 0x0, 0x0) ioctl$PPPIOCGL2TPSTATS(r6, 0x80487436, &(0x7f0000001280)="4a8ccb1e6c48616d677a50953c50bb39220417cbee2e3be986c0461f171d4ba383a1ef41ec4f562f92e9c8241c881a71cae5d20d77c4f8ea12f45772e8cf5a9c02f2125c2246e2ac873482733bffe5cdd0a2f51c038d873d642b30e2f6d42eeab96d9366c740f422c3ce2638703762c50b10ec7679ddb7562a9c975c894eb28d984bcaf82a214777b0b517e7bd711ec8cd6a16f3ccf553c7d320c69c") inotify_add_watch(r6, &(0x7f0000001340)='./file0\x00', 0x2000041) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000001380)={0x0, 0x1, 0xd004, 0x1000, &(0x7f0000fff000/0x1000)=nil}) ioctl(r4, 0x3, &(0x7f00000013c0)="47a403e219d9280b2c99c400f6e72f7cfb7849082484770a0e88f4a158052dd6614d518704968894921240c89fc036d8bc366dae8b79707cedaee3395c6e9c1135cb3e8aec2b53e03f65d3c24328fb0fa228bf133bb0ff38f1cbf247f806ae13e928c839dd5c1faf848e2f533ed143683bbcb25cbe0e931b9d2d15f622ee6539eebe68ecc45334910d7b6370fe1221f2148f370165e443f1e722a28975da92ecaf561fa3") ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f00000014c0)={0x8, {0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}, 0xc0, 0x8, 0x1, 0x7, 0x7fff, &(0x7f0000001480)='ip6gretap0\x00', 0x3, 0x81, 0x3}) r7 = semget(0x0, 0x0, 0x0) semctl$GETVAL(r7, 0x1, 0xc, &(0x7f0000001540)=""/123) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r6, 0xc0045540, &(0x7f00000015c0)=0x5) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000001600)=[{0xc, 0x4}], 0x1) ioctl$EVIOCGBITKEY(r6, 0x80404521, &(0x7f0000001640)=""/79) getsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f00000016c0)={@remote}, &(0x7f0000001700)=0xc) semctl$GETVAL(r7, 0x0, 0xc, &(0x7f0000001740)=""/30) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000001780)={0x0, 0x8d9}, &(0x7f00000017c0)=0xc) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r6, 0x84, 0x71, &(0x7f0000001800)={r8, 0x8}, &(0x7f0000001840)=0x8) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f00000018c0)=@filter={'filter\x00', 0xe, 0x4, 0x410, 0x110, 0x210, 0x210, 0x210, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x4, &(0x7f0000001880), {[{{@ip={@empty, @multicast2=0xe0000002, 0x0, 0xffffff00, 'vlan0\x00', 'bcsh0\x00', {0xff}, {0xff}, 0x32, 0x3, 0x4}, 0x0, 0xe8, 0x110, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz0\x00', 0xfff, 0x1, 0x2, 0x1}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0xb}}}, {{@ip={@broadcast=0xffffffff, @remote={0xac, 0x14, 0x14, 0xbb}, 0xffffffff, 0xff, 'gre0\x00', 'ip6gretap0\x00', {0xff}, {0xb2e031f9caf5a095}, 0x6, 0x2, 0x10}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x1000, [0xe48, 0xcd, 0x1, 0x8, 0x6, 0x8], 0x6, 0x7ff, 0x100}}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x108, 0x168, 0x0, {}, [@common=@unspec=@nfacct={0x48, 'nfacct\x00', 0x0, {'syz0\x00', 0x5}}, @common=@ttl={0x28, 'ttl\x00', 0x0, {0x0, 0xa2}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x4, [0x1, 0x9, 0x7ff, 0xff, 0x4, 0x71d567f00], 0x3, 0x2, 0xfff}, {0x7, [0x1, 0x400, 0x7f, 0x2, 0x3, 0x2], 0x7, 0x100000001, 0xfffffffffffffff7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x470) lstat(&(0x7f0000001d40)='./file0\x00', &(0x7f0000001d80)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000001e80)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000001f80)=0xe8) setresuid(r9, r10, r11) 07:13:17 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) 07:13:17 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mldos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:17 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x31, 0x25}, [], {0x95}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x400) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x900000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, r1, 0xc08, 0x70bd29, 0x25dfdbfc, {0x8}, [@IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xcf4}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xb8f2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xc69c}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6ed4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xef}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x84}, 0x1, 0x0, 0x0, 0x44004}, 0x800) 07:13:17 executing program 3: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$sock_cred(r0, 0x1, 0x2, &(0x7f00000001c0), 0xc) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000000040)=@sack_info={0x0, 0x8000, 0x8}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f00000000c0)={r2, 0x800, 0x6, [0x10000, 0xe2, 0x5, 0xfffffffffffffff9, 0x7ff, 0xff]}, &(0x7f0000000100)=0x14) 07:13:17 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500}) r3 = fcntl$getown(r1, 0x9) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x220c01, 0x0) clock_gettime(0x0, &(0x7f0000000100)) clock_gettime(0x0, &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000180)) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x6004c2, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) write$evdev(r4, &(0x7f0000000480)=[{{0x0, 0x7530}, 0x2, 0x8, 0x5}, {{0x77359400}, 0x0, 0x5, 0x10000}, {{0x0, 0x2710}, 0x6, 0x10000, 0x6}, {{0x77359400}, 0x9, 0x2, 0x7}, {{}, 0x4, 0x100, 0x6}, {{r6, r7/1000+30000}, 0x6, 0x1, 0xf8}, {{0x0, 0x2710}, 0x400, 0x100, 0x6}, {{0x77359400}, 0x1000, 0xe67, 0x1}], 0xc0) getsockopt$IPT_SO_GET_REVISION_MATCH(r5, 0x0, 0x42, &(0x7f0000000040)={'ipvs\x00'}, &(0x7f0000000080)=0x1e) getpgrp(r3) 07:13:17 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x32000, 0x0) write$evdev(r0, &(0x7f0000000040)=[{{}, 0x3, 0x1, 0x800}, {{0x0, 0x2710}, 0x3ff, 0xfff, 0x5}], 0x30) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000080)={0x10000, 0x4, 0x814, 0x7}, 0x10) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) nanosleep(&(0x7f0000000100)={r1, r2+30000000}, &(0x7f0000000140)) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x8001, 0xff}, &(0x7f0000000240)=0x90) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000280)=@assoc_id=r3, 0x4) ioctl(r0, 0x3, &(0x7f00000002c0)="ae6c0795b197a743294255a6974e1abd8aebd543fd7b34b9bf658812afcb25d103f05e22c969dd05932eabc03a6901730157e1acd4f9b1de1ebd0705e31b8291db3a0ac52cd8e78b8e3709e222669d569409b26a7c90acb3e7f0663a8a03dc8d590000790cb4a148d4d21dd64551b3ccd18b25a599c8461d13fac9568c6dd5106a5f5632d419db464e5a6d0081a1e2669bf94e79b268ad5eaac2") getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000380)=0x2, &(0x7f00000003c0)=0x4) getresgid(&(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)) recvmmsg(r0, &(0x7f0000001980)=[{{&(0x7f00000004c0)=@in={0x0, 0x0, @local}, 0x80, &(0x7f0000001900)=[{&(0x7f0000000540)=""/182, 0xb6}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/48, 0x30}, {&(0x7f0000001640)=""/17, 0x11}, {&(0x7f0000001680)}, {&(0x7f00000016c0)=""/211, 0xd3}, {&(0x7f00000017c0)=""/181, 0xb5}, {&(0x7f0000001880)=""/92, 0x5c}], 0x8, 0x0, 0x0, 0x97}, 0x1f}], 0x1, 0x40000140, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000019c0)={r3, 0x1000, 0x4, 0xffffffff, 0x3, 0x8eac}, 0x14) mount$9p_virtio(&(0x7f0000001a00)="3a235dd200", &(0x7f0000001a40)='./file0\x00', &(0x7f0000001a80)='9p\x00', 0x2000808, &(0x7f0000001ac0)={'trans=virtio,', {[{@access_user='access=user', 0x2c}, {@noextend='noextend', 0x2c}, {@afid={'afid', 0x3d, 0x4}, 0x2c}, {@uname={'uname', 0x3d, "5c272e76626f786e657430d173797374656d2bb82c"}, 0x2c}, {@version_u='version=9p2000.u', 0x2c}, {@access_client='access=client', 0x2c}, {@posixacl='posixacl', 0x2c}, {@afid={'afid', 0x3d, 0x1}, 0x2c}, {@cache_fscache='cache=fscache', 0x2c}, {@afid={'afid', 0x3d, 0x7f}, 0x2c}]}}) ioctl$sock_bt(r0, 0x0, &(0x7f0000001b80)="f834277d7e1ab4e64670e0689bad21a2e7b40ed07728750b73e3ffa82fd686d6bfea467c9255a10911da669ba812990a8803544b74a203776429a198a0d61baa85dcb179fb096232e92ab2fff7fcfadf2f2d4128b14eb74d9e483d5721fe5969b9e5f21c1558477533c575947deb8db1a75021eac42f6885256acdd6ddf9f215ad8a8c8309470f1c020b81950bfefe840776e87956b9b5543349a04148baa84747cde4ff23a7ff771dea4c4681") setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000001c40)=[{0x2, 0x1}, {0x8, 0x400}], 0x2) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000001c80)) io_setup(0x5, &(0x7f0000001cc0)=0x0) io_cancel(r4, &(0x7f0000001dc0)={0x0, 0x0, 0x0, 0x7, 0x100000001, r0, &(0x7f0000001d00)="b46ef819f1e72e04760034f9c741a3c43ba3d216f00106da8b2b05dae0fb762ff8d2a34d75c3841d3ffdddf17a3aa85fb303437dc5220fcc2c1be07254c20c3f0989f97715f09f85a0f20a897c610016ebd84981ffe7e954a2ed35ab824b414126762cb3813f6dcd0c643e865f16418d9405a70b49bff80365f463085ea484c2b7f237f57b928f941dbb59c451f204981c3ae9e1e9ad8eea2e0d4305a551b019dec57c47b9b2261cfa", 0xa9, 0x9, 0x0, 0x1, r0}, &(0x7f0000001e00)) r5 = syz_open_dev$mouse(&(0x7f0000001e40)='/dev/input/mouse#\x00', 0x6, 0x208001) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r5, 0xc4c85513, &(0x7f0000001e80)={{0x1, 0x4, 0x2, 0x4, '\x00', 0x9}, 0x0, [0x5, 0x4, 0x225b, 0x6, 0x11e, 0x5c, 0x0, 0x2, 0x8, 0x7636, 0x0, 0x1, 0x2, 0xff, 0x7, 0x10000, 0x6, 0x0, 0xbd1, 0x100, 0x4, 0x20, 0x8, 0x1, 0x0, 0x8001, 0x4, 0x65, 0xe620, 0x0, 0x7fff, 0xfffffffffffffff7, 0x1, 0x7, 0x2, 0xc0b, 0xfffffffffffeffff, 0x400, 0x7, 0x74, 0x81, 0x8, 0xf3, 0x7fffffff, 0x4000000000000, 0x8, 0xa466, 0x10001, 0x7f, 0x5c, 0x7, 0x100000000, 0x0, 0x3, 0x5, 0x8e, 0x6, 0x8, 0x1, 0x3, 0x7, 0x80, 0x5, 0x8c55, 0x9b7, 0x80000000, 0x3, 0x2e47291a, 0x510, 0xf598, 0x7a, 0x3, 0x401, 0xfffffffffffffffe, 0x6, 0x92a, 0x4, 0xa4, 0x9, 0x77a5, 0x1, 0x1000, 0x4, 0x10000, 0x40, 0x8000, 0x90a, 0x4, 0x401, 0xbe05, 0x0, 0x7fffffff, 0x83d, 0x80, 0x8, 0xffffffffffffff00, 0x7, 0x6, 0x0, 0x80000000, 0xffff, 0x7f, 0x6, 0x3f, 0x31, 0x563, 0x1, 0x10000, 0x317, 0x7, 0x9, 0x5, 0x0, 0x8, 0x8, 0x6, 0x6, 0x143, 0x1, 0xd87, 0x80000000, 0x0, 0x9, 0x3, 0x7f, 0x3f, 0x80e9, 0x4], {0x0, 0x1c9c380}}) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f00000023c0)={0x6, {0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, {0x2, 0x4e23, @broadcast=0xffffffff}, {0x2, 0x4e24, @rand_addr=0x401}, 0xc0, 0xfffffffffffffffa, 0x1, 0x9, 0x7fff, &(0x7f0000002380)='syz_tun\x00', 0x0, 0x9}) socketpair(0x15, 0x8000b, 0xfffffffffffffffc, &(0x7f0000002440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r6, 0x2405, r5) ioctl$LOOP_SET_FD(r5, 0x4c00, r0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000024c0)={&(0x7f0000002480)='./file0\x00', r6}, 0x10) r7 = getpid() get_robust_list(r7, &(0x7f0000002580)=&(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)}, &(0x7f00000025c0)=0x18) sendto$inet(r5, &(0x7f0000002600)="3b04995b33756ad31c1e597aec8e8c31fa810cfcd5c14c383ca1ca34ca9ece660c5037324019c87ddaa65b52252ce203188b2abddafde4b7c141ac08d6667fe59a1d055c00294d4d22375a34196f1e7b51a6bac31d1758806b5ba160c715b21a5ebfd7392a9c00709977ce53711022d032686eb514f158c67bd62242e07b46f0fdb8e636bc80269c0680d6a9cb5637c789d13d95310f06d01eb5a20e3d18bf6dd9f8914893409e5aa970a79e43758a1381e704d23f0381bb50b2ca904ddb633da5944271", 0xc4, 0x24000001, &(0x7f0000002700)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) faccessat(r0, &(0x7f0000002740)='./file0\x00', 0x3, 0x900) 07:13:17 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x2, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:17 executing program 1: r0 = socket(0x10, 0x802, 0x100) write(r0, &(0x7f0000000100)="220000002000070700be000009000701020000400000000000200000050013800500", 0x22) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000140)={{{@in=@remote, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@remote}}, &(0x7f0000000040)=0xe8) fcntl$setlease(r0, 0x400, 0x2) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RREMOVE(r1, &(0x7f0000000480)={0x7, 0x7b, 0x1}, 0x7) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000340)=0xe8) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000400)=[@in={0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x13}}, @in6={0xa, 0x4e24, 0x9, @mcast1={0xff, 0x1, [], 0x1}, 0xffffffffffff8001}, @in6={0xa, 0x4e23, 0x5e9a284c, @empty, 0x4}], 0x58) dup2(r0, r0) sendmsg$kcm(r1, &(0x7f00000008c0)={&(0x7f00000004c0)=@generic={0xa, "07049c6a002cc1cf754ad99f41cfe1971bd1077ed01e1f796e3552a91a99470cb3b0962e91d05f76980566d419ebf65817dbd4d0f177e2d1755f33ea66fdcd57d81f4fdf6393f742e485862c8d8740e9f002ade3050589a742166866bb18bb55ed6ea09cf126f0ba301802496ac312f678b0f70fd0c61f74fe91be017f09"}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000540)="130eef62fd32e3be9c4149f5f967667d5101346d74b2be97c2da278d71e0d56443f2f64bb69ee5f543a136ec28fa3131b1a54c5d95d95e521cd27f692e301888feae47a342a5ae924b906c2639e8af9e2be51e4e3276d580bf212227601ae2b64bf3994f9b8aaf3d19403c3301c4a8deb58a1a1034457aa34854b23c8c46657b716535ffc58e986b", 0x88}, {&(0x7f0000000600)="9b092037ddc602170890990b4a599e5904522ab12c02c8574e291e587b6250e4af9b6db5a54bbf55f7ca3115589284ffb4e8da4815175095f0f22bd0a08d7146db3ed81cafdae068ccb20511892b2a8f457a8b3337615f022a2c50d1212de7bbe66ddc2635742f2ed057775cf26cdf00096bb4c3242a19ac3a4ffebe55eb8120dbf69c249dc31c9937457120014295f251c99372a97ee16f1a0b869b64ec8ff9510d76e7082fc8a6454c48880a1ddcc86aadc18b5a77a214d985f16d864772b7861331f49fef7c7c26ded87514d0264e304bdbfaa1365e", 0xd7}, {&(0x7f0000000700)="eb91acf3c85609f661b3c0cb1e83a9ac02588f3fd4b418bfb7335149e198d5800107696b885a193defba0f08f8057cc4eaae40d9178d9b145dfe613349334e0fe93ce43ea5af3120", 0x48}], 0x3, &(0x7f00000007c0)=[{0xc8, 0x105, 0x81, "8dbe552b12eb9a1a0954afbbc754168c986c1064b595347053a09150d9cd1615ecb70d6a96f624b4774b69f973d586d405cad1155b234f0868ded3484bca40568091d680b4e9d9e50a5ec0a0b7eef5f8d2b419f4620ddb00feea9db132d033b41e6b86d9c3f3fdbd13fcfccb3cb30586c8c17fd9097d62ac2cc4751f942edd7a55f5b569c8ccd576cf65986b3c03b8222026332ebfb8030a6fb1e4a0a5666c170673368f45eb7cb2fd6bde2311bb34b11270442ab24177f2"}], 0xc8, 0x20000000}, 0x40040) write$P9_RSTATu(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="6c0000007d4a96000057000700ff0700000e04000000000000000000000000000400050400000600000002000000000000000400626465761a002d7365637572697479637075736574246370757365743a292d5e00000600766d6e6574310000", @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r4], 0x6c) 07:13:17 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="025cc80a2b345f8f762070") r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$restrict_keyring(0xd, 0x0, &(0x7f0000000240)='.request_key_auth\x00', &(0x7f00000000c0)='user.^\x00') r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x102, 0x0) setsockopt$bt_BT_POWER(r2, 0x112, 0x9, &(0x7f0000000040)=0x10000, 0x1) dup2(r0, r1) 07:13:17 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000040)={0x3, 0x4, 0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000580), 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000000000008704000000000000000000000000000016ec4a74326ad2dd80c8739601a8ec73dc6ad0b49762d299bd2421846f50e5be456e8ce6a6ddc4c07b03f108a2b6a6e89d32fb07b35284adb50efba378d6094dc3100fc0b33427ff641ddd4deae273c5c735d3556d71a4a49a5975678382bbb63f87d41c6e5b279ceebb4c0bbfce8de5224cee15a278d4bb281be65ccc09a6add48f6b14b362f6790d4c59c0253041ec415a83f87d2a7fba16d5ad4e648519bc8fc389cf5b0a961aacf621049e16863c6dd3f7ce88df89f975d437131c95b2331b09d4f7093c2d6dc242171c5e59bf877e32b5b7a2f743a5474c9efa32d3cc29bfa761b5f3e7586b5296424caec8d28a47b499443c33b17a24"]) 07:13:17 executing program 3: r0 = memfd_create(&(0x7f0000000180)='em0\'wlan0\x00', 0x4) ioctl$RNDADDENTROPY(r0, 0x40085203, &(0x7f0000000040)={0x9, 0x433, "0a078ad3b33723f10a053d60a40279757ec9bcc5945a50f03d06cf2f9b47d2b2e9ebfa8966fc5afc870a4a461fd9118672ce830eddf22e4aa42a7bdfaa66a1bb1e381f045895236fcd7836e3eef95fcefa376e3b474b336ce3ad37820a9a7cd469a63d153582561415b219344a757d1a546331913e801043"}) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x9) fallocate(r0, 0x3, 0x0, 0x2) [ 240.464346] binder: release 13879:13881 transaction 403 out, still active [ 240.471424] binder: unexpected work type, 4, not freed [ 240.476737] binder: undelivered TRANSACTION_COMPLETE 07:13:17 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0xfc0000, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f, 0x5a6b010000000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000000)={0x20, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0xc, 0xb, [@typed={0x8, 0x0, @fd}]}]}, 0x20}, 0x1}, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)=0x0) write$P9_RGETLOCK(r1, &(0x7f0000000100)={0x34, 0x37, 0x2, {0x1, 0x9, 0x9, r2, 0x16, '\'keyringproc#:em1nodev'}}, 0x34) 07:13:17 executing program 6: socketpair$inet(0x2, 0xf, 0x100000001, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000140)={'NETMAP\x00'}, &(0x7f0000000180)=0x1e) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x100) r2 = msgget(0x3, 0x18) getresuid(&(0x7f0000000200), &(0x7f0000000240)=0x0, &(0x7f0000000280)) fstat(r1, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000400)={0x0, 0x0, 0x0}, &(0x7f0000000440)=0xc) r7 = getpid() r8 = gettid() msgctl$IPC_SET(r2, 0x1, &(0x7f0000000480)={{0x3f, r3, r4, r5, r6, 0x41, 0x6}, 0x3, 0x5, 0x62bfe7aa, 0x9, 0xade, 0x6, r7, r8}) r9 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r10 = getpid() ioprio_get$pid(0x3, r10) r11 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r11, 0x8912, &(0x7f0000000180)="025cc80a2b345f8f762070") timer_create(0x3, &(0x7f0000000300)={0x0, 0xa, 0x4, @tid=r8}, &(0x7f0000000840)=0x0) timer_delete(r12) execve(&(0x7f0000000500)='./file0\x00', &(0x7f00000005c0)=[&(0x7f0000000540)='trusted\x00', &(0x7f0000000580)='selinux\\\x00'], &(0x7f0000000680)=[&(0x7f0000000600)='NETMAP\x00', &(0x7f0000000640)='NETMAP\x00']) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f00000007c0)) prctl$intptr(0x2a, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000040)={[], 0x766c, 0x9, 0x3f, 0x401, 0xe30}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) r13 = socket$inet6(0xa, 0x1, 0x0) ioctl(r13, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x3, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x2dd) ioctl$PERF_EVENT_IOC_QUERY_BPF(r9, 0xc008240a, &(0x7f00000001c0)=ANY=[@ANYBLOB="ff03000000000000000000000000000000000000"]) getsockopt$inet6_tcp_int(r11, 0x6, 0x2, &(0x7f00000006c0), &(0x7f0000000700)=0x4) ioctl$BLKTRACESTOP(r1, 0x1275, 0x0) 07:13:17 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mpdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:17 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3, 0x2000) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000040)="2d091cfcc788261860b707f1a1c72c903b302c43355a35993a0228f1b50f807af7879cf43c", 0x25) r2 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0xfffffffffffffffa, 0x2c001) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f00000000c0)={0x3, 0x4}) sendto$inet(r0, &(0x7f0000de1fff), 0x0, 0x4000, &(0x7f0000db4ff0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) shutdown(r0, 0xad89ad736916add4) [ 240.578682] binder_alloc: binder_alloc_mmap_handler: 13879 20001000-20004000 already mapped failed -16 [ 240.612182] binder: BINDER_SET_CONTEXT_MGR already set 07:13:17 executing program 0: r0 = socket(0x10, 0x803, 0x6) sendto(r0, &(0x7f0000000000)="120000001200e7ef007b00130000000040a11b98191605ee0e851798b5bfd98d49f1cf0e5f037cfba420ddb75db7dc2d9549ba598a646f543fdb773660d72b9140cb0282a743ca6921f6f08c5d8ba7f73e6b1b83762691a5f55e8aaa353098768072d1236babc4e4b43a51115e268a1af08080efc88176fc68dd457997bb12582590d22977e2770214c2905ee53b675f341844e793b64a8b47143e7f9733db6f40795b6ef8b1789e8006e2c595db0d028bed4ca28f2e311044292d51ef263e051f86e3f214188d24a553ff805a05000000000000009df72929f9a9c9d3e20e2a18f545ff5369683d8ff43fb28f05d32eaf7df464de3004b94b6b7ae94d9cb4b1f1972eb10f001bb1f078586031b8b7a5ab6a07577af59dd1d91ca0f9700cfa75f0c670d78bb095de7f50c4971a6ef1ec36091162fdfca5b1bdead7af57e82884078be4276026fa0f49b596c4a0fd12dd2fe2e6a77123eaabd0bd4bb61e3b556cce8c1355e52e21fed73130eb86812a23ac40d8127479d897795cb6b653525bf7569d456415a685070994ba44bc0fe9595b4b137ce47b0a24a983add01937d30d4f81a5e6e84f683fb9fb754dc07c8701a5cb4f8bf8c61765e6c18be0e5dbb2fbc6bdc79f6707f067132c629f43539c2500c643a9846c25f80118c39abd25207f25d181937b656d718c433902c8d696298529aa4a47c13336bbc46f619d5e2579e7c38665b0397c1b038ed387f413ab19336e294ebeffcf5fa0d2c1ed5d4831c26dcdfd44a752da0b4cb4b32d362bad414359aa5db419260821dbaa1428ed9bb0c631444eb15cba1318cb3d68fd3f27e3c43476a93de354786a81dc7e695e55f64790f9d803055a21ba0a5b17cda22f", 0x26f, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000005300)=[{{&(0x7f0000004d40)=@hci, 0x80, &(0x7f00000019c0)}}], 0x1, 0x0, &(0x7f00000054c0)={0x77359400}) sendto(r0, &(0x7f0000000280)="7b04e3a40b051ecef60407ece7ecc9db6927c1b00fda8b3a425ba5186b4629dadadb3bdcfe5a787302eefd448b2c8ff89d22aa1dc960527c024a5a5b8828dbbc19e9b2e3414351", 0x47, 0x0, &(0x7f0000000300)=@pptp={0x18, 0x2, {0x0, @broadcast=0xffffffff}}, 0x80) [ 240.640609] binder_alloc: 13879: binder_alloc_buf, no vma [ 240.646247] binder: 13879:13907 transaction failed 29189/-3, size 24-8 line 2967 [ 240.646328] binder: 13879:13881 ioctl 40046207 0 returned -16 [ 240.676527] binder: send failed reply for transaction 403, target dead [ 240.699936] netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'. [ 240.699972] binder: undelivered TRANSACTION_ERROR: 29189 [ 240.758663] netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'. 07:13:18 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) 07:13:18 executing program 3: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffff9c, &(0x7f0000000200)={0x10, 0x30, 0xfa00, {&(0x7f00000001c0)={0xffffffffffffffff}, 0x2, {0xa, 0x4e21, 0x100000001, @mcast1={0xff, 0x1, [], 0x1}, 0x81}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000240)={0x11, 0x10, 0xfa00, {&(0x7f0000000180), r1}}, 0x18) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0xfdfffffffffffffb, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000566ffc)=0x8) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x40000, 0x0) ioctl$RTC_AIE_ON(r3, 0x7001) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a85352, &(0x7f0000000280)={{0x4, 0x1}, 'port1\x00', 0x20, 0x40801, 0x0, 0x2, 0xfffffffffffffff7, 0xdd, 0x80000000, 0x0, 0x5, 0x8}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_SET_IRQCHIP(r5, 0x8208ae63, &(0x7f0000000640)={0x1, 0x0, @pic={0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}) ioctl$KVM_IRQ_LINE(r5, 0x4008ae61, &(0x7f0000000000)={0x8, 0x5}) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000340)=0xfffffffffffffffa) ioctl$int_out(r3, 0x5462, &(0x7f0000000100)) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0xff, 0x81, 0x8, 0x0, 0x8, 0x80, 0x8, 0x2, 0x8001, 0xf800000000000, 0x1, 0x9}) ioctl$FUSE_DEV_IOC_CLONE(r3, 0x8004e500, &(0x7f00000000c0)=r3) 07:13:18 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8910, &(0x7f00000002c0)="025cc83d6d345f8f7620704f4312fec9a36339d79c5cc05961519d7958023cd4aff38b0d504ab93cecab5b614be097c7730cdc250e606a248361ad2e3fe1edb460bfc11482cc2bf87ca42dfa73d9459d47e6e35ee5773c2fee53dabc06bd330c41156a0f454854366d6d1f79f4b88126a8399d632524256b4d6cc99a734d98b889c57001e4bf8ed6bdf075da6918e74362dd574d3986d21830dea7a25aa379637fba4f905b3f2fcf743eede9bdef46cb9b18e708eb518a70e878cc2640b69697e9495c086540561b2745288fd922d8629ae4fae8") r1 = socket(0x10, 0x2, 0x0) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000040)={0x77359400}, 0x2b9) getsockopt$sock_cred(r1, 0x1, 0x14, &(0x7f0000caaffb), &(0x7f0000000440)=0xfe8f) 07:13:18 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40046207, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:18 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x400000, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000100)={[0x2, 0x1, 0x40, 0x100000000, 0x7, 0x0, 0x5, 0x36, 0x4, 0xffff, 0x2, 0x20, 0x480, 0x9, 0x6c2b, 0x1f], 0x5000, 0x11000}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000000)={0x1, "7457526c3000100000000003004000"}, 0x14) add_key(&(0x7f0000000080)='ceph\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000000), 0x1fe, 0xffffffffffffffff) [ 241.455251] binder: release 13947:13948 transaction 408 out, still active [ 241.462520] binder: unexpected work type, 4, not freed [ 241.464981] QAT: Invalid ioctl [ 241.467851] binder: undelivered TRANSACTION_COMPLETE [ 241.478270] binder: BINDER_SET_CONTEXT_MGR already set [ 241.483927] binder: 13947:13948 ioctl 40046207 200007c0 returned -16 [ 241.495308] QAT: Invalid ioctl [ 241.516870] binder_alloc: binder_alloc_mmap_handler: 13947 20001000-20004000 already mapped failed -16 [ 241.528815] binder: BINDER_SET_CONTEXT_MGR already set [ 241.535174] binder_alloc: 13947: binder_alloc_buf, no vma [ 241.535435] binder: 13947:13948 ioctl 40046207 0 returned -16 [ 241.540808] binder: 13947:13962 transaction failed 29189/-3, size 24-8 line 2967 07:13:18 executing program 5: r0 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x3) bind$bt_sco(r0, &(0x7f0000000000)={0x1f}, 0x8) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 07:13:18 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m0dos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:18 executing program 0: r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x2) read(r1, &(0x7f0000000000)=""/28, 0xe8) r2 = getpid() sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x2) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1, @time}) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x45) ioctl$EVIOCGABS20(r3, 0x80184560, &(0x7f0000000300)=""/166) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r1, 0x80045301, &(0x7f0000000080)) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f0000000100)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x2000, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a") fcntl$setstatus(r4, 0x4, 0x4000) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = shmget$private(0x0, 0x4000, 0x1223, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_RMID(r5, 0x0) write$P9_RLINK(r4, &(0x7f0000000040)={0x7, 0x47, 0x2}, 0x7) r6 = fcntl$getown(r0, 0x9) ptrace$peek(0x2, r6, &(0x7f0000000080)) perf_event_open(&(0x7f0000000240)={0x2, 0x70, 0xffff, 0x0, 0x4, 0x87da, 0x0, 0x8, 0x2000, 0x5, 0x9, 0xffffffffffff0000, 0xbf, 0x5, 0x8, 0x2, 0x6, 0xfffffffffffffffa, 0x7f, 0x80, 0x3f, 0x1, 0x5, 0x4, 0x0, 0x856, 0x40, 0x9, 0x401, 0x7, 0x8, 0xa, 0xf8, 0x100000000, 0x200, 0x7fffffff, 0x4, 0x2f7, 0x0, 0x5, 0x0, @perf_bp={&(0x7f00000001c0), 0x8}, 0x20, 0x2, 0x1, 0x3, 0x50e, 0x8897, 0x93}, r6, 0xf, 0xffffffffffffffff, 0x1) sendfile(r0, r4, &(0x7f00000000c0), 0x80000002) 07:13:18 executing program 1: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x4006, 0x4) syz_emit_ethernet(0x7a, &(0x7f0000000400)=ANY=[@ANYBLOB="27e1ad4fb2c6aaaaaaaaaabb86dd60e3837f00440000ff010000000010000000000000000001fe8000000000000000000000000000aa0420880b0000000000000800000086dd080088be00000000100000000100000000000000080022eb00000000200003000200000000000000000000000800655800000000"], &(0x7f00000000c0)) recvfrom$packet(r1, &(0x7f0000000000)=""/4, 0x4, 0x0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2}}, 0x14) 07:13:18 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000019c0)={&(0x7f0000001840)={0x10}, 0xc, &(0x7f0000001980)={&(0x7f0000001880)={0x4c, r0, 0x201, 0x0, 0x0, {0x1}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7}]}]}, 0x4c}, 0x1}, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0xffff, 0x400000) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r2, 0x800448d2, &(0x7f0000000200)={0x1, &(0x7f00000000c0)=[{}]}) 07:13:18 executing program 3: r0 = socket$inet6(0xa, 0x400000000005, 0x0) setsockopt$inet_int(r0, 0x0, 0x80000000000f, &(0x7f0000d10ffc)=0xfffffffffffffff9, 0x2f) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x9, 0x800000000060) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80}, 0x7}], 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000d24000)=[@in6={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}], 0x1c) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000080)={0x8, 0x7ff, 0x7b, 0x8001, 0x2000000000}) [ 241.564116] binder: BINDER_SET_CONTEXT_MGR already set [ 241.569549] binder: 13947:13962 ioctl 40046207 200007c0 returned -16 [ 241.604222] binder: undelivered TRANSACTION_ERROR: 29189 07:13:18 executing program 1: r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x8, 0x1) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000040)) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(arc4-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001640)='9', 0x1) r2 = accept$alg(r1, 0x0, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r0, 0x2288, &(0x7f0000000080)) ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f00000000c0)=0x62e) readv(r2, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/250, 0xfa}], 0x1) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) 07:13:18 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = dup3(r0, r0, 0x80000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='\x00', r1}, 0x10) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x4}, 0x1c) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind(r3, &(0x7f0000000100)=@pptp={0x18, 0x2, {0x2, @multicast1=0xe0000001}}, 0x80) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000200), &(0x7f0000000240)=0x4) sendmsg$nl_xfrm(r3, &(0x7f000014f000)={&(0x7f00003c7ff4)={0x10}, 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}, 0x1}, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x4d, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x88) 07:13:18 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0x40046205, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:18 executing program 3: r0 = memfd_create(&(0x7f0000034ffe)='\x00 ', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000053ff3)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$RTC_VL_CLR(r0, 0x7014) r3 = memfd_create(&(0x7f0000000080)='\'', 0x0) r4 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r5 = dup2(r4, r3) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000000500)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000480)={0x0, 0x0, {0x1, 0x0, 0x0, 0x0, 0x401}}) [ 241.613000] netlink: 'syz-executor6': attribute type 1 has an invalid length. [ 241.627217] binder: send failed reply for transaction 408, target dead [ 241.650447] netlink: 'syz-executor6': attribute type 1 has an invalid length. 07:13:18 executing program 6: mkdir(&(0x7f0000000100)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000000)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000300)='./file1\x00', 0x0, 0x0, &(0x7f00000001c0), 0x30, &(0x7f0000000340)={[{@grpjquota='grpjquota=', 0x2c}]}) openat(0xffffffffffffffff, &(0x7f0000000080)='./file1\x00', 0x801, 0x10) [ 241.714637] binder: release 13999:14002 transaction 413 out, still active [ 241.721685] binder: unexpected work type, 4, not freed [ 241.726999] binder: undelivered TRANSACTION_COMPLETE [ 241.750188] ALSA: seq fatal error: cannot create timer (-19) [ 241.783251] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor6: Inode table for bg 0 marked as needing zeroing [ 241.793279] binder_alloc: binder_alloc_mmap_handler: 13999 20001000-20004000 already mapped failed -16 [ 241.795833] ALSA: seq fatal error: cannot create timer (-19) [ 241.808363] binder: BINDER_SET_CONTEXT_MGR already set [ 241.816656] EXT4-fs (sda1): re-mounted. Opts: grpjquota=,,errors=continue [ 241.825574] binder_alloc: 13999: binder_alloc_buf, no vma [ 241.831284] binder: 13999:14016 transaction failed 29189/-3, size 24-8 line 2967 [ 241.841414] binder: 13999:14002 ioctl 40046207 0 returned -16 [ 241.865973] binder: send failed reply for transaction 413, target dead [ 241.871317] EXT4-fs error (device sda1): ext4_has_uninit_itable:3150: comm syz-executor6: Inode table for bg 0 marked as needing zeroing [ 241.897334] binder: undelivered TRANSACTION_ERROR: 29189 [ 241.903784] EXT4-fs (sda1): re-mounted. Opts: grpjquota=,,errors=continue 07:13:19 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x102d}, 0x2c) ftruncate(r1, 0xff) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xe, 0x0, &(0x7f0000000080)=ANY=[], &(0x7f0000f6bffb)='GPL\x00', 0x1, 0xfb, &(0x7f0000000100)=""/251}, 0x48) 07:13:19 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m-dos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:19 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f00000002c0)) execve(&(0x7f0000000080)='./file0/file1\x00', &(0x7f00000003c0)=[&(0x7f0000000100)='^/\x00', &(0x7f0000000140)='tmpfs\x00', &(0x7f0000000180)='tmpfs\x00', &(0x7f00000001c0)='tmpfs\x00', &(0x7f0000000200)='j\x00', &(0x7f0000000240)='tmpfs\x00', &(0x7f00000002c0)='*\x00', &(0x7f0000000300)='tmpfs\x00', &(0x7f0000000340)='procsecuritycpuset\\lo{\x00', &(0x7f0000000380)='\x00'], &(0x7f00000006c0)=[&(0x7f0000000440)='cpusetvboxnet1selinux!vmnet1(user^Asecurity\x00', &(0x7f0000000480)='tmpfs\x00', &(0x7f00000004c0)='self-cgroupselinux&\x00', &(0x7f0000000500)='tmpfs\x00', &(0x7f0000000540)='vmnet0eth0\'lo,*em1@\x00', &(0x7f0000000580)='-&\x00', &(0x7f00000005c0)='tmpfs\x00', &(0x7f0000000600)='tmpfs\x00', &(0x7f0000000640)='tmpfs\x00']) mkdir(&(0x7f00000000c0)='./file0/file1\x00', 0x0) rmdir(&(0x7f0000000680)='./file0/file1\x00') 07:13:19 executing program 4 (fault-call:5 fault-nth:0): r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:19 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0046209, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:19 executing program 3: getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000ac0)=ANY=[@ANYRES32=0x0, @ANYBLOB="bc04000052f2ac73d206aa32e23b5b843e6888324f2c9875e5670cd6d70b30acf677462fcf1d8361d26f71f8f0a124b0cc2419cfb10a19f6d39b6030c2c7bdb77d12e9f3c0311e4cc66173f4a60a8f554a200ef06d0e1fdd1d5a1033cce3cadc74cd16a4e92c458dffbf587b195e27688a390245e4770a76c529fd98ab59fc40d5979eb63a9abc90f9efa5151228c787908d2f84ea8f3f2dfccf6ff562c92a3eec45c946f5b1ea3ef70cb1a47656cb54e65b746cf5bd402f588e4fd77f7c32caee44b9a4f658af47b69f1ed79c5ce1a82dec1f9f8b434da68acc9a25b4bfe18a014e6f154bc02cf1389e68e7fd36a19e888c940dc0c0de1db3370b16cef2e28d7e2da8ea6a9310760b20844633c78a36c7a3a8e99d43b5b9f466dacc027193fc90a374461cf4c270441db1f4660e864b203dbae79ddf19cf0df72af72fd0addd04ad519ea253f6af6b7aafa6ba9bde761515f9381b3bf773de0781bf77c739d5e4eaee4af2e9616f9d9f688e036c3bac0e5166eb90971d22c2c265f393a5342e249816dfed70aeeb1138912da6c5f13bf8afb0362fa2d59f27c842169e0ad1f415c9efa263a1a3a6e3849b2f988d6828cad122508df65d3e728c4e061e86abdbce2ec90ecfc736417db69c8c6fd4794f261c97e2eaf69857e27309fae3815a032cf705a3decb6b944b96ae02ede75f51efd547d9518cb2e9633177d5c5d9cb618dd9a469bc42e7c4a0881c4c90ab2168615b5aa4cb93f336a70424371abfba32340a32e80ad983f460a2872aedb714d1ef79bc4a9149bd135232fae3425d32c9329da7b83a2f220ccc259770e87a8ffd8336e7cf875628af8d19838331e93987117f91486824e2fa38ac867de54afe9c598a7584126905c75df0921401d6f17a149684b518290d028ace983cfec3512aa66ac7e5fc71d2815a833081cecb76bd60117e62414998a83a87f805dd5bc14f07ffbcb0d481ed6a075679413928e2b348d9c18f5eacd47a9983c01be9e8621fa8e5d2b33a15543600d632b5eb973c038928627c59f46d5d81df0cb453e0c2309acbae403d9a5c6483f0acc12ab46eefdf1e5a326991baafb8d326da9eef18b7a756209a1aa680ded1526d92a35b0008c3d6c84f610bc24cc4f7dca4b44d8aa977eeae2941ba203a937e792486cf6042bd0e19478edff047dfed57afa324e73318a2b3f37866205aaa350c94a78918188a1843a88f6573dbe7992f52761477b8b4b969fcdb789aee1abcf2b9457080c640027312c8c823fa2d38bc948594d2821e88dda0aada9a51203bc3ff4b850f7268605264c41641e078847a60527ca88bd359499a9e38bc77afbc466fcd1631a539f649ae9935f08a096fe47dae75d4f104aec452277bce963cfe7753c01d1786b7bec4bf23e900666e9203d97bdcd234b33a5f911e2e939425c3f5aabf25d4d7f9896e11e1e1413fe91e20454e92dd39c0016fe728c6d02d3b07d944604acae6e57064ef6151e7fe956ddfdc671cab26245bb8b345f963a4bfcef2c0250f50b7a17d918cf5ac4e6cd14281660be520501805e86bd441c8537957c21c886f85750dbc0c6f365f2bc1e3c7829c40c8f27a74e4bc0f3c839c1be00bd04a123146abc2e7a173d65f6cfa90a2e6e07159416f40fc4d055c85dc762c271cfff2da21deb17e1db35a5cc9904b5bb75e041fc54117d0cce76677b7acab7adb8392a950"], &(0x7f00000001c0)=0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket(0xd, 0x4, 0x3) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f00000002c0)=[@in6={0xa, 0x4e22, 0x9, @ipv4={[], [0xff, 0xff], @rand_addr=0x40}, 0x3}, @in={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e23}, @in={0x2, 0x4e24, @multicast2=0xe0000002}, @in6={0xa, 0x4e21, 0x5, @remote={0xfe, 0x80, [], 0xbb}, 0x64b5cb6}, @in={0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e23, @multicast1=0xe0000001}, @in6={0xa, 0x4e21, 0x2, @local={0xfe, 0x80, [], 0xaa}, 0x8001}, @in={0x2, 0x4e22, @multicast1=0xe0000001}], 0xb4) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000000)={0x1, 0x1, 0x0, 0x6}, &(0x7f0000000a80)=0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000013000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000040)="c4e32d7d0b02dff40f22e70f01d165660f3881ab00000000650f01591bc4c3715cd700c4e3314ca9897e0000ba3e0fc76ec88fc9d89ade", 0x37}], 0x1, 0x0, &(0x7f0000000100), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 242.491905] binder: release 14036:14041 transaction 418 out, still active [ 242.499006] binder: unexpected work type, 4, not freed [ 242.504377] binder: undelivered TRANSACTION_COMPLETE [ 242.519437] binder_alloc: binder_alloc_mmap_handler: 14036 20001000-20004000 already mapped failed -16 [ 242.521782] tmpfs: No value for mount option '*' 07:13:19 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000040)='./file0\x00', 0x5, 0x6, &(0x7f0000000640)=[{&(0x7f0000000080)="396b71cf124225501d3bb610dd42310435116838904c02f76520f15e5dbd8dc6df7c4a7396e7fdb7b69c28aa33bbc09639e1068cc26d4b08505622ab784af91050fed68283dc011e4fc181f0a8d9c4ab03f7dc1298e511804d62d716e757ba0f043d925257651bc1175a948f64eadec6e216ecc00ea0f5b5b57307139a90619b690967732c94809dfbc6b9", 0x8b, 0x80000001}, {&(0x7f0000000140)="b8f3fe6603a6f661a5dca5b59ff9e4c83715b610164921e3f4990438d5fbb2ab6eac685efc015fd7da4162b8a8441b5cebe92fa88010ff2a77fddf1bff44f15136a28ab1b021570cbf2588c5e655056cb11c0e0ceab7e3f6200b00c9fd6a143ad2f1de86a47278526074fa1f526ae716b75c8a5d9ddfc302d0c3441729ba775473f841e0e30df98cd068839fc28a365427b9923e257ae7d7cf80c0d1b2237e9168b3f3a53562", 0xa6, 0x2}, {&(0x7f00000002c0)="38a5f09597af1cc58c14769cfc1502df93aa4ad6b1ab8f3ee9ca13b8bd6497c75920339fa1f1f69d94c3d6a532db8f956dfe9eb33ce470374dbfb58435e53587f74a854130c2287e47c424c76762fb93872bb338fe736921b46e894fb9795b503ebc9c77d1116616cef3c7622280ccf640020c052c4bca2dc894d9f463b5b7479126dec2a54f563f18922ba98c34666456ff5b9877040b7c63a9df871178f5115f24b96c2ed5802d02924dd4827011bd7ca6794a4a6518848584b314b674a8ef70d72ce2d5922a8dc5963fb5ac9389b7e79c6253c0d74bf433e46ff7885c0e84f1b66ae3577cd57c0866eff5efd2f72b508505cbfc744d8b", 0xf8, 0x861d}, {&(0x7f00000003c0)="aeba73c5a89cfe7464feecf305bfbd9f53bb34b2b4d0ef599a6663d9428d19fe1c1ae9f3d0df5b2480249600969bfd6a896c30eef3ed03b4b43503f0695674ea49114923e227ede9e75fb7f1a6ccc0d85111039e0e31cf9ee6d040b15b0ce4860135bbda74887175ef79f7933e07533598af10b622e76331cade4a7a3adcfa7e945e5d91668b44222869594d937d2aa7129ed045450bf48c9a3e441c9601cd6067cfc50b84a8782963d56e1b62506ad9ca71602c3c83d3f8f4f3b12825b1b7606fb160", 0xc3, 0x56}, {&(0x7f00000004c0)="bbac7dea23839a8e3df0268e256d1af60f4b31fb03f84d3cef80cb04320fe6f567780dc8e208a085e12d869e6072ae1a7898dd8155f1b7e80a803842d06f880b528d8d1af9fd81ac524b4c0f76c7c472e7135729a4b50b17be0f52afb25b6b2aa7f06c48905290132bd4b4ed55b1518c1a9f592534bfb126c22c1868eb8c84b6c3c11b79f27cb1c53cc8178953350456ade9de71b16de8c120649a45463ae2e54290efb62e5db3e14a195e53852e", 0xae, 0xfffffffffffffffe}, {&(0x7f0000000580)="d53aa00654b7ab3ad7fcb9da0fa8db9932d143cec8b34bf9a65e4e8fd48ac8afe94360f9c48dcf185301a140af1d2d819865422f2d381601781d4eca6ca00c06519b83c7430a779b5b17737e1f66b3c3669bfc2b2e3ec2a79acb5c65023ea4c8e528eae57d09b9bacff94f5d73a231579c6f52476be375e3ba215fea78d731824f3676050e2f19", 0x87, 0x9}], 0x80, &(0x7f0000000200)=ANY=[@ANYBLOB='d,\x00']) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, &(0x7f0000edfff0)={0x77359400, 0x4}, &(0x7f0000048000), 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000000), &(0x7f0000000100)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1004000000016) futex(&(0x7f000000cffc)=0x4, 0xc, 0x1, &(0x7f0000fd7ff0)={0x77359400}, &(0x7f0000048000), 0x4) [ 242.544105] binder: BINDER_SET_CONTEXT_MGR already set [ 242.549653] binder_alloc: 14036: binder_alloc_buf, no vma [ 242.550727] binder: 14036:14041 ioctl 40046207 0 returned -16 [ 242.555331] binder: 14036:14050 transaction failed 29189/-3, size 24-8 line 2967 [ 242.581526] binder: send failed reply for transaction 418, target dead [ 242.593808] binder: undelivered TRANSACTION_ERROR: 29189 07:13:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@delneigh={0x28, 0x1d, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@NDA_LLADDR={0xa, 0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}]}, 0x28}, 0x1}, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x280, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000040)={0x10001, 0x0, 'client0\x00', 0xffffffff80000007, "12bb93d3269a62ba", "760f8ccf98434a0ba35307af7797af3a8deaf15eb6450fdfa8222f8a8ccdfac7", 0x9f24, 0x8}) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000140)={0xffffffff}, 0x1) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000100)) 07:13:20 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mXdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:20 executing program 1: r0 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x14, 0x80000) r1 = socket$netlink(0x10, 0x3, 0x12) r2 = dup3(r0, r1, 0x40000000080402) ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f0000000000)="5a6b1af878d0e31ddc061037aa6a031eb3a1958ec7a2434bdcb4e279afd5c72f498533c0b8430f9d61e704fbb4cd2df6ee") r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000100)={0x0, 0x3}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f00000000c0)={r4}, 0x14) 07:13:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc030620a, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:20 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="025cc80a2b345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = accept(r0, &(0x7f0000000080)=@un=@abs, &(0x7f0000000100)=0x80) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f00000001c0)=0x4, 0x4) prctl$intptr(0xe, 0x200) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x80200) ioctl$IOC_PR_CLEAR(r2, 0x401070cd, &(0x7f0000000040)={0x8}) 07:13:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="025cc83d6d345f8f762070") r1 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000380), &(0x7f00000003c0)=0xb) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0xffffffffffffffff, 0x32, 0xffffffffffffffff, 0x0) ioctl$SG_GET_LOW_DMA(r1, 0x2282, &(0x7f0000000000)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x6c3f, 0x40080) mmap$xdp(&(0x7f00000ab000/0x1000)=nil, 0x1000, 0x2000006, 0x13, r3, 0x100000000) rt_sigqueueinfo(r2, 0x6, &(0x7f0000000100)={0x2, 0x800, 0x6e, 0x7fffffff}) syz_mount_image$gfs2(&(0x7f0000000180)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0xff, 0x1, &(0x7f00000002c0)=[{&(0x7f0000000200)="a351279a34b18a4ddb1d664e6af8a0306ab98549a4cfb4566d2dd37addeae5e3f433c31d2f163aa3749dfc9a06d6645476c9da971369688d43fda3f96d44ff940442ea69ed89f9d3957950f2e704bae5f7cdb85b7f2a0291af3cffe7c1003dbca2dc3c7a6fde104e76cd322a83264dc06606f0dc0968dbef734fb257183c45f0c61edf7c082897b1f36cd4214a7119d8c031e6dc21df0d51ef2a409e5394adaf83c64222957b72832a358f", 0xab, 0xcf54}], 0x2000, &(0x7f0000000300)=ANY=[@ANYBLOB="6c6f636b70726f746f3d6c6f636b5f6e6f6c6f636b2c6e6f61636c2c71756f74613d6f66662c737461746673000100ef7474756d3d3031303030303030303030303030303030352c6c6f63616c63616368696e672c00"]) [ 242.765599] EXT4-fs (loop6): VFS: Can't find ext4 filesystem [ 242.839594] binder: release 14077:14083 transaction 423 out, still active [ 242.846628] binder: unexpected work type, 4, not freed [ 242.851950] binder: undelivered TRANSACTION_COMPLETE [ 242.857649] binder: 14077:14083 ioctl c030620a 200007c0 returned -22 [ 242.870595] binder_alloc: binder_alloc_mmap_handler: 14077 20001000-20004000 already mapped failed -16 [ 242.882603] binder: BINDER_SET_CONTEXT_MGR already set 07:13:20 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x20000, 0x0) r1 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000340)="c536dce67e773b81e25507f1b1cd6b413d6691d2f30efb9ae84e1c1a98e141b5bdf2a833dfd902b0697ee5bf0a301ddb3ce78a0127290094a376a7e0a0f29922ce2c6b4515b90b749b58aa6508a859dd241a86f75e7a232c4af2e7a1d61c590c120e31bfa1558bc1bfb2b8c9aa5b93297f0948f8703d66b5cc0c0076886c07d058f018f0af954ae4143c7e52eccd42c2710b951633dfeb257ec3076ee3e74556d263d8952d97187a0981d6216e6134db6091941b64583f04a76fc1838210dd20e83ef13107b15082db94ee7498d5dc3d6934484762cb2ff5f168be93218081be84a57e79cbce904708b9b978d2b702b9a24ce43d9e718e104a2f66b6d2f8d4b73324864391d5e42797b7cc654ceb95a0a68a39d1ea8ddb5d3023e44160c5e9b3f67fcedda1ca68557e32bcbce5644ecc8a186e3bec1d7807ab00cf34c8ace41dec196677ec6867ad0d876a94e086b4e42a271870cd31091370c656cda8d27bc68a42bf2a8cdbeb3e02ed61934b95c1916372e23a036faaf6fc003f30cd392e9d4b7e248092430b21e2346fe5af73ab5bf555a2ca75b7db5f0c0f8dcea7e6e8be81348b92f13d9e54f0ef4ac7bd43a912a487d427db1deb9717b45c301acd1c756030ab41807ff801582aea1fdf04fd49209667c7fd3e4b54dfeb95a131ea5bcd98e6a2dc565b5e778f6f1827ae0a544766a1cc637c678afef109219524596cb49886e13a3c042d9cc71ce87cd780fc2e2ceebcf3e49be89aa769990556da1abb6b7fb10c875664adf9161eef5028592a2071373dd2280b469406a51038c3a09eb57add477f01d71c3a95928ed9c0c09ff1de2644dee9cbfa8a0b0df4741f9f7a1a070e96e808b2ec6978b8089b1413b82d1c14b3388775d48d1f08fa758d4b7f830ba6c113061f1375e2bf4960ea146b85d67f4ba993d7ae9889150fd848957a87619ab883802b77b7b775967601c40dd8072ce90d156ae846d79021e4164fbb21d546767d66dfaa4acf7d078badf79c7ea8281b7ee635c50d58a0728be7d5553a3987165c482260905e3d816f73adccd82efcd5bc4281dd3b97defb0ff36027aa3f36fafa95e29380c82b8ff75834cd452ca246927b09d40c88a06a8db4a0e46c1d1fc4a4341dc42f96de32da321784f0b4c714d7b64b5515b8aa4070d2e6ddd09fea030b637014ff4d7f78c73b7c42ea99b77cb90e11224ba14c6586ad77f4c47721b819c31162b1567059df0abf460554d9f924c366e30f4db918cd84c80a38fbf9b57da1dcf40749dced5fc35ad597f24692de8b0dcb14441787f645070084eb4d6cb41040e435021df5968d2cc0a1a0d168e98d949c3e0e851e69f2c84e4f9832b8c4f9536dd6a86bdcb6a6a7b22d04104ae5285ddcab89004a41ba4b431aa328bb5e890818f97c3e50e53742cbabdc03fccd38a72f701e2ce56758322e0164c1ee125a9671cc855f9b3eb80504ae7e671218e62cf948ddf8455d13cd95fdf16d22c68a7c62fff6a87f6f8bfec17ad3e41c02f089fdafc4380f1c3600b06a92911d70352edac52ddf584ac5194d7f9c02676a9662621e20e2a3d133ef14c9ccd3f381e7aad93e331e23e582dba4e2806a0653025db8cc4b5cc634fac52bc5b760614f88715ff92e3d0a4126afe97b7039ccde89e770fbad5914b0ff620f507439c694b6a74860a7d2f048b6e4f8dfaa2f2c567f0bcaef43f79215360747c8b036ba719c79fd14f61620337cabf56a644b6b3f3acde08cdea3e06902252abed3c62350053cd2be6ad260355525d0199aeed14e3537a0a10e8c16987bb1ca2c4594877df8af5ee6e6b5a3e62c660a362e4dce037d43dd495da743b18e7327d9f5f5e478f79176c9c5e484f254b04c3e250dec09fc508abaa068346645e039fa02ea416524511a5bec45a783c903d9df67674d60f1126972a429ee4cabecc38db696fdfd4c2ae22a49b0dafb060035406c12666f8bbbb761df9eacd8866748c202440f3a71c78d4fab7d36f94b7fb6e08ccc38179ade8617a36faddc27047f88667444304e9de7bd7a2520502c424ca808f0f3d4a6d8f3eaac0c599dbfaba86f016349ef67e1bc21609cd79cd47c0d9ba2a95b7dd77f894bce0ee4a5fb86e4f1641ac90d1b2fd42968cb02a4c3d8bc1c0466a4af5dd05116d5f2c8a53c56a9bb6706a2e28f1a6da3bf0422a3c53c536afead7e141295ee6d6b051e96ae7ab6a268e612c756ea1985b4395ee95941a12be93fda0dd5d33cffc910253e3d97cbef67e16b7512144907f9f04e6ca9108c15fefeb7790c53c13888d1ad00b5f8053da1557aa7f663dfefd14068a751af9a42f4c8afe3294672bf228e0dedc99bfd26ae8fd9f1ecedbbae0a5f0e37d648e21ca71f47ffc46e765187ba996dfafce94871aa3c6e4575a3b4f7fcba72f675831c8acededa92b1bc08a01df6543f410c197cfc72da7f7f172709cff2dc79648e29da07b74c4d20ad087d27d1d1620041c4fc03f8e3ee3679b889d84f0b54e402542b31f853f48c2a81827d7c0106d3283156cbfa5b57a630f8e8c63a7f8a353654eb935c21ed5a09b09b521958ab0c0504a0b81f1a8e10a9e4848c389b41a4e51aeed4254d953677f82995a3600f83ff75f10d90df49a792a7d22a457b640db165de392fa1adb2b658930f88ca1e733dd2aa857cb0296b39a8ee2bb8d966c02f338b7058f7ead4ac3c9614f1f61a79898f37d840a675a00f38a4a681619e15d923339a98d54176a85b163ec553180f42e406e8846b51deca63962f3e6370d3db51afbe0a2e81afe748dde548655fb9023ab388cb2b0574db05b87a19fc547482782ce36bfd9636e0f7c6b5a87943c126906ee9422813da6f5885b3201c5018e0ce90351b93c1754e1c2736b57710d46c69c86f6147f1dc49a5a7a2cda944537c3022499fa0344b90dd044163fa2b33a537b83583c303aa7b694d72eeeed5b8a7a7adfb36f69a185b77f36832332225964934b7e1417c6a60e0c42b396738cba004db96bdeeaf9bbd68999bd082d20dc9186c811bbebc1b56765cb6b34d0672dd3c80299a8e4517d8a5ad0cc167541c6398199e38afe204596075f4fe4b38bca472cf12e6167ab19fd848cae5bef9690540059f10aae98b7da14b65ab6e64a42540e3bd6191be12175235442ff45c75117ca62a660191609eb888458c9a14f9fcf602626bf5717733fe93c668e298529a300705d557ea51e4eb56d4ed7ec125decdafb5e906978a2cf6131f211b193a605278cda3610865294518e1a9abed94f0f738a74af3f8ade4eac29df60dea506cf92c94241f1f4c729aadf71ddd5eb95d7f3e6f81d0e3b1b2f8911e4450ee167da3aba6df252d13d0e45043748718247ac17a2d0bd6cda7ebe25d402d3f3a61fdf6cfd6f21494e093a62ed41b5ab70862b5abc9a20919c5cbf1c8760f5e5a0b767ef59f43299eeefb5d32e5a7030c3936516c3febcde659fc82f619540dce3731968060f130be0c5872028d4549ccaacee3793441be5d9fe311b1d42fc9e2a277d0c6606e8afcf8bb057eed1d96b48ba89cecff2250d53d9d34cd7a3ca7139d8934cf4308e19581afd8a5142706f87176cecba0da16ce93acfb2a1c28068e030ae4b633213ae561edc326528391eff48b101083fc2510f0ad062b60460865efcea48004d35067d4b29d65dc9a4b816cc999dc9891ba560043384f5570619f8549cb68819795ab530937acb13b9569cfe40ed9c639a09a7b2ff71b06bb845b858e4331dc75fcb2174c92852be97192b6921f406f77266025be98e892ce468e5c3f1aea2f8ca5b4942f1863b664e41701b223792c95dd41fa66efc56519c929a2836b094d8168374639c0ae30808dd96f3c0d2c3d4ea1cb7b74f20ed210175796c23b6495f3fdd9b41540c76422353bbfdff7f960eeb3a1d59e68123f5572b21723c23b25ae04552f9e1229cbc57464b8105946b55a82923559f8a28ad32070fdb27b6ddb4bc4a24c34f861d58b8cabb444eea217c5df4dfcb423075546df060071323a77848d86afa8354cb8fa5b0262e6d106ebf945c79bd34663cdbe329d1c9dd09fb1f07c0c3bec990d3dd431867d52f88152872e1fd74a1d56cdcd54d0ca215ddb7d274205c3c148d8c5b2a8184c7cc7ea7ccf6ea997020f307c38d4c2ffb0beb3658e9773d2bf6c8f066f2dffebdc7e8a6c007057668cc037a80752fa94a55dc95851c2f111dfb7323aec31eea364fe9914234e1023289701db6fbbefd6660ce31e52e3825e22a3c6292dc720ba4b6e04079e0cc2a4a5ddb6d7c27c41b13dd5963d8a8da29d32d14db94361abe969900126f2945e51b2952b7dd994ac964e91b938e6188feba75c86e8d49fcb3ee12bafae99a864865ee5cc909e6d2f22840a4e10a2c2d80801321125ebfa6baf9d5e315cc859cb23e476af88600ef98c96b6140fcd8ec67774785b8bd4b7a414ea68717ac8bf0fb93616b5354362349161092ca28c6c900d9a706fda5ebc495bda31e0d8a23832b3caeca91fce1798e6f1fdcbbecc37435b3467ebcbc7ba418b998d574520e498b70b0fc1ff670eb248b745002101abc4609e3872723d7021dfa27e2403f9ec3d2109fabdeebe48b67de696da0e10d6665cb6adc3eb4d027281f5a67b5b45b20840f70a35946fbb2460d5359d91ad53a1f2bd09941bbbd97df3d5b7012b1bcb87098df83666836c042f5572de838f2adb971260c5ac0bb303e8a37acf08dab19404ddb52f96002b368d7946c1a3ac725d79c62649eec6d92c0e197e6b3cc444977770137266979e128f72d883e0611d886a360d4275fcc4c609e6dc6b6f925fc3207016032eac44b5568f5744bc3e6a0b43b197eb40c2ee17787f0320f182d9694430a2c6b6b965bcba8e15a8656629e7dbe816a5a47ad17a7fb7f7e9c40394d216a29835aafd65d6de5c383e47c12c1f8450194c9631ee8c05413997875021830e7ef5053fc60d3b423d7efb4b45ffb0ff69e1c06f97d7953344d113a97dba6d686ce62afcbf0f022240a90c0af2b985c8ac8710a5c26ea700de5fa19d0104b92db3f4b19c6db56e23519e1052ed0cdd67c0c0332398720f682dee8602d19f4d032f143b3567fa8969f5879921eb5c10b6a7a4df5c5e20e581fc7e4d5fb06f1703577dfd0c6a078b69e3afbbf5ca67e2ca48becdb5c743877b1f74ff7675bf6f3bff628b1b09a95a149ba0155287214b6b7cf6fed7ce778396813e06dd65a2f06a297e288aaef1119b83cd14c3b35be16a7641c7b1b024155a19c07271be324ccb51989e05b2735d1035cc07b653ca0c468ffd230962a279c047cdb20706d1e6569b064e90f9667fed0e6edb23f4e02f1e7eeecf64fc0f6915741e579e8377b27aeb13008e872fbe86300f90dfe0c016a2cf58b2f2b6009b9baf97ef2cef8a7091d76e8777b474b75f46de81a349c66558662566ef0c8f9511a275a2093f2b2de6627eaef26b4ef0f6ff08fd97d838fc03b1f3ff8837d97c7f1070e2ded4f49d07c0dc394e188280bab6990ffbb25161d50deb98b8e5e8fb6021e5dad7c152706fc37f255121cb72dceefdf78ea05057819bc40e96ce0c92fe8f6aa8ef031b262821ac8dff030405fddd42e2b250c21cb790736dee64da002a1aee0ad8074bd2527ee8a85f50c3b487339da0d38e479c83d9930d9bca797d44eda13b991517ea7c5d922bd04e17f808188b89f172121598ee8647107f10dffef12f605efd5d255fc045a489cab9caf72b1d83bdc76b529b9190b87b5f01af767e19d49374b3d6b83a0403b0578cdff8d4", 0x1000, 0xfffffffffffffffb) keyctl$dh_compute(0x17, &(0x7f0000001480)={0x0, r1}, &(0x7f00000014c0)=""/215, 0xd7, &(0x7f0000001640)={&(0x7f00000015c0)={'ghash-generic\x00'}, &(0x7f0000001600)}) 07:13:20 executing program 3: syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="646f733178664b1d7ac5792c7569643d2c64656275672c6572726f72733d72656d6f756e742d726f2c64656575672c04006f77657865632c644500000072642c636865636b3d737472696374"]) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000180)='./file0\x00', 0x100000000000e000, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/fil..\x00', 0x0, 0x0) mknod(&(0x7f0000000280)='./file0/fil..\x00', 0x0, 0x0) [ 242.888531] binder: 14077:14083 ioctl 40046207 0 returned -16 [ 242.896381] binder_alloc: 14077: binder_alloc_buf, no vma [ 242.902178] binder: 14077:14086 transaction failed 29189/-3, size 24-8 line 2967 [ 242.924165] binder: 14077:14086 ioctl c030620a 200007c0 returned -22 [ 242.932808] binder: send failed reply for transaction 423, target dead 07:13:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306235, &(0x7f00000007c0)={0x8, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:20 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mcdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 242.941376] binder: undelivered TRANSACTION_ERROR: 29189 07:13:20 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$unix(0x1, 0x7, 0x0) pread64(r0, &(0x7f0000000200)=""/176, 0xb0, 0x0) bind$unix(r1, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000040)="e91f7189591e9233614b00", r2, r3) fstat(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000002c40)=0x0) r6 = getpid() ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000002c80)=0x0) sendmmsg$unix(r1, &(0x7f0000002e00)=[{&(0x7f0000000080)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000140)="2f1e4f218c9a555050199c2cea6a21373b7551b59d84ad584368d5ce5eb1b17803edb1cb9cfc43070322ad7570ac2031f33b52a358a0c557", 0x38}, {&(0x7f0000000340)="7e9f458c68449b6288e6e342f9898d3094a664380bb7a6fbbdc4a1e9", 0x1c}, {&(0x7f0000000380)="46dc7ffa96d24ee1a59bdb7ad2dba99ccb36e3898a8efc8fbc1165da6f5fb938cd809f809f5f505ba03aefb0fd3405b4e35a5589a702125b288e30ef497e0678959557e84cdb4dd22e805e2312f0c0b05f1c476f1031f523490111c6323b181b690b0c51412c41", 0x67}], 0x3, 0x0, 0x0, 0x4004000}, {&(0x7f0000000440)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000001800)=[{&(0x7f00000004c0)="eedeba4dec6cc79f6874984b05d1c98651fe1634466841e7247b936236ca776f725838b08ff211305612400ff2ebcaff100e8ec2a5c823dce86c1d36e38dd712f32c55169cc87b6fad08a87b38c3d16dbe4958b1d8c68da1eb539f08e3d94133cd2202297e9844d124601073edc9b99e1758035ac0259ab933c6a3263a77efa90d5372b63cdfaa8fe2dc8ac696360c1016c2aa3bbf4abcfd43e061001d0f66f09491c616d7146203872962bbd0e8eb7a11be07215d2fd40ca166feefcd1f184c9fdfd1a7432ff38b0def5b44bd3febe06e95150deed89659ba46307803919cc2b2c148e369c10de1f007f5c8765459bd42e48076ccf124bc625a597c8310da04d80cb3312e8bc7b2b101daf2b35dbdcd5f98b58ca834416f1cd5a3dd794c45888539708f10cf5cbdf74e7d0a9ca69031542965b36758df48a97fcd033563a3337ce1fa7f44201c639274fe00685c87820924e9aba398bc510a5e07a3e16b9e06a95c7d588b32a70b90541c2580bf46588114c46b40db5addc1426bf78408e2fa737e7ea07a0c5dcad782e730c190c83fc3a9805d215d16e5053391284a438e4f78ec9008ed71c3c0ebf5abfdfc60166a13420736c2f745553fd9ccba5c963f12978f5d4dadc5746f6e2a4ce232c7a9a67c338635e04ee69a86cab4fc2d0fa631bdee90acdf3dba3cf596c00354ad2e67f8954bd2716650c9f356e26528308d263de1641fd51d4cc4f6520b57b088c4be5e2d955b3340e7f040e1f02470b9d65362b6810267f50670f07af8b5cd3afca5a4cca980c006f2a5bf0814af46b4c2fa3d607ba6dfa96fa79d89f7f3befc04c5557efb8a3f7af1ded21b7b6ecc80ba7660c372d5176b3725c5a3a90d75abf2f005bf90c4c1cd1acb8724b752f0f72fb9b0b9c4535e510bb0f001515ee24f07f208024024689de94536f5b9cbbe98a2bb6c18c01c269cccc4eeadafcaeb1cb14d99d19e69ce7a12ae138afd8fd63e94e48d156b85cf07c96ab64f4dba841634576b9ae91e72487fa735125087592171b7faefeac2158addc97611914a333a20bdf4672a4ff79c3bfe1d5696de13ba9ec2f9bfab22e6d369d7f25511b24d14ab9fe44502c14fa929ee2bf542d877c9d4649e30d5d98a27ccf4df9b25ad635c9a44e978c370dbfe4fc1b621f2fc4769fcaf66edaf1242cee7e3adb4d18b04a07104debdd748970365d202f6057b049901dcd108af2a16072ca2e0ad0e2fcc8a4d190f16501a0959da54fa69802359bb337729754ea1931d8a1119042f53f9802983e2156c2cac3d9ab530be0487c1868283d30281844485017bba34f52228461aabdf55c464b4e3eed722f65190358a225aa91629299b7685a30330b07e4e1d9615f85181ac6129e58aac2146d1c26610a8d6ea3b642acf12572a1d431217216134617a4d0c1f2b6fe3fc073adc8ec18a98a9857017c0ba5c26f3c854933e2a25b10400f66e192c29a9b1be106d498d27422e4292b087c318981878d774a0206f51982466b52771c153bf949853bd0a8e57337924a3ad953a4457772446aa75d1f544b1c021799297da398f1af9bc92c6afe543ddac65e4c85c250d4db603c95760096763e26bfdf76c84d0d17fe9a2deb0d09018b70f10c9cbcef31f4d5d5660d743d2f60fa786c2491a2eb47508bb7b66e45dbb4bd51ce5373e28b1c383c64bd802cf8dc1fe3564d49636a2c2a2e2bc7b6e512bdbcfec08b47acc03c73b277a271a3adaeaf6b5410dc7ba82a0767dd647cebda5dffe6cdad58cfd802920ca5819aa160ea4021315484de3e801aab9ddce4d219773a8ecf05e90acd125f8400f236948ee3f91d26970b1f1582ad2d30eb2c67086c576e396dff9fe7994847de592dd186105f9076b4eab69ff319612d8694183e67b3f053a376550decb8dddc782be5dc91c3fe894589bee5638014838cab4f0d3a7f4e26a8a304a42670d6731abf5e8052c568fd2f45167e6c580d82ef590de40ee0937f1d708aa7e35db83e7c7299400f3b65ed180ecc1f066b75a05c6c5f3e538dd8e6970feebbab9157abf5923bba5534f3befe72e44a3b65c84a21ce1b1faa3c82bd84482a5656e4df0fccb91be6c3535aa40031dfaf05c826e9ea49c68dc6e0781c75a11f70e7c219f01b85c3be9511d99220a93908442afa24e2b1c2c9a5329048ecf7d42051148c564bd2311854b5797c31354e23c06b01a9ab93a93718ab517766ca0616fa64868e80604481de7ef5b6d42013fd03bfa9526bb7d187d8bd40b5f956bee7b1653f74639e38e8f05a7afe9373f9f2c6d8d187671082e7489d69c0f8721ef81946227f93dcbaa5fedd31e8c1c4940b88bf534aa60ee87998cf06f27eb6c29db86e5ef2ac619f693685fca8bb16ba0fe3c3f69da1a404d37ae89f1a329f811089adc884f497885145ecb7469a2ff19e5764bdc29a59c00680b38179714f47cfba780b3e4ac83459365a0c0975d1453244e112ba0cc5caa767b45fe750ff63c484eb3e246e277937883f4cacbe189c66c16379c05e6161886bf6d02d0613245530808fa7b50fba9ed99898ed825051f04a7f30441d30e4eed55375f4b3ee057a9782e2a42b5f4157d683ff6243e272302e6241eb0b7c3a9271c54c930f93f8269f00652aed1d18bbd7f9fea54ac7854f026d030c6945a7b0138f2970d79e311c525ad9d3ce0b9f66d055c3f0cc079791a536870dac0ad526fd5d06afe851bc2d43c08dac787784f8c92945bbdd3546c5a7299be596b490071d36e9902f0014a6b8c1907ec99770a6976961d493e174e490ae21452043a4c2d094135ff99ed4181f3de7d881e8ea12dbe9a0b0ce97cda417b80aea9758bc4339d9d92979f079388ffd2f8f2c9605c9e2cda177f61d0e6a300a9b8a90cd55ccb55125e3acacd437f8291f7f629a2bb6cd6fb5de9ffa5d6fbb08dab175c01f54cb6c461d25aca6b8e5297efd0d3917a8323ff78626839d0b42ce7cccedf1dd08485e907513635369f238525d70cf3adfa44b577d3c38ac4c41993547ecbfd6cdee7832eb9d1ee7d6538eb34ede9a6e0c658cfb5aa615c20187540485676732b80221cd2abad22e91f62bc5176de08cb3a5f303eacffc5ebfeced22f95449ff6da619ef3f029c1cf83ad6adff73df9d905198257d1418f2eb8f8a49078f4c8eb934012a6a56a2d99e3ab32dc511eae99390127cd5248d9a5cc762888de76a6282e1d2dc1f679125761276aaa75c26c1f2c92672843034005cfc869ad123317980a281d7d407772d9807f88f8012292e9bb96ca7b003ae3b3bacb5fba9d932a0ac6a4ee9271de7ba17e7b6372579ba1955bed765cbfe7aeefb99f7d38bc2c7d08f6c921748759a5821f670f2dae457295547950b5e9dafca24dd7c08b0bee25796c684786d80608decdcd130ea47a74eb0668755c53bff1f325583d2c08fc389335feb81af38ab90598469f82fd4b8cf194c0194110d3d024cf43816c083a8830e78e286037ec822edc0421800067d05d75794bf29f697db2f553de307452b8fb11f8b090d1b55254536596e07032ea36f1f07f1f671fe348ed4b1c0c9cff701e6f0a6b25536d0aaee2d551f00f57c533bac279eb944ae56dc9fae5c316bec2ddf29b2c6919454eab91e9cf5546893d810ea14567bb57c6bce36393dbfd3c6ebff2fdccc915ee7b64a69949e7d92c3557c861affa7cedb9bd1cfe290ce7e35fd432f97f0efbc77a37ee8c976f021c891c35d0e0a1d6573f4882c81fb83a83a23deb66d78a7fb61e7c25deceb7b4adaa915067c631857edd048e5a792b6ba670c1a1caca47b71e2a8045bd480e009a77bcb634761a832d5b6d3280126e621b1c10777dc76a774609704855695979fbe783759c05fb24c2b146476f589f4bfdd4af44f9a705c48ee7e3ebe188cc191a327e54e0ad5bf12dd56ac993adec57e45e6b590dc32bcc890802aaa99c92eba5caaa7d9f4817251858087db404e735af4da09459b66914561a681b33dadc000f97c8f675f2fdaba87306a4357a47490e74d1c22148ebd1e9f1a967163fe5f9abd6a8c019cb1e11ef9348dacf21275d7f546375f623a6738e451be487a99ecf53028c679a22c2123ccc4aff5839aaa219b49444534e20194931c0c70ac121dbcc6d5ed4b5e2d8c5626ad94784996c4adeb871363efa380f011f5b7ff2ccd0c60c3bcbae1826892e660de420c2f5043a7da26e85d8a9fd7328af7bd541adc1b4d4b0708ac733b14573e8564709e075479f7554ecbc22de022ca07e145b7efd1ac0e9da17b956fbc5b5820c3c280e90c952ad677d0cfba1e6aa336eb06916ab38e3d5f22b724fd4ff9daed8462b16a5cc74d5b139a5008004a746350d9e35054e050cc319e04b55d3910910bcf9634e2fb80ba9c0a705c3b3fdfdc76b3a16ea7a344565c14141af0bb431def48322dce469ca45b22b3f1e8b1c9d761e2bbf317e23b30e26eee1b8f159fc0f15ca4bc05d9131f42794043b0760e75e34cead7f33e09bc3358aba0978df0515235be5be5e4a8b5f5ca07ef7c641c61172906b72987f3681d2e6397625c9bf3b5aa9ffb3b426e16ec52d272250a99efc70b832f721c499d73f667a8055b3713143f4fae74557129cd76152b26864f00d3416c09422f130c6bbb2eda85cdf312fd88d86e9a38a818aa5e1010e1aef35c7ca84370e2b410e649cf4277ecf421865eec3d778c655f44d70f3ddc61a080df62daf8590a1b4f74b4e3fa12442b5ee8ea4653e810322b551bcc1e60fe3ba75f4f145c67d6861375f8a6e02f6f18868c65a19276dced89f9e73846d0e3813b7dc8891160e82ae1348e4fb436536e4251b2b2313f4e1cbc34867dc58f60e0bc21743f0a74cd0f55a28691a92afe47b668c94ae16f78ea7b15de57d758bf36a896d2b6340de6a34f24c7927be90e65a89a1e094b8c9f2ece3ac77f58cac056be4a3c20448ce07b6b24908e8f0395e1df49e55aa62d511d658de2a8d8793c98773383b0516d5b4b2b5e651b93a1714d23d3791cd830a73db636704b6eafdaa7b3bb121a45e4df6de562fa3cc6b307528d4568abf89728cceaf943d45f29ba77ebdeda69c848c4d77c67e14a3a4223a025f55ff0e24cc2f1708e307701da451e33402e923625841ecfdcc0b13bdabc566c7b11d00d68fcf16c9b56c8510e9a125f7183071c46050a4cbcb10c2586cabe6ecfe079e36e38258604deee47b480c7d1932b9602861faee8edd28b3322b88181b7e11a73fd605db9f1bcf6ede45ade142d2c7aa98912bd30d729f262c804025487df04e3f24483579a578b9464aac84d0a8cda0c636eca5fb099a59ad7d06017bfa6e0ec4a66038aadadd0c24f89a467c286c022995b5ac9a8d68e5960072ce9c979421c4741f3f121187d0b10058dae3afc8fd401b8aaa5c354d3e2d10c669b7965b20581273d84d1b5dcaeebbda1325450ebdb7ab3626a5eefab7c6484f18af01e2a184cae360139de067550c862a10936bc0a347be60ddc495f519798482120c90700d06e2c277a2ae0d21d79bfb2e9135540e01d1de7b65a99404df2bb98be5dc08ea8ab545f23bbfee897375b9dd19ae8c2ed89779a3ae8c9008befefb0bbe97f8e12c84af3f4b9e0fc316e6fd0c0dc3d725a7373c3b2989d265cfcd15a89debef18676acb7281f70c356594f801d00f075cc2d35c7d5da1bc1e7d2ed19ffbcce095a702afed63e6f350bc89c819beea155a949cba6114f46fbc087300d311d683f9b83d670a7f0bde708a6afb3cc7fad4ff2fa8128c8c394660985be27cc44480c732086d", 0x1000}, {&(0x7f00000014c0)="2bdaeb337caa0d7a9ba3ef5fc8262255044d044dd9ceb17aef7092c8818e04d07b824b8fcfc351eb06f876387d994764571a7f6adfc462a161eecb162321c7e27a80f2c3f5c03334b1eebe04e538f21a6e193d96006f51b851bfc69acf8072b8ab9c2fab5de8a63282619437027bc307de6311c375d40edc28d3595eef9f5daa1eaa345aa232fef5e2fa512318817c4a5f5cba897caeae290d9967f4be00f2a7ae9abb06f5c52ed80eb04f690c359682435079e04b80f6096e46eadf1a33a96c421c042bfa4804595cf4418f95918c1617181fd8", 0xd4}, {&(0x7f00000015c0)="472a6629ec5f703bd63183d2b569e9b5d29abb6f15258c4adaa9a6385fb1afb2792c153af9476421b7044680900d1c2c8b49640ab7b3d80477f12ed858f135f7a47b885f4a4f987300ff6228459e9455f71e7c190648751c1c6cb51282be5e6b5ae60ccb6d967890abce35081bd845c2732a9fa10a55c17f571420a890b82cac568e54090032dc32544fe55dd518aa25b46076086afcc0756f6d7071e47ec40de988d3062b", 0xa5}, {&(0x7f0000001680)="1519a46e347098ee86687a9dcb1a18becc63f39f3824b8dcb53e8e66ef0133e690232b5780345584aa3fe47e1c9b39d33a669c3cb279e6c081ab0ae0f93a05aefe715571cdc3ef9a289aa4969d1e8259bde136fc4bdb032706079c513e21c63fd5dc2b25db2e05d5e1b30a028bd1239cab645f04e8a2837f9253bd8ad4d77ff0fecbd1b6db9df3a9b082893472fccca4e27f58c064fdbf", 0x97}, {&(0x7f0000001740)="285729f9b1b963c6685ee47e95e1b94eb68f91e2f4e60afa87f56f1e30b99f6866cea276d143af7f9c284a269decb99a3355ba0cfa15a8041ce51495a077bac186b8ab66d413c3175482ef0bdb0c633a27f1324469c958ff87589deaabaee75b9fa3d009d1ec8bc546ebefbb00b34116f8f0814a3ea811df7a70bfee9e4f5c5027c96968e23e3986aede7392fb197910e9f07d24f4e66cd8aa9244951734c5d66391a344b76ab945f211386b5ed7cf67b32d6c75303d81720550b982", 0xbc}], 0x5, 0x0, 0x0, 0x40000}, {&(0x7f0000001880)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000002bc0)=[{&(0x7f0000001900)="e996a2613948bb1f3b87df64abb4840bc1a46a7f90248e5313f9bfef9748ad6a626dd93de4b587810f2230bce974a0baf1cf1f5117ff4d4ec175c590f708e316844c6b89474befdc80760456698700791cb97d416422e02b0ac725881a6e7103223db79c5e8e89294360a9d74c9f33c7498fb3545f3760086265a5a3bda3460aebc2621aac183a09825b47fd100407b5af517d93023c59ffea80e2884004de7a1cbcd6514709a731fbfd71795f1f9cfc05bceee0b739bcadaf78dac6e312d07bc76b73bea3bd909bcf87044b28c6cf9f3ef97d56d118c12890ef1aadc2597936d99a0e4177df29b363821cea23e4b8f0873397edc8529a1674842a1a7fbf2b23a38e9207bad986a9083804ea823374b461d998d648c96ce677bcbc35e855f36889dd3fa353ca8b2a8fc673a6b018f3b84b5ba8dfebe326ddf2dce61f56120f44508feda1aad4e1834b0d51c8b7fd0f7f68c36d31c81c271b015ba50a2c4b3a0b7ba78ba1de1086402ff369a807acc22f8df615368d5c5a5bdf1ffe9d81fd21bdfbbb8c80f841b7b9c8c76264827acb9d33e5741c7d728099ee00f028b75fba97479246639efcc34e6e09b19b28a86aac1c938e1a00c7a5cf7c229b5e33fa53f1b712b60488bb55a1c245195281a59988262e3f8781bb11138adb6211ae62edc1d1826346afd0a019c57b9ac8951ef91d06e26bfacc3d2514a21f83d02c3adda971d17240fea7cd0bd562237976cfe7f48c0b70d0414188641d9a341e63921c643186cd7e432074fe2b0dd4f0fabfb8850bce94aa5d99bd9c62fb244a7517cc2024c08ce6605de87797746d1fe2ff18d2bc3f8bfac4613de1637db2cffdddf9f9160b25a779843c63a3e1bf50beb056fbb0e5271bc66c64993aefe301f0b517249d6733f9ec15de697d10dbe81221b7138c1b0da3804590792f8e575a6c669050e99e6ebb676d4f000ff2575aafb7d8d650c4d4aa857f28ce169391cb0a99ab8dead32feca88af0e83026fae7fd67c19c816b66153ce9c3b80667e8d6f5c7af844a8948eb9fbcc4946ed1d87315b6189d124e15668308cf8a9aa704dacc739815d9dd33b303746e21121498e3f0c936e26560b12a79bb557c84b028078c464aae5fffc9138ed2dc57ec21e55ce433315a5eafdc9e96044905ed45bb974a74f5911f190f0c8a864c201f7fe6482f2e075354bcad5438fb745dfcc18eecdf0d22bb604f4746d44a0b451a6867340272915bd2aee16d70e66ab4205f17a8a5b219dfd9f0897ae65197f35fad969319e46e628046461fdc13f2d146632f32fb216608a37abcb77861c9dc8680560f577ce5f81356d037d88f88515cb5fc84a5eac3547edb65b2bb0cbf57c17f3c9978ccc83984ff0abd4903e5d0082fc37ce51f24bd580eeb5f57f4a28c8069cc6b50c164e26abea6c55e1f55b2945ef98fd3d04d5f2f58b2b46246573e934c432c82371fb4a867f8347ba943eb44ad73ccdd43bbeef41c653ae5cf5c17c19d03aaac25ce71dc9f874acfa0e566324e3394bed2f403dcc2f68b6f371e0e80880e50b54391fb748b14dc49af9bef3fa34f12820cd87924c7fdacfc05064abf1f3b05bcc702aec6d02088875daf28e04e86cac71fd7c3e1a02c258ee5e496c1f55011675e3724ad6d9ae613a3eef9ef84f80cabe60492220c2ca77dc58a8945b483113213f323482e758119b5422d59385054ec5175fc0338fd4abb15f32c321c05bb35fbe5743aa5f72c1e1fa5f947a5812c4f8ff166a0b8f9f6d2276c63e1e417d59d9d33b0d965b16ba5e86dd11ad7c338d1e1114d81d97a0e33ad2065a5ecb8a947aba79e23030338338b146dd225174ec52ec50987d854a0bf6b9274113e9571339fe03c595b32a223a988637faa74f8715caa19fb258b2607933453370bc2484ad66f0752f22879943ec2b9b68562dbc34d586ad9a83e1850b8d1ae04d8863fdbb9ef3ddad6f1766751828afbe827c74b077562ae90e4ae5b63b59b4ac5aa6bfdf9793572be3ec329d7ebd2db7d8c9a855cf0573ebd7a246d60c40d79d5cd273ab239594fd06165a2f223864bd4a1621f54ce54728f7549cb24fb5d95c06d53c67eac47aae5a66e3026c9148b4ac4ab6d4edbbf64c320dd7db51305a7dd399b10bdf171ace7d7d609c5f8b3c6101612f704a5d62a961d2acc6ec5f35271e71bb5b7da25a45110539ebcfe7d1aa1715e940bff257a89b5bf44f2e2d6ed0ebe901b8e68490992969da3a43c9aa3d4bb7b90585d384b45ba8a96c53508cc4b15c5b9d63f14d7a1ebe9465c46c9b1319a951898359f5f05a68abfeb7c5605fab1e513e30101d2d1dcb9c294a3165c77a4648396a7e35a4010d746c4694427fe93d4ec1a79520135dbb34f40cae8e97d5a693ef2fc56f7684aadfb48e56c5ae9ce41dd165864e2539ac4d4094f04b1c8e74f33132c5e214c7c5d6ba83ce3a686d95d29220395249318fda77a4ddbab1c8b34729e418ee7d70a345414bc8b0adc5c2c09a573882dffaa34816baf028a9fe9e481154f147ed88e549c944f3e684a224826ea28ed059f1736df0f9b1f2ca2c5d46c2ab3dd5da29bcc6892e831991f5da65a7a7f3acb71b5d4deeaec2a7c6e3a0d1f0cf50801038869c510071d7ebaaa5918c309369efdb15f72039750e08f84e7a6cb24c0ee52b01e9767c2ebb56adbe141c03659a2633dd916d4594e7b1d487714d8ed89da27729c255408b454f1e8d80463d3013f8ce23380ce27e9ef9bf70430963374788c5be247839301f3acc6a43fadf94f481fe1dfecbd019cf1bdc4918e3681320c216bea7ca6b753dc3808c3092251063413c3e3afed3238cbce4d25659f85b126094173615c1598a15588892debd3b44d269b340c3fe698099676e289f9fcb146a7241794457928d757c72497ba6f9fe4df3e3046bf1a9a1309ac429df43e9a7d7ae9e25bda6c31df9af58c5319725ec30410cbf231a6747c5ecbcaf53539e3fdeb4f338af1f09408b5094bcb117ea1efd9d9922ebec4ce2e95cda15dbe9a34ccbc277ece38f7e9c1c7ab399f80f0c812fea54eda96e4dc8d27c86fec41e5b0e2582282ccf9ab465c3aad63057c22f61b70c4164062eeac89106d7930619b1e47f91679f8b6d6f4340461b1da70ab0b166376a23f8e4c45328d41df3c754c5954efaaa1ca68130696a2a2d77590375404e9db2d7f20bc13cb819c8b5ab106ab4644ea09a819325a365fa23a3fdef286e701bd90b32b44ff16fbbfc67b2a42cb1c97d4967df2ab4181d7d854f9e25ede04e06bf920e34a2af1bfa7fa37c31891eb613ca9d883a2c121ed67d665a08a632d9677915ca8b5184e6bcf672a94a75936ce3864e0afbdb150d88ad46f68be66e3a81fd19e39f47a34f2998a611b26fc7a7e2e75267efd2c1850ddf38c85ac9fd4e3f3078e6a57238c879b1763525e4e6aaecb0de1c3c87efceacd23e96c7bb022982c016cb92327b49748cd70fb8523f9a4d98a2748806d663369863d39973a1cf859897c8f06b684b8ec077cff31995dc6810e09017902af0d6f839f73cfefbc92c9c07624b68f24de1ab7b06219117b7685018287d41105b45aa1ee2eb3453729776bd8cf0221f62e63d3d073536a1343e40514472d38acdc9fff74747a8bebfe76c0547f8e9dfe4669678a7a146a0070cbe8a0d8372663fa83b01d89ca4da4ae44ec960bbb6e8f6e13cc76ea52b06d6f09d9ed7240576ed6f5fc53fe49f480d20345a4c747c647c7ba14ce6c19040d07bfb4171862ccd2fb163045d1ba0adbb8ae743441181136c5937be8cb202919bdc54ee1fb9b37bd8214ee30d6b121527b7abd3f873744dcc7b4c2582250799c72ccb6f35c4d2bdcbee313dfee9c75fcd3370849ec17af0234d5c644d76e63f6437727c17379c87e2ff28b886dc7439802155ca4eede0629787d5cc48523b247df1495b9216a13c9d1412033d2593582408dc66370335d21722d8a028a4dfa3f4ea27021afc4362657df3e447c7e69ce8ae52493618c5fc6eebcdc74c1cece7a969f412868862440a11edef7c1ce1854db9e4a085ceb02a8ff85dd61233411918fb8ed05c865f2cd31a852ab697139b22a00bd04327256522d9c702795c9668c546980375008c99d201bb3f62c4b1ee57901e0976143548b79f54ef45e62a56b186187f8d60239fe9d9cf81b732e4ec0914f22f79713eaa38cea3f83d82fe8f08be05a6cfc39881c679c242a16883321bc436bf0e7d7811d7548452e05eb17f32b485e86471830ffdf28614cf1764247e94a05921997054f1a4756dee6bb32f26310f6206c6cdaf0f79b66c83f36464a73e0804edd481fab119fb21bb9f653d95ccab50fe4dd9a918af86bc49ac469f398d71f00276548ef125f5c3d7516db2f5098ef260d633b6d36715c4f43b08b6044571665dff7aa035a58ce4111d34a8fdadc20d2dd6ef1b702a1740b14686c3a09fa90bc07ea5c21300579c5fed4857d97301505316a1e33f22c10e5a120b4640215bdffc5ee060f0687a52e0a974b8eb062a1b9cf88a64e0e2a12d7beab0754b004f893b44492a8116a13e26d249bbdca6a3c9537ee81c098893d3dcdccb0baf3d08521b3c2804fd77b6a91441b963be1705a8352b3a97c34a68e16e80fc6cfa19f7d9f9e584ff6935b102c6d1a90000c372c002e5055876409772c8f080dae6c214f7e57b148a2a5baf38819b8d2b8162ad4dd9c0925dd8e257ea0b72ef327106414a12693dfcf66513d4232febaac6ac0999379f0e478e19de7c905b9aede45ac3ddd04138db4eb9235e173f5f76a75da1037d0f3c17c457a8ca19b47568a1ca04090063b9064e58da3fe580fa7badd7a1b3f813e10b3006f49f64368a20f62bbc3769191310cefcea1d1b4709b4a04443d2585ea2ea72ee57f67fd23eb262dfb6afea5d230a6d4ec8b360ccf3d960c9d09c1f8a611c45164167c54a7d6c6be876f6f078e41af5d09b1d307335805237407d52a7c60a16a8a7196dc6300103cc108bbc6a63f2372839aec798e7bdf31299853a2d856ec928b76845bbbda224f2f2ec41318f3e271a38d4f5c78f9988ec68d4cb7e0cdb03ecae50a114cda8ffc811abbb41d269b26d353838cce211e6f6fea5bba5793bff7c89e2eb97545a3f76f52b22a7f3ffebf377cce8438ab12ee3bccaa49df048550515b7517b9406b4bf529ee80f09ed31bf7954597ef21b255d1b0256ea1cc1b5d50523dc3c2024091fc7a43a5ca2d22125dadbe0c1f98f2a852e1d0d9cdff677d4c1de5823fd1dfa11aaa1d1d2fee8800fd27913a47b2c5034dcd476c9689334748f8a09e780a46919c5a11ab55c742c9ca2a1451d9246ef6d38ca0da25c233db6dee53f4bb985b1ae173cdc3308c67290fb87c2d27f2b172dd7bd8436cf54e4d855b599780e22ce329bc4c9834816857a66ee4a8f679a58d8bc466b295d88b6cafe05a1c0c32ec6914e8410f382fa42ba85b2a25a788bb0056056d6f5e9a5b41b4ea3b93529ec3beed0e89b3094d261b08f40b494a7552db236f80028007a40837630cd792e617333db9245b9281aa3f44da742eea7257951fd3c5f7a5ce2df89a984d738a1632166973d7b84e70336d9a93853b7d6e6c002b8ff43389420fc0fa26b378bbfddd9fe52fe6e46782eafab32d91da7aaa46b9b2527b11deac33028c9ec2d991d1cf6643ded482fcfa6ec0ea4751af4632e7c0addcdb4fbb08c8b213c06e7df3e88729ba491e320b32b2017d3fa2c38f069da05807f9b7f2d8ba4ca877b59f194e1facdddc20aa7412c93ad9bb6728d517", 0x1000}, {&(0x7f0000002900)}, {&(0x7f0000002940)="b5f3aaf8d2cc6d22c28c7fbd382cfcfbccf5f44435941e83e78e7511566070ea12be6fd99a2f9d3f388d26b8c47d0912cb13ae810ddfdca163c90f31cfec5641b1620af6e0b2918c4fc7246cc4810ae88398f66378479587bf84d02b75dec18a71042942bf75244eebc108796fd9b0db88e31e40f4014b1d241c95a886a101c42d2e4c0e67fb0bc94dfa802166dc53ddba73738802463cc9abeb23cdeb196c8f78c5e8ecd23b5528444a1be5f53ce2a1d26bafb1c72b98d235b1fa4326a116694c754f1857bf12280a13b286c4e33bf081a67ddd1b2560d2cd8d15e690d90b8a23eb3172b0fe1f62c2e2", 0xea}, {&(0x7f0000002a40)="a8b74a762429a57ad9b7733ab2fd52df516c7a2448b634a75a11337959e0321ba98b24fe960abbedc29cf781749bb0edb40bb99dd5f2b72720a3837177a326d12b37d43dae434bd702aae81a6d5f7fd72aa2f8e1563808fdcf923a3539e4ac3b15f9a9a3d9e6e3724d862076344640", 0x6f}, {&(0x7f0000002ac0)="5046709a187182cf2828f0a4ccb6bc9489c60299a934ce6e68d14f749349c379c6de1d4ae67e7a82a9eb87b177ba586673b08a78367b732970ef1713976fd3fd8a4cd3e03a7b179039aa48a03dd23b0129d290ea0b46932c1615ca562ebd727b150fa8987739dda961c3e545c0c82c5a9014ed229be68385f253986388811f87ef7230230be88c9e164c134a888bf2857609f16e8b6d1b6c632bb03d3c8cdb295b0ac68703d5d97d6556361343ce2245954a4ea745b1a36744588429a01319dc5667004d5113849fd65d65ff678438176e55d8cfe12469299de3263506aac371843ecdf5a01c0523ab219eb987ad9f83077e188cca4bd137a8", 0xf9}], 0x5, &(0x7f0000002cc0)=[@rights={0x10, 0x1, 0x1}, @rights={0x18, 0x1, 0x1, [r0, r1]}, @cred={0x20, 0x1, 0x2, r5, r4, r3}, @cred={0x20, 0x1, 0x2, r6, r2, r3}, @rights={0x30, 0x1, 0x1, [r1, r1, r1, r1, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r7, r2, r3}, @rights={0x20, 0x1, 0x1, [r0, r1, r1, r1]}, @rights={0x38, 0x1, 0x1, [r1, r0, r0, r1, r0, r1, r0, r1, r0, r1]}], 0x110, 0x44}], 0x3, 0x8000) r8 = fcntl$dupfd(r0, 0x406, r1) ioctl$sock_inet6_tcp_SIOCINQ(r8, 0x541b, &(0x7f0000002900)) pipe2(&(0x7f0000002ec0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x10000080800) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) [ 243.064319] QAT: Invalid ioctl [ 243.069811] QAT: Invalid ioctl [ 243.074845] QAT: Invalid ioctl 07:13:20 executing program 0: r0 = getpid() sched_setattr(r0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0) poll(&(0x7f0000001080), 0x0, 0xffff) r1 = epoll_create1(0x80000) r2 = timerfd_create(0x0, 0x0) timerfd_settime(r2, 0x0, &(0x7f00000002c0)={{}, {0x0, 0x989680}}, &(0x7f0000000300)) epoll_pwait(r1, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, &(0x7f00009d2000), 0x8) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f00000000c0)={0x14}) 07:13:20 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f00000002c0)="b295ddd8b6dec4de7203b7ce2e1d7a2042e3df16279cb70251331c4e594beda3837710d768c280c1e6eef1080b7a9dc11f971f27b53bbccb5492c59f1099b474ef5a94b3cf4475cec8dab7577b65233f4fc67397f85f5da6cf7a603be24c2e92f4e152c18945725836658dcc69845c4757f18a2ec30d5dcd1e429b224f0c88f1b94c3770523910d7b9120c07f51fb27ce979051de0e7e39f5e8b3711ddc1f9c15a4dd11ece19859c82d8a826924fb63d6e4cdbbb8553408a56b4283585c307acdb32d9aa764f4ec98bb7d89c77cdedcefe18d10910fdae56e96bdef29758c03e258243e50d595376bdb8f635c27a32e1e7a31b2cd139f4bbb7bca49e77888f24201dbe9d27f62a96043c177afb786482b5e4540f28e04b53135f44c9eaf748c7616c938fe4aa6f15b81e64a2cee23a2be2fcfb52bfb3bc79e1ff5044d6c9abdbec9cfaafcc4ca858e21394311d2fc283e0c62bb3e9d7f98810bca0bbe958452ac718b4897ce37fb21a7b7908af2250eb533beed5127ab8225c55b219235f08db8076bb73601e7877c697137f402b12982963b63a8f06daa56580b45053d2d394f5984ecc4c296c166017cf46ae3ea9fdbd0f1afe15bc6b9fc7e801b8841c7f667b60f1f422858ea21e24a9000be4cde38a8cc8e4f49b669e404aac094bab1da048f7bc7598b0524d6f23d86e4322367c45def308918419a2ca958a43ac5b1b0335241917eee4795d0cfa40581b34ea0d5c5422da4c130f22ee40c3a7b419203de806f059e0bff09c412fc3c20bf5134dd0a853764df444ac83b333e960bdd948e3152d02ba4f3754d5263dd802f1f5a56d8e3897a41e96290b1b6d09ea34077418be9ee191aeb56c8bc78aced96479880ea62edc2633e5d1e637c9d3539dc6d46264135697923b9f104e5ebd93c02027739f9d70ae1deacd0a8b362419f59f02f2bd17867e04d4a3801dd72fb67711235b6930472baacf3c91c052b192ddd19ddf0fd0a3448715a20455b56a3de064d758058fb5017f53ace5ba47f80c93d6862fc1fd1b1d05721fb04d52a229fe2806194d159c5d7b50b1d9a634b52f3ce491c917fdc12116219b7a73bc1d9363988a4f10df9f6a2f6ed0113430c51b23e1c53f35ff99299bdd9bd9c6dc3b74a2e71e56ba0f00568e16d90820215a1bcc3338cf138e61d0a06a01657ae8f664929ec1ecfe42ff3baf0aee107ac5b560921615c32b2c608eceb49b66229668814fb6bc596dcec6c1dd02c9cbd09074c5212bdaf5a135138695499eef4ad997b68ec9a8d15eb6d20a540b1d9e619334873f9b0dc46e4f6abc5675cde09ebc5454db7980c81e71005e788de45f20d9c188fca1d83b0ff3ad2aab5deab70bc802d4e3c825d9cee4e21efca971f7b76ed8c945bce44e1478f0d47af71943f93988231f2cffeae6fc8d21f8abd8a0649da574fc921e9e681a62c5c992b0c9a8ede3f4d93aa1a0e316127e8db5e8847b2b403a12c914eb41050225f8d18df5ba343baae8076c52081af434903a1ee686d028e691422f16132fa7b1a9dc85fce08e657d52487917c21b1fe5ea433597efbe94517f95d3e5061630e3b50c17e951d2e1e94a9f726ae60679749df0a3db2ac94a81a28d9ec34ac6ae86b27a43f88f939c6ad96efb8349188207cb42cd512333395590d6acbdfe60712241a9e143dc3a95267de4089bfc05f389538080e84da8a7885b50913e670002af14e419abe9efb2250284af7f69eb1ae1107c432180df1c9f9ab72b89ec257c745a9bbac055750298ea6c2f84ec84260ebe4701a57a1d527dc3211ebd016d7a92f69b2bf67894531c8620ed87cfb0460c950524711c5a80c0c57619b070875a9a932fba3e3ae668219eea22197af6068278a5b7473cb241ce806f372d502337f9a7b0ea6b3828f9260f975c7d2caf8c23025bb52c3196bea261e3129014843d350686bea8530c51f7ea0ae5e4c5a5805f52851e4b1917ed05cb10dfa86a7f2f155139ca6ab7653eed68c1e459d24b1d3d9c8c83641ae9af699d113e0f11aae82371cca747391998ccf351c3ab00fe9c202d2fba5b09919b283d93a834c85d93c23eefe6a37fb62af73f17a9ff0c2ec2e0b2ddafe93c5eb5d350dc7a50b57d72b02aae6c8efb1895aa6843888a3fbf2fd080773a1b538afc4134f7319dd356417d838c28a061cf712ef643ea3d2e02cbf21fdafa4ccf3a1d4fbd5e5bfd7b7cdaf16a80bc303a1e2e6389ea4fe79553a55743052771ac12b0addd833836916bcb817a92e8b081c4d660fa805a1d29dd452fa580504f08dd9cf6b92d36c5978e7556b6b3245e19158a97dc0383f6a62702cbebef0b3ad4944664c1fef526e9c8ca7931df7ad88055c1d60c3762e7c25fb4bf4f701f503adf4ccf3098d7f7887afcc719228963f2806701b21729012a308fd366a6639706ce6b1761c737c9c130e1512d44190b2eea7be6c7affe8e3a42d131b3e1ca106cc938cc84dddaf3c6bab4745af6d63e7dd9c88e424c5fc36937843ef2f8ff8fc2356d2581150187ebb0e2707a61ba1756e9b179263d932ea3c7e095fe047575490957cd7e8881513e31b2dfd63886e43c815f1fd46ddec5e9955deb6eaea23d0f57bec91bb5733c0c11c8fff3fec57ce6aeaa9b1a0c0824bab87989c87b3762ced4429982193e5c8aa46f3bcbd176c9e45bfa2216a7b40675dd9b0b5cda2440b89ad54f0ef6b3f47d01c295fba52d45203cb5e54ee3176f1def4a431ee927b78bc12441464364b20bf9595b6f3adb577934065b678c1504a7159eff22cf4fbafab122c8e5c4a73e8568669659244fb7a457c5552147abfd6e429034d74b8f33231bef46f6a757680e6a57236a7d4c8176aab7a18d6937ad3ee3f75100dd5af1282c4366a0805b716d525bf60a9a4039a95a02617744c0018588d10fa034bdc4a8f111ee0dce715c8b37891f84e4a7f42c730096e427888e80001264bd8622c243f155b0fc4ebe93425c458899db3c9d55a401270da33fb3fc3be248762e1a1807e3f0df934baadc7bfc35fc15f01c9931400239dc6c576d5f56978e16c61e450302abb78172a52f8250cf058b190b5f5ee7fd5f3a5ede49482259059b2217da57d1ea92698719a9dae871c4d5079aa87c61221fc1a0618e905129fedbc08ae434152bbf889d52ac921c6c54b2472e69cf8448fecc68bb4e6688335186645e234beabb8754166d94c539bbc21351241088e4f2fc7d588f1ac7c229a79389ce8661c27ae7396561bf283bab11748a414d718f2ef57dc98286a2fd25c29d6d32460714716428ae0d813267daff53b940ebae23d7d89e0b5dac9e5c683c014ef514bd643f8574bf1b4e4934746c5a94c59f9c0b8097fd5c1227cbc79a3780996afed3c3ca833c0e2b2b63deac5caa31457001b85d171c27794da35c9133018a6665a2890d80c15ebe959e11356dc79caa5ac763227f245f388fc5e03b3eb42d561ab61db11914ae9aeb5a10224c04609ffe88026c059f71abd46154723a400c69687cbefba539fffcec32ff8cf5cf52896e3f2e3841673da3c88a2e27c82fd787e603a5d456f57f5d384f281e2ef6b4a97f6000d00a6a6b868b84107cdaab3a08afd1ad26383fe20b9b13201e99e26ee047bb671ee1744e6908d5c63acee1c3443bfe935813ba250807ef08947ee7ec24d69dcd6a93abd4ab7cc4c29bb14ae3ec63069e69cd80f6736b16f67fd3ba4dd06cbf7505cceeac6d5a324186754ab485eeccdf72201759ce7f7926bda5d2c1d31459d52441c8fd10b1b335ed4c9067f5ee6212a66ae68e8305852d7b1618a87f93d8a220f2a849ed3e95b076f3f4e95fed4c1c131ecee3f27aeb0a69d519f0cbabbfb844bfbd546196273d59997b1e79a6e179e1ff51494e27d19750882b5da69ba97ef7d711906c5c42ca8ea2bbed978c71ebe6bab40c6d26185933b2e13a36e6ce01050eb4d3c9a65ba82eb9510d8e00504a93399184156173f5d551e145e38510f4cce8d9a1709bec3d1ffa596c52155de627a77fc6fbfb24411bed150f2d14c04692247c75736e90235a1ae2451070c15955beaa186871b57f84af026ef37548f99ae7260f103b2e409d125d89d4312e3a5c3f324f6b9595dd52fbff8b02f67dfbd5f0e999e0707d9ee85a130407db28cb394df0d57f42188d344105d053a41139eb4576433b2161ed6a7d650ebd3cf7182895b2c49836730a1dd187ba89fbf9ccb3117be00abe418642ea6f84ef9f6f893b80cee87fc575d39904cac18e7a5f3f90fe26ca97f28363cb521391c34825b7ffb936d0260b6e7737553f66475eef936a0b1aec9b32075497e8e03755ed03801a19bc4fbe24b77df53219f00b1603bd5032ab3d5976b5e630155e4bae5f430b9905e8d58da39a7832ee4ce2db924495288fe5238e85294c094bc59cf630ba949d87a4daaec396ae5150cf8cc570709163bf2a30a3ed81315a30ea0b1ec5226e31dac931aa245c4cd97f813ed08f994d1bd08e9b57415cd0ab33bf44c7008ad60e8f16f2a1cf79111dcf4738dba4a9935ee5219b524304b43e7f25f2345a427b076c3be9af5217e1c125ca357a7db1fde516411f1eca77f98067850da856da6ceccb6a496084e4ff2b14ab4398497593cb037ede9933fa621f2a6bc0aff08d06aa768daacf1c1fff79e3fb92259ceb46a9a803230ebcbce46b2c3f9e53947b03b139ee0d67873d712ab1d9abe314a5473fd76d1ee6e561101670509396ed90e5bca17cf9652a0e066e5b7304e758de3be3ab965432cf6d291beedce46f4c7e2b50dc9b524aa7df5dffeb86fb83c432bfa3525b6d80096cc467a35e5d8c15ba03cbf5443f9217e356833b75cd902fbaef560a7b3acc96617b4733ecd4532e76c1f49b9689977c8378bec143ec5987471cfb8b05896032f2d32c001557a89cfdfe5108fd8a0d08c3896341ee19687c53dc622d7b4b25de93b5f31eae9e67a9b70e3c1765adb5b3a8caf480f388032651b05cd6654ab9dd23cd5a3e19b21fc114aee1bbd9fd21b2c02fa424fbbe64c12a794b20bac8cb310a8a7cdef2b8cf1cb413dc5b6c9b5981c6dab5f2e7c89a4d602f142c19f9cba90e7f5c9935c84a529ee1c80ec0ede35bb9fa14e131df0df52d20e3e36c13ebe98dd95881ed364c0d0fdef5197bbc60a047a57f5b5424435fdfe8366ac9378552fb7645df22dbe986454cd960a11992378761f781936a7490d30b3676339db647fe136ce187242dd43a54f43ee009de670f946a9316c86798c49e50d9be250fc1c88dc3835d391d141ce5a49f65b34df7e04424fb8cdbc7182d61be7c39a1778e3a1db94d4d0cde8aea84b62c5f266f822a6d34755d7f2e01f6d2decab2bdef118453feb4c5bb888efd603f72c8071932ef409da176f457c854729403572c402666ffafc9172f18a63c31e6860a691be312cbaf47146c35811a9a2a1e7b8a66d17b47413bff8f1f75b94cfa7f767a7dafa83a9407ddcd11bfe669e446ec5920ddbdd82480a1e1d09bfbd797708d3c2f0be806bd541412d33854b986f93d8a781d84b2d2befaa8b8be639121257730bfc3c325281f8b06f08ece8524467e87fff3489ed248142a58047590acb27098c7c44e6c6edfe56f7c0c101eff8b9312d84c902b8346778614e5c3147bec2c09ccee1fc878497ee1fe4fd3bf37ff0de6bdb9bb48e7825819f1821cf85602bbccb95be4bd592f1bde3b997a418f32662bbdd1fe72a02149b0ada4c2eb6e75544a397389421441a01e42d0abf8eb45fc28390c061c40b3f91e9055c7a67b918d6434", 0x1000}, {&(0x7f00000000c0)="c9419de27fab6c839f5f61d22f47ae9806ea5de57b15ec8f57b18fcc303e0e9c70c835c303b67025162260c92f57a07d0378adbafc8f266ec824be440d0be10d62fd1f3f06a2fb1547f85139596d399565e5af0ce32e884c3114f395970b3ff73aa5b98794f518ed78be3b1e42dace421fbf5de7d6598e6f9793e43461e2b8ed5d7f042722208524587318c55b81549ea7ee5b16327c8cea05387b48f3b320f10f87d76abae5f4cdf97f4424b25bc7", 0xaf}], 0x2, 0x2) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00001dcf48)={0x2, 0x400000000000003, 0x0, 0x0, 0x16, 0x0, 0x0, 0x0, [@sadb_lifetime={0x4, 0x3, 0x34000}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa}}, @sadb_lifetime={0x4, 0x4}, @sadb_sa={0x2, 0x1}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}}}]}, 0xb0}, 0x1}, 0x0) r2 = memfd_create(&(0x7f0000000000)='\x00', 0x2) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 243.165228] FAT-fs (loop3): Unrecognized mount option "dos1xfKzÅy" or missing value [ 243.171779] binder: release 14119:14126 transaction 428 out, still active [ 243.180142] binder: unexpected work type, 4, not freed [ 243.185449] binder: undelivered TRANSACTION_COMPLETE [ 243.191018] binder: 14119:14126 ioctl c0306235 200007c0 returned -22 [ 243.206500] binder_alloc: binder_alloc_mmap_handler: 14119 20001000-20004000 already mapped failed -16 [ 243.220723] binder: BINDER_SET_CONTEXT_MGR already set [ 243.221125] FAT-fs (loop3): bogus number of reserved sectors [ 243.230951] binder_alloc: 14119: binder_alloc_buf, no vma [ 243.231924] FAT-fs (loop3): Can't find a valid FAT filesystem [ 243.234200] binder: 14119:14126 ioctl 40046207 0 returned -16 [ 243.237747] binder: 14119:14131 transaction failed 29189/-3, size 24-8 line 2967 [ 243.257357] binder: 14119:14135 ioctl c0306235 200007c0 returned -22 [ 243.266322] binder: send failed reply for transaction 428, target dead [ 243.275714] binder: undelivered TRANSACTION_ERROR: 29189 [ 243.304760] FAT-fs (loop3): Unrecognized mount option "dos1xfKzÅy" or missing value [ 243.321538] FAT-fs (loop3): bogus number of reserved sectors [ 243.327464] FAT-fs (loop3): Can't find a valid FAT filesystem [ 243.559141] EXT4-fs (loop6): VFS: Can't find ext4 filesystem 07:13:20 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:20 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x35, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:20 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m\ndos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:20 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000060107031dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) 07:13:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001280)='/dev/kvm\x00', 0x80000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x68, 0x0, 0x0, 0x0, 0x0, {0x1}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2=0xe0000002}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip_vti0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'dummy0\x00'}]}]}, 0x68}, 0x1}, 0x0) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f00000000c0)) r2 = socket$inet6(0xa, 0x400000803, 0xffffff7ffffffffc) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f80762070") r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000180)="f2410f1b1c74460fc71a66430f3881a00a0000000f20e035004000000f22e066ba6100b00deeb805000000b9a82e00000f01d966ba4000ed663ed9f7c442c1aac6c4c1245ce4", 0x46}], 0x1, 0x0, &(0x7f0000000240), 0xffffffffffffe8b) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000003c0)) 07:13:20 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x47) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="7f454c460000040000000000000000d9199f1e451bb3ca7aedcda9c4000000000000000000000000000000000040000000000000000000000000000000000000000000380000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a07213b76e509fe05448b376ed6f7f703b4493cc666805b6e9b048724213c42d9a630b02004dc5727bbd335fb5509850f94a1f16502a18cd8ec037bdb68522b53305f26e2169178eaac10a96f13accbe8842b1721bcd7b47dd147c0cbf6e21644dbc42c2629b248df04c92b3d06589eb67e36247e01aa4efa112c57549a3bf64db1b7672e0bc2b144f58acdf2cfbce02873975a549a609ae64e8f734b59bf28208d6279c2bf99640f854dd80"], 0x78) 07:13:20 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x39a, @dev={0xfe, 0x80, [], 0xe}, 0x4}, {0xa, 0x4e21, 0x100000000, @mcast1={0xff, 0x1, [], 0x1}, 0x26d}, r1, 0xffffffffffff1993}}, 0x48) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x890e, &(0x7f0000000200)="025ccc5b6d62b72de540cdb2d52ff0719554f91416e55f7261eb08") setsockopt$llc_int(r0, 0x10c, 0x2, &(0x7f00000000c0)=0x5, 0x4) clone(0x0, &(0x7f00000012c0), &(0x7f0000001080), &(0x7f00000022c0), &(0x7f0000001f00)) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_ifreq(r2, 0x89f4, &(0x7f0000000080)={'eql\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x005\x00', @ifru_settings={0x707000}}) 07:13:20 executing program 3: mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000040)={0x6, 0x40, 0x3, {}, 0x8}) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000000, 0x100810, r1, 0x1d) [ 243.714417] netlink: 20 bytes leftover after parsing attributes in process `syz-executor3'. [ 243.723946] binder: release 14179:14185 transaction 433 out, still active [ 243.726154] netlink: 20 bytes leftover after parsing attributes in process `syz-executor3'. [ 243.730965] binder: unexpected work type, 4, not freed [ 243.730983] binder: undelivered TRANSACTION_COMPLETE [ 243.767921] sg_write: data in/out 262108/13 bytes for SCSI command 0x0-- guessing data in; [ 243.767921] program syz-executor1 not setting count and/or reply_len properly [ 243.789786] binder: invalid inc weak node for 434 [ 243.794890] binder: 14179:14185 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 243.802654] binder: 14179:14185 unknown command 0 [ 243.802776] sg_write: data in/out 262108/78 bytes for SCSI command 0x0-- guessing data in; 07:13:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f00000000c0)) r1 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f000074fffc)=0x3, 0x348) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r1, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r3, 0xc08c5335, &(0x7f0000000000)={0x4, 0x84, 0x0, 'queue0\x00', 0x9}) sendfile(r2, r3, &(0x7f0000000100), 0x8000fffffffe) 07:13:21 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f00000005c0)={'bridge_slave_1\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000600)={@ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, r1}, 0x14) r2 = socket$inet(0x10, 0x3, 0xe) r3 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r3, &(0x7f0000c67000)={0xa, 0x4e20}, 0x1c) listen(r3, 0x1000008000) r4 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r4, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) sendmmsg(r4, &(0x7f00000001c0)=[{{&(0x7f0000000000)=@nfc={0x27}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000000c40)}}, {{&(0x7f0000002080)=@nfc={0x27}, 0x80, &(0x7f0000000140), 0x0, &(0x7f0000000180)=[{0x10, 0x10d}], 0x10}}], 0x2, 0x0) ustat(0x8b2d, &(0x7f0000000040)) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="24000000100001000000fd946fa2830020200a0009000300001c85680c1ba3a20400ff5e28000000050affffba16a0aa1c0009c001da5a80d1090000000000000029090000000cd37eaa0e9e", 0x4c}], 0x1}, 0x0) [ 243.802776] program syz-executor1 not setting count and/or reply_len properly [ 243.827551] binder: 14179:14185 ioctl c0306201 200007c0 returned -22 07:13:21 executing program 6: pause() r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x40) fcntl$addseals(r0, 0x409, 0x8) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x80, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000000080)=0x9, 0x8) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0xc0bc5310, &(0x7f00000000c0)) write$P9_RWALK(r1, &(0x7f0000000180)={0x23, 0x6f, 0x2, {0x2, [{0xcf, 0x0, 0x3}, {0x11, 0x2, 0x5}]}}, 0x23) setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f00000001c0)={{0x73, @empty, 0x4e21, 0x2, 'rr\x00', 0x38, 0x3, 0x69}, {@dev={0xac, 0x14, 0x14, 0x1f}, 0x4e21, 0x2, 0x9d, 0x2aad, 0x7}}, 0x44) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000240)={0x5, {0x2, 0x4e20, @multicast2=0xe0000002}, {0x2, 0x4e20, @rand_addr=0x7}, {0x2, 0x4e23}, 0x0, 0xd5, 0xffffffff00000001, 0x3, 0x9f75, 0x0, 0x70f6006c, 0x9, 0xff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000002c0)=r1, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000300)={0x0, 0x69400000, 0x3}, 0xc) r2 = syz_open_dev$sndpcmc(&(0x7f0000000340)='/dev/snd/pcmC#D#c\x00', 0x5, 0x800) r3 = syz_open_dev$amidi(&(0x7f0000000380)='/dev/amidi#\x00', 0x3, 0x200) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r2, 0x28, 0x0, &(0x7f00000003c0)=0x1000, 0x8) write$P9_RSYMLINK(r2, &(0x7f0000000400)={0x14, 0x11, 0x1, {0xc0, 0x4, 0x5}}, 0x14) ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f0000000440)=0x8000) ioctl$GIO_CMAP(r3, 0x4b70, &(0x7f0000000480)) set_tid_address(&(0x7f00000004c0)) r4 = getuid() r5 = getegid() write$P9_RGETATTR(r3, &(0x7f0000000500)={0xa0, 0x19, 0x1, {0x110, {0x8e, 0x0, 0x1}, 0x70, r4, r5, 0x3, 0x1f, 0x81, 0xfd1, 0xfffffffffffffffe, 0x5, 0xffffffffffffffe0, 0x3, 0x10001, 0xca, 0x364c, 0xf2, 0x2b10, 0x0, 0x4b37}}, 0xa0) bind$pptp(r3, &(0x7f00000005c0)={0x18, 0x2, {0x1, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x1e) ioctl$KDGETMODE(r3, 0x4b3b, &(0x7f0000000600)) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0x40405515, &(0x7f0000000640)={0x6, 0x3, 0x2, 0x1, '\x00', 0xffffffffffffff11}) bind$netlink(r2, &(0x7f0000000680)={0x10, 0x0, 0x25dfdbfd, 0x4}, 0xc) bind$pptp(r2, &(0x7f00000006c0)={0x18, 0x2, {0x0, @rand_addr=0x1000}}, 0x1e) clock_gettime(0x0, &(0x7f0000000780)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000000700)={0x2}, &(0x7f0000000740), &(0x7f00000007c0)={r6, r7+10000000}, 0x8) getsockopt$inet_int(r1, 0x0, 0xd, &(0x7f0000000800), &(0x7f0000000840)=0x4) write$P9_RCREATE(r3, &(0x7f0000000880)={0x18, 0x73, 0x2, {{0x0, 0x4, 0x6}, 0xffffffffffff648f}}, 0x18) 07:13:21 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mddos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 243.870150] binder_alloc: binder_alloc_mmap_handler: 14179 20001000-20004000 already mapped failed -16 [ 243.884549] binder: BINDER_SET_CONTEXT_MGR already set [ 243.890212] binder: 14179:14185 ioctl 40046207 0 returned -16 [ 243.896678] binder_alloc: 14179: binder_alloc_buf, no vma [ 243.902325] binder: 14179:14202 transaction failed 29189/-3, size 24-8 line 2967 07:13:21 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x2f, 0x0, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 243.916520] binder: 14179:14202 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 243.924333] binder: 14179:14202 unknown command 0 [ 243.930237] binder: 14179:14202 ioctl c0306201 200007c0 returned -22 [ 243.938260] binder: send failed reply for transaction 433, target dead [ 243.945213] binder: undelivered TRANSACTION_ERROR: 29189 07:13:21 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000100)=0x0) kcmp(r1, r2, 0x2, r0, r0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f00000000c0)=0xfffffffffffffff9, 0x30b) setsockopt$inet6_int(r0, 0x29, 0x1a, &(0x7f0000000040)=0xfffffffffffffffd, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x8}], 0x1c) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000240), &(0x7f0000000280)=0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000001c0)=[@in6={0xa, 0x4e24, 0x4, @mcast1={0xff, 0x1, [], 0x1}, 0x100}], 0xff22) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000180)={'IDLETIMER\x00'}, &(0x7f0000000200)=0x1e) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x1) ioctl$KVM_GET_PIT(r3, 0xc048ae65, &(0x7f0000000300)) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x0, @multicast2=0xe0000002}], 0x10) [ 244.188341] binder: release 14229:14235 transaction 438 out, still active [ 244.195417] binder: unexpected work type, 4, not freed [ 244.200770] binder: undelivered TRANSACTION_COMPLETE [ 244.207160] binder: invalid inc weak node for 439 [ 244.212222] binder: 14229:14235 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 244.220118] binder: 14229:14235 unknown command 0 [ 244.225645] binder: 14229:14235 ioctl c0306201 200007c0 returned -22 [ 244.238547] binder_alloc: binder_alloc_mmap_handler: 14229 20001000-20004000 already mapped failed -16 [ 244.249420] binder: BINDER_SET_CONTEXT_MGR already set [ 244.254797] binder_alloc: 14229: binder_alloc_buf, no vma [ 244.254917] binder: 14229:14235 ioctl 40046207 0 returned -16 [ 244.260423] binder: 14229:14241 transaction failed 29189/-3, size 24-8 line 2967 [ 244.275129] binder: 14229:14241 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 244.282964] binder: 14229:14241 unknown command 0 [ 244.288860] binder: 14229:14241 ioctl c0306201 200007c0 returned -22 [ 244.297214] binder: send failed reply for transaction 438, target dead [ 244.304371] binder: undelivered TRANSACTION_ERROR: 29189 07:13:21 executing program 0: r0 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x8) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000080)) read(r0, &(0x7f0000000140)=""/117, 0x75) r2 = getuid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) fchown(r1, r2, r3) 07:13:21 executing program 1: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x0, 0x0) r1 = fcntl$getown(r0, 0x9) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x20000, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sched_rr_get_interval(r1, &(0x7f0000000000)) dup3(0xffffffffffffffff, r0, 0x80000) readv(r0, &(0x7f0000000540)=[{&(0x7f00000001c0)=""/165, 0xa5}, {&(0x7f00000003c0)=""/192, 0xc0}], 0x2) 07:13:22 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x402c5342, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:22 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='modos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:22 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x3) io_setup(0x6, &(0x7f00000000c0)=0x0) io_pgetevents(r1, 0x8e82, 0x5, &(0x7f0000000180)=[{}, {}, {}, {}, {}], &(0x7f0000000240)={0x0, 0x989680}, &(0x7f0000000300)={&(0x7f00000002c0)={0x8}, 0x8}) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000340)=0x2, 0x4) syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f00000003c0)="80000000000200099f027100e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="6e6f6c617a7974696d652c6a71666d743d7666736f6c64246d61785f6469725f73697a655f6b62080000000000000030303030303030303030362c6f726c6f762c00274099ddac7b0f9634eafbe827e7f6d9d14c7022bf105499be8fa9859beab650109ff9e2650fa32c3d14231934ad6d30407b56200b9dde93bb33b14318bed11d16019eb652fe4687ad2205a81f008dbe17cbbb63d126d4dbf5e2d1499e4b97fa0a71864268e3f3af4bd4a16203216211a510785733313e865d23"]) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x80, 0x0) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000140)=@generic={0x3, 0x4, 0x401}) 07:13:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xc0000000000f) sendmsg$nl_route(r0, &(0x7f0000004fc8)={&(0x7f0000016000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f0000031000)=@mpls_newroute={0x24, 0x18, 0x21, 0x0, 0x0, {0x1c}, [@RTA_TTL_PROPAGATE={0x8, 0x1a}]}, 0xffc3}, 0x1}, 0x0) 07:13:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x68, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:22 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000001c0)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000013000/0x1000)=nil, 0x1000}, 0x1}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x2a0400, 0x0) write$evdev(r2, &(0x7f00000000c0)=[{{}, 0x2, 0xffff, 0x7fff}], 0x18) r3 = socket$inet6_sctp(0xa, 0x400000000001, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0xc, &(0x7f0000000040), 0xc) close(r3) sendmsg(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)=@vsock={0x28, 0x0, 0x0, @reserved=0x1}, 0x80, &(0x7f0000003440)}, 0x0) close(r1) 07:13:22 executing program 0: clock_nanosleep(0x1, 0x1, &(0x7f0000000000)={0x77359400}, &(0x7f00000000c0)) clock_nanosleep(0x400000000000009, 0x0, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000000080)) 07:13:22 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = accept(r0, &(0x7f0000000080)=@alg, &(0x7f0000000100)=0x80) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000140)={0x8000, 0x1, 0x6, 0x2, 0x2}, 0xc) getsockopt$netlink(r0, 0x10e, 0x3, &(0x7f0000000000)=""/2, &(0x7f0000000040)=0x2) [ 245.038616] binder: release 14271:14283 transaction 443 out, still active [ 245.045706] binder: unexpected work type, 4, not freed [ 245.051037] binder: undelivered TRANSACTION_COMPLETE [ 245.060674] binder_alloc: binder_alloc_mmap_handler: 14271 20001000-20004000 already mapped failed -16 [ 245.070474] EXT4-fs (loop3): Unrecognized mount option "jqfmt=vfsold$max_dir_size_kb" or missing value [ 245.076651] binder: BINDER_SET_CONTEXT_MGR already set [ 245.092323] binder_alloc: 14271: binder_alloc_buf, no vma [ 245.098057] binder: 14271:14288 transaction failed 29189/-3, size 24-8 line 2967 [ 245.105830] binder: 14271:14283 ioctl 40046207 0 returned -16 [ 245.124942] binder: undelivered TRANSACTION_ERROR: 29189 [ 245.131213] binder: send failed reply for transaction 443, target dead 07:13:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0xa00, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:22 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mudos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 245.146440] EXT4-fs (loop3): Unrecognized mount option "jqfmt=vfsold$max_dir_size_kb" or missing value 07:13:22 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000e80)=[{&(0x7f0000005a80)="532656866550f058d2b159f9ccc4978554b9f2d61456de1636fa743f424a88b12c9c1bfa00644d59013ba62a0b7868d27c2d971036c7423c15d7a9b0901c46bae5af272434c41f4da908c2da7bcf1a5b266d9b07c3cd5ab49b9c5e7cd58423103f9995ffbef48f5ad1ddecc631cb1e9ad136325381abe9e036b009f559e09650688e224fb21b5874be53dd6fc0d541c1868c9a399a2ebcaab0ce632101b4c38116fa30957b105f2aa9cf6f70ede1074e8a0d8cf3cbb051d3539d1c294ea806e3cd196ab12018065252595c8124386810e41a02df51aee9d06906f44ee9296cc0f5516becbfc606a0c1eab957edadba79f58ab8cbb27729f840c74e86d11b6e1cee5a2c970c3e13cadba395f7e21a13d57b96c3027ca2d8d5d75075e77171339d9d308cb6d1ace7fde5413b28c28a7c62d8758652db2acbebef079011721d4d295465c993013470c369fe7fba8bf62ba3c97c14855912085ab61a4b2f298d8a70d8df2c469779dcc07ceb9f80cc0dc618cd1b1be4805c27cf491d9d57b62a771665e4003f8eef25bc8b21a031611a5b0af1aa61e7844c12c3ec6d893755d49b7f3a3240cbb2bde33966c666aa96c6793748e605bfacdb26c568914582d38bdbe4746a9da19c9b59991fa4e06ca9b8ea5996f7c56071fa031b61bd052d9f9205ac73231095886aa5a3372be4370f21b0a05ed2f0ef49166d51c2ee54dcedd811cd20f4a46c8579f64f9e6c66ccbf3b69622cce5b19127f0abf7157ddbdd49c2641784a5fc98b4445cf3ac18d662f458c8296a435760c4330a526d0a1cd1f0bcf949c0b29ab3a9e0c0a8128642c9c10634528d12334f79fb5726a8351a86a0f5d7eca1f0279d5496ada0b0f1318f4c112de29cbb6409c769013bbf02be2cb55bef2b5e9161b49cdb6280af047a9d01ffcf443fcf53606d12b3a9335d1304da8d440b918cf96aba499bcccae4805076f30c1edd63903990c727fd6c5433c2ebad7b9d1dde5c3b43b35f7a25458774ef126ac1aa7bd1f4d857b904a2899394d3f0852e8b847787bc96fc16f3f2dc503e1548b390e5daac4441556719a4ce6ebd2a2c69a8e676b00a8411620315f41bef4279bdbade7701cd64c49ecbb96b475c61e377c967f7b3118d25c19ced901f53dac0b5b7b29b1777414afd62e10778f9b0682d40191f53c12e4f290e0288e7ad984c41f55d7db2264974cd1cfaf35480a2d519f546830730b699015ff7a33c27ee4d8158d227e1bae1e422b81f6848a275eaf0fb58187ed83737655f618ee6c47b797683b3cf24614b8a52f9b01bac61d4951590d90f76b7794953812ef5c27794c9ebccd9e28a9b3fe4fd617de729291df08a1191cd17d76ccee6b75461049f4d2a5d4edc26520db0b7f1540ac0fa1c5078b911be74c0e724207b2ea5afb53a949fafd4a9fccc48d8d5b2ff877829a9f618fbd79d90f67a87e7b1dd844e3ac650aeaaca04e1347276da9a866b332cd99d99c06784e840b766f6ceecc28406c5f1fb52f42f6f176353434191efc7994fbe91f2f6b11b11b1d174bdbba661f98403c6554c4f1da0caa63a6e0e4bd15678ca7a5b8c4c15c5519b336b9379b6e71b26d5920fb6d7bb07dcadbe8f3bd4fd0e9bf5d237457adc2617e5803b9e826ca16aaf554452c8dcb1e299a46f6c438f93bdc54a391e67790531e39ce94c89dcb296271227d41889620e9fe188abb5a6c85f716bdbe467372138e0a5fe930d233a57009d3585ab8470d8a88de9657116507e7878eea090b33d603166f5ce97c2f9eba4b878651ee1d3aadd53c831ba7a428ea0313cde04a705d4a590a78fd7ef1cb604e65f77d731bda2754416014739d841edcc89263024f7d1e10fe01dd0123f345f343c3989b098607b9948806758075b2086e76ba71bae5f7a37346e4ff5ae887232d8c16d5f6307389e627a152f23b07d6f4bb30f1824ec184d840267b098e288352a034de33a263a0f1", 0x579}], 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b3a, 0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000040)={{0x1}}) 07:13:22 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x4, 0x4) fcntl$addseals(r0, 0x409, 0x4) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) connect$llc(r0, &(0x7f0000000180)={0x1a}, 0x7) 07:13:22 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000200)='veth1_to_team\x00') r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x2fb) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0xfffffffffffffffc, 0x200000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000180)=ANY=[@ANYRES32=0x0, @ANYBLOB="00a9e100489ddc7e8f437c94036d8f5ddf00000000866bb2be02960eb2551b69a8c80188b43bb75c3e0a35a4c322e0e8d40262a0abda7f0000000000000045f85dbe7b21df0daff47e0b20ef2e25a291316c45bb402c20d6124bbe4bb92f00000000000000000000000000000000"], &(0x7f00000000c0)=0x2) mmap$xdp(&(0x7f0000f55000/0x3000)=nil, 0x3000, 0x0, 0x812, r2, 0x80000000) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000001180)={r3, @in6={{0xa, 0x4e23, 0x8, @loopback={0x0, 0x1}, 0x75aa}}}, 0x84) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000002c0)={@in6={{0xa, 0x4e24, 0x4, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0xdc90}}, 0x9079, 0x3f5, 0x5, "bcbe172b11ed9ca2dac5331a973948c1a2ff57559af168f9d2b17014181d688373279126d476f2ca9e8d642a145015431bc5cb3bd2fcb2e9caaf4c957c091e9031625e0e80fb89248fd43fb940176391"}, 0xd8) mknodat(r2, &(0x7f0000000240)='./file0\x00', 0xc100, 0x6) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f0000000140)={'team_slave_0\x00', 0x9}) syz_extract_tcp_res$synack(&(0x7f0000000280), 0x1, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x20000000032, 0xffffffffffffffff, 0x0) getrandom(&(0x7f00000003c0)=""/2, 0xfffffffffffffe10, 0x3) [ 245.318460] binder: release 14317:14320 transaction 448 out, still active [ 245.325640] binder: unexpected work type, 4, not freed [ 245.331027] binder: undelivered TRANSACTION_COMPLETE [ 245.341325] binder_alloc: binder_alloc_mmap_handler: 14317 20001000-20004000 already mapped failed -16 [ 245.352390] binder: BINDER_SET_CONTEXT_MGR already set [ 245.357768] binder_alloc: 14317: binder_alloc_buf, no vma 07:13:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x7, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:22 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m+dos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 245.358098] binder: 14317:14320 ioctl 40046207 0 returned -16 [ 245.363370] binder: 14317:14321 transaction failed 29189/-3, size 24-8 line 2967 [ 245.369777] binder: undelivered TRANSACTION_ERROR: 29189 [ 245.393517] binder: send failed reply for transaction 448, target dead 07:13:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x10000, 0x0) ioctl(r0, 0x8912, &(0x7f0000000100)="02d0ebf512f2b47d07d38a1b134804311c19faaec7705cc83d8166cc74985b13cdf9166a2fac94564dd40d8064daea3cef4b4796aa06fc8c294ecb7dd61077b09b3b8402ebb926da8862022986df1b2dc194295e685c8d82bf38c2511203319b84e09d16fbf5f292309700c167") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes-asm)\x00'}, 0x58) [ 245.456542] binder: 14327:14338 got transaction with invalid data ptr [ 245.463819] binder: 14327:14338 transaction failed 29201/-14, size 241-0 line 2986 [ 245.482332] binder_alloc: binder_alloc_mmap_handler: 14327 20000000-20002000 already mapped failed -16 [ 245.494200] binder: BINDER_SET_CONTEXT_MGR already set [ 245.499608] binder_alloc: 14327: binder_alloc_buf, no vma [ 245.499990] binder: 14327:14338 ioctl 40046207 0 returned -16 [ 245.505264] binder: 14327:14344 transaction failed 29189/-3, size 241-0 line 2967 [ 245.522620] binder: undelivered TRANSACTION_ERROR: 29201 [ 245.529522] binder: undelivered TRANSACTION_ERROR: 29189 [ 245.652072] binder: release 14346:14350 transaction 456 out, still active [ 245.659144] binder: unexpected work type, 4, not freed [ 245.664632] binder: undelivered TRANSACTION_COMPLETE [ 245.670311] binder: 14346:14350 unknown command 0 [ 245.675280] binder: 14346:14350 ioctl c0306201 200007c0 returned -22 [ 245.690310] binder_alloc: binder_alloc_mmap_handler: 14346 20001000-20004000 already mapped failed -16 [ 245.701094] binder: BINDER_SET_CONTEXT_MGR already set [ 245.706505] binder_alloc: 14346: binder_alloc_buf, no vma [ 245.706555] binder: 14346:14350 ioctl 40046207 0 returned -16 [ 245.712284] binder: 14346:14353 transaction failed 29189/-3, size 24-8 line 2967 [ 245.726807] binder: 14346:14353 unknown command 0 [ 245.732221] binder: 14346:14353 ioctl c0306201 200007c0 returned -22 [ 245.740211] binder: send failed reply for transaction 456, target dead [ 245.751923] binder: undelivered TRANSACTION_ERROR: 29189 07:13:23 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x3, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:23 executing program 6: r0 = socket$inet(0x2, 0xa, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x14}}, {0x2, 0x4e23, @multicast2=0xe0000002}, {0x2, 0x4e21, @rand_addr=0x1}, 0x201, 0xbc6, 0x7, 0x65, 0x6, &(0x7f0000000000)='veth1_to_bridge\x00', 0x7ff, 0x8, 0x4}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f00000000c0)={r0}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000100)={r0}) setsockopt$inet_int(r0, 0x0, 0x15, &(0x7f0000000200), 0x0) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) 07:13:23 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x40505331, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:23 executing program 3: r0 = socket$inet6(0xa, 0x801, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getpeername$netlink(r0, &(0x7f00000000c0), &(0x7f0000000100)=0xc) socket$inet6(0xa, 0x80005, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000040)=0xfffffffffffffffc, 0xffffffffffffff16) r2 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_int(r2, 0x29, 0x200000000b, &(0x7f0000000080)=0xc, 0x4) r3 = memfd_create(&(0x7f0000000000)='nodev--`\x00', 0x2) ioctl$VHOST_RESET_OWNER(r3, 0xaf02, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}, 0x20000000000}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0xfffffffffffffe64, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 07:13:23 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mxdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:23 executing program 1: socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f0000a77ff8)) 07:13:23 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='bbr\x00', 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000af5000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000f59000), 0x4) sendto$inet(r0, &(0x7f0000000440), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback=0x7f000001}, 0x10) r1 = dup(r0) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f0000000040)={0x2}) sendto$inet(r0, &(0x7f00005c8000)="c3401c344654f3c7d9fe1ba48c8e399aa4eedc3d6bd8ebd65c856a45d61154adc2b2a976fbffffffffffffff38e9dd18c58f6bd779650fc30f09000000ecf323c9f6502ceab47e58114347b289546465a5eb278de12b1989f64cc99412e36880d20c34d91051b22f6c8acc9d082b7bcdec844f667da0867d08d4154004997e317b79", 0x82, 0x81, &(0x7f0000e66000)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) sendto$inet(r0, &(0x7f0000000300)='^', 0x1, 0x0, &(0x7f0000000000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000000540)="d0b115b1d69900fd38983ba83a9edace62e7e04b33b1bba6ed83415e2a4cb8e79c140896173f9059e799b42ee6e38bfc4722e8e6fb382e4bb60cead1097aac90a80797f25c6b64592c171b4b2058ed7dfbd8314c13237ea1911bc402eebef18bdd5d3d49a6b29bf979a6a2695756e341b47545c7f0e699ea7bff55f396b09ca6852252e16a0ee95af29c96b068e8247befdce6e8708aabe0349faede228c3bd4c55bbfacbe9275a539ec72702e795a153ea500296c7c391da463040000004a5a3a9384f409c70b390b402d68cb7744b0e420268472667b7a9d3336c881380474c0a9fabc60e9aa119be95d15fb983b97494f500021f1cc", 0xf7, 0x0, &(0x7f0000000180)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f00000001c0)="322792bd6734dd44edf52c6b1b6bd3d06437e1e682eb000607563dce8c1ea0d242ec93d19116fd4473eb0cd7fa177bb17891c0280f5cb6be7baa2d486f0a69b787279e192b671926ca10bfcdfa59c718c154739f4e3644d56bddd0f97cb88a8e3bec09d0a7216c03cc9bb5f778759032cf1a549f5df8623af43791d6246056932e21", 0x82, 0x0, &(0x7f00000000c0)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) read(r0, &(0x7f0000000340)=""/206, 0xce) shutdown(r0, 0x1) 07:13:23 executing program 5: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101000, 0x42) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = msgget(0x3, 0x100) msgctl$IPC_INFO(r1, 0x3, &(0x7f0000000100)=""/62) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000002c0)={0x1, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}}}}, 0x4d5) prctl$setfpexc(0xc, 0x100000) r2 = syz_open_procfs(0x0, &(0x7f000012bff2)='net/mcfilter6\x00') write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x100d}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f00000000c0)={0xa, 0x4, 0xfa00, {r3}}, 0xc) socket$l2tp(0x18, 0x1, 0x1) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r3, 0x10, 0x0, @ib={0x1b, 0x2, 0x6, {"7c727483c302f5950417bdabac62b4b8"}, 0x0, 0x40, 0x8001}}}, 0x90) readv(r2, &(0x7f0000000800)=[{&(0x7f0000000700)=""/84, 0x54}, {&(0x7f00000008c0)=""/27, 0x1b}], 0x2) 07:13:23 executing program 1: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x5, &(0x7f0000000640)=[{&(0x7f0000000340)="5da0320202d586f0a39274312ff4a0d4061cc0bb0905f74f6e39a9ff172ec58748c0640d3c6f868184e199ba1f05081c12228d4a354c028e321d2787f3d463550d025bc22ffdcf400a07e69c72b7015a64940c10000872787e5615753a66c1452b3d394fb2b83eadea6c0afba466cd5ca627ff43d181c463f12302c5cbf677c752ca3ba3bcd509123846b7", 0x8b, 0x5}, {&(0x7f0000000400)="4206363482347fc1193822f36306050225a3922fb68f7314bbacbbbca9b33ec6694555fb1e8f2cb39b3e8f43d1a62597295095a4cf27cb5bed7b205c48f357f0a8777d127a18ea72d87641fcfb52bc5b7ed9ba892f18cae95882df92d18d430da3d033bb40937cee", 0x68, 0x400}, {&(0x7f0000000480)="c85fd28da94c52b004cf9e91b56a4b4ae5e2e4751ea2023880a6f13eef62c23953d8027e6ca01cdc5e853bb2e8934e72b0a4c7551c8a2a7026f35e9eb808d498fda7c1bc15082ea38275d46720cf3157c857984235427b3a264a4ae6942e51eae29075988841e81ec7fc1f239f4fb87ae0d92cd2ba8f66491665a03b9cbaabdce47c3ee46293a184d71bc0e128b240c9a7c0a20d17300415a630229da3b1c8436d03176e07470201403cb16b795325fc780919b11c4414a7b7d1a2f1856ba7dc2681d8bbdf0c8a0c58e0", 0xca, 0x1}, {&(0x7f0000000580)="87f7c9ac5750aabfd0e3f235ed6973bc08a10b63c768afd60c4d83b952ad91e62be554a8af0e3dd18fe6b0bedde9445ad30f1d7941eed5dca299a62b9b8a4bb6c0a9b924e5851dea2a226935d67e332bf6945ad991c7300b5f30351d4538e8da07ce83e37de18991a1795da43ed386519330b93e58c97f585bea28cd9d2e781c2fa5f837623c377d3904e6ac2dd189ca", 0x90, 0x7}, {&(0x7f0000000080)="ae58793e8669356daa9d9a7b8f", 0xd, 0x1400000000}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x102) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000800)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000840)={r1}) getresgid(&(0x7f0000000040), &(0x7f0000000140), &(0x7f0000000200)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknodat(r0, &(0x7f0000000240)="2e2f636f6e74726f6cff05", 0x0, 0x0) mkdirat(r0, &(0x7f0000000300)='./file0\x00', 0x0) mkdirat(r0, &(0x7f00000000c0)='./file0/file0\x00', 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000700)={0x0, 0x81}, &(0x7f0000000740)=0x8) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000900)=ANY=[@ANYBLOB="0200001a00000000ff0b00c000000000ff00000000000000f70b00001d00000000000000400000006337e74dccd56368237307a0b1e1a3ba0cd4c4362db528c54979fdd497668d4aaad9f14be7660cd50fef6e32f612b46d40770fcb5e66b49f9668a148a28846ad1c061babb40ea70378fce2379a471da643322783ac393b416f3eae1851ca742cecc793159448347fc62f6476d4879abdac24e25892615746293709f0e7f8eec6168c61c99f8c5535da1767e5395f3c629b7660561345e652ee12c36abef54a194eb6ee21c6d5cacfffd3b866290535e26b658c05f18ccf2914bfc176030b338818f9d1d88c651e523d43c3798635816ad53226896f743c5dea"]) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000880)={0x1, 0x4, 0x0, 0x3, r2}, &(0x7f00000008c0)=0x10) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000780)={r2}, 0x8) getsockname$packet(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000006c0)=0x14) unlinkat(r0, &(0x7f0000000280)='./file0\x00', 0x200) 07:13:23 executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0x7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @loopback=0x7f000001}}}}, &(0x7f00000000c0)=0xb0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='maps\x00') setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000140)={0x5, [0x5, 0x7ff, 0x2, 0x3, 0x5000000000]}, 0xe) 07:13:23 executing program 5: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0x80e85411, &(0x7f0000000080)) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000000)='/dev/snd/timer\x00', 0xffffffffffffff9c}, 0x10) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f0000000140)) [ 246.274254] binder: release 14396:14409 transaction 461 out, still active [ 246.281315] binder: unexpected work type, 4, not freed [ 246.286618] binder: undelivered TRANSACTION_COMPLETE 07:13:23 executing program 0: r0 = socket(0x15, 0x5, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000040)={{0x100000000, 0x20}, 0x40}, 0x57) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000300)=0x4) connect$inet(r0, &(0x7f0000adf000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendmsg$alg(r0, &(0x7f0000159fc8)={0x0, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000e8e)}, 0x0) sendmsg$alg(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000380), 0x0, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3}, @op={0x18, 0x117, 0x3}], 0x30}, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000140)={0x9, 0x0, [{0x5, 0x6, 0x0, 0x0, @adapter={0xffffffff, 0x8, 0x2, 0x1, 0x401}}, {0x143c, 0x4, 0x0, 0x0, @adapter={0x5, 0x549e, 0x6, 0x3}}, {0x3, 0x1, 0x0, 0x0, @adapter={0x0, 0x8, 0x7, 0xefa1, 0xb145}}, {0x7, 0x7, 0x0, 0x0, @irqchip={0x3f, 0xc4e}}, {0x0, 0x7, 0x0, 0x0, @sint={0x7f}}, {0x3, 0x3, 0x0, 0x0, @sint={0x2, 0x1043}}, {0x1, 0x4, 0x0, 0x0, @irqchip={0x0, 0x3}}, {0x80000000, 0x3, 0x0, 0x0, @irqchip={0x9, 0xa930}}, {0x1c6, 0x7, 0x0, 0x0, @msi={0x7, 0x5fd, 0x1ff}}]}) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000000)={0x8, @local={0xac, 0x14, 0x14, 0xaa}, 0x4e24, 0x4, 'wlc\x00', 0x10, 0x6, 0x14}, 0x2c) [ 246.324574] binder: 14396:14409 unknown command 320 [ 246.330829] binder: 14396:14409 ioctl c0306201 200007c0 returned -22 [ 246.340089] binder_alloc: binder_alloc_mmap_handler: 14396 20001000-20004000 already mapped failed -16 [ 246.352066] binder: BINDER_SET_CONTEXT_MGR already set [ 246.357952] binder: 14396:14409 ioctl 40046207 0 returned -16 07:13:23 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m.dos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:23 executing program 3: mkdir(&(0x7f0000578000)='./file0\x00', 0x0) lsetxattr(&(0x7f0000712ff8)='./file0\x00', &(0x7f0000000000)=@known='system.posix_acl_default\x00', &(0x7f00002e7fec)="020000002000000000fe0000000000808c000000", 0xffffffffffffffe1, 0x2) 07:13:23 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x600000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 246.381109] binder_alloc: 14396: binder_alloc_buf, no vma [ 246.386836] binder: 14396:14419 transaction failed 29189/-3, size 24-8 line 2967 [ 246.398820] binder: 14396:14428 unknown command 320 [ 246.405645] binder: 14396:14428 ioctl c0306201 200007c0 returned -22 [ 246.415654] binder: undelivered TRANSACTION_ERROR: 29189 [ 246.423169] binder: send failed reply for transaction 461, target dead 07:13:23 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x9, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="a74dcaec1e75c7c968010000000000e288a5c900001100000000e2b7"], &(0x7f0000000180)="4550d4001f91eb2f57b73224433025039c3096b20c6b439348bf689c08608537d6223e63adc0624fbae2e109359dce6922324ccc13160b68cae6430697259dd52d1f73e16adc3592d02925dffae85e9cd2398c6c67c87fb5b12602f145b484be45912966e8b7e2f66069c56dd76c1dc112013c3a6b4de999cdcdc8855aee3437dcc87580cfbe546fbbfbc0eb56d8bbbea2904a7c73c2", 0x0, 0xc3, &(0x7f0000000000)=""/195}, 0x48) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x18001, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000002c0)=0x2, 0x4) 07:13:23 executing program 6: accept4(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @dev}}}, &(0x7f00000001c0)=0x80, 0x80000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f0000000200)={0x0, 0x82, "e9b27b3c7b226418c6bd3d9d28506239fb385d7d28f1295b5967cf323c3f20871d16e167ea94d7df288e44397efaaa855a7c434f683d00bfbc60d51b10a2c0ca9d79424b8b58635a48779f76fe09695310824a2874d536a1d4cbd27ffbcc17ee11b8c1fa312ff3ff5fba34cbf53f71667c332fdabbc5231ff69399e7cdde880837fd"}, &(0x7f00000002c0)=0x8a) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000300)={r1, 0x1000, 0x2}, 0x8) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x14040, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000040)={0x7, 0x0, {0x0, 0x2, 0x3ff, 0x3, 0x4e36}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f00000000c0)) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x87}, {0x6}]}, 0x10) openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x200000, 0x0) [ 246.552711] FAT-fs (loop1): invalid media value (0x73) [ 246.558079] FAT-fs (loop1): Can't find a valid FAT filesystem 07:13:23 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f00000000c0)='./file0/file0\x00', 0x1) fallocate(r0, 0x41, 0x0, 0x1) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000240)=0xe8) getresgid(&(0x7f0000000280)=0x0, &(0x7f00000002c0), &(0x7f0000000300)) chown(&(0x7f0000000100)='./file0\x00', r1, r2) [ 246.678922] FAT-fs (loop1): Unrecognized mount option "./controlÿ" or missing value [ 246.740811] binder: release 14449:14460 transaction 466 out, still active [ 246.747809] binder: unexpected work type, 4, not freed [ 246.753939] binder: undelivered TRANSACTION_COMPLETE [ 246.768821] binder_alloc: binder_alloc_mmap_handler: 14449 20001000-20004000 already mapped failed -16 [ 246.779919] binder: BINDER_SET_CONTEXT_MGR already set [ 246.785553] binder_alloc: 14449: binder_alloc_buf, no vma [ 246.788660] binder: 14449:14460 ioctl 40046207 0 returned -16 [ 246.791159] binder: 14449:14461 transaction failed 29189/-3, size 24-8 line 2967 [ 246.810223] binder: undelivered TRANSACTION_ERROR: 29189 [ 246.815779] binder: send failed reply for transaction 466, target dead 07:13:24 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0a85352, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:24 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6c000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:24 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='midos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:24 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040), 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000000)={'ipddp0\x00', {0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}}) 07:13:24 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f0000001000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000), 0x2}, 0x1000000000c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000000000005000000000000000200000000000000", @ANYRES32=r1, @ANYBLOB="0000faffffff0000000000000000000046520000", @ANYRES32=r1, @ANYBLOB="00000000ffffff7f0000000000000000000000000000000000000000"]) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000040)=0x100000006) read(r0, &(0x7f0000000380)=""/143, 0xfffffe29) dup3(r1, r1, 0x80000) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e24}}, 0x2, 0x75, 0x1e, 0x800, 0x1}, &(0x7f0000000080)=0x98) syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x4e, 0x600000) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f000000d000)={r2}, &(0x7f0000000000)=0x18) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000001000)) 07:13:24 executing program 6: prctl$setmm(0x23, 0x7, &(0x7f0000007000/0x1000)=nil) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000600)=""/246, 0xf6}], 0x1, 0x80000000) 07:13:24 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000100)=""/213, &(0x7f0000000040)=0xd5) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x8003, 0x20002) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000080)) 07:13:24 executing program 0: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_open_dev$midi(&(0x7f0000000180)='/dev/midi#\x00', 0x9f3, 0x80000) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/qat_adf_ctl\x00', 0x2, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x7, 0x440002) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000380)={r1, 0x0, 0x4, r2}) r3 = socket(0xb, 0x7fffc, 0x401) openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cuse\x00', 0x60000, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x7, 0x8, 0x0, 0x6, 0x10}, &(0x7f0000000000)=0x98) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000340)={r4, 0x7f, 0x2}, 0x8) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f00000003c0)=0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000440)=0x0) rt_tgsigqueueinfo(r5, r6, 0x8, &(0x7f0000000480)={0x24, 0x2, 0x2, 0xbaa}) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000400)='/dev/uinput\x00', 0x8000, 0x0) ioctl$KVM_SET_IRQCHIP(r7, 0x8208ae63, &(0x7f0000000080)={0x3, 0x0, @ioapic={0x5000, 0x9, 0x0, 0xffffffffffffffff, 0x0, [{0x9, 0xfffffffffffffffe, 0x87, [], 0x1}, {0x0, 0x4, 0x2870, [], 0x100000000}, {0x4, 0x100, 0x1, [], 0x6}, {0x7, 0x6, 0x1, [], 0x2}, {0x2, 0x20, 0x7, [], 0x3}, {0x53f, 0x3, 0x0, [], 0x3}, {0x8, 0x2, 0x7, [], 0x3f}, {0x7, 0x1, 0x8, [], 0x20}, {0x0, 0x60000000000, 0x8, [], 0x5}, {0x0, 0x8000, 0x4, [], 0xf78}, {0x3, 0x6, 0x5, [], 0x4}, {0x5, 0x200, 0x6, [], 0x100}, {0x40, 0x4, 0x0, [], 0x5}, {0x1000, 0x2, 0x100000001, [], 0xb2}, {0x1ff, 0x0, 0x0, [], 0x8001}, {0xc88, 0x1, 0x8, [], 0x800}, {0x7fff, 0x600000000, 0x0, [], 0x7b28000000000000}, {0x9, 0x7, 0x42ca, [], 0x3f}, {0x5, 0xfffffffffffffffd, 0x2}, {0x1, 0x0, 0x2, [], 0x8}, {0xfffffffffffffff3, 0x4, 0x7fff, [], 0x5}, {0xb77, 0x4, 0x3, [], 0x2}, {0x6be3, 0x3, 0x20, [], 0x7}, {0x1000, 0x4cf6, 0x3, [], 0x3}]}}) modify_ldt$write(0x1, &(0x7f0000000040)={0x7, 0x20001800, 0x4000, 0x7, 0x400, 0xa86, 0x1, 0x8000, 0x4, 0x2}, 0x10) 07:13:24 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x7f, 0x1, 0x3, 0x0, 0xffffffffffffff9c}, 0x2c) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000040)={0x0, 0x4d, "2b92972c970c4c46c9e7a4d1e4fef552cbc56e83addb92475e52f42a754ac76641bad085b0a13e5e92968841a66411eb67526a84c33eff5f184d51fff4b2749ef7166cf833cb90382925fca436"}, &(0x7f00000000c0)=0x55) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={r2, 0x7fb9}, &(0x7f0000000140)=0x8) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0xffffffffffff4c25, 0x0, r0, 0x0, [0x305f, 0xa]}, 0x2c) write$eventfd(r1, &(0x7f0000000180)=0x7, 0x8) 07:13:24 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x9, 0x40) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000200)=ANY=[@ANYBLOB="00020091080000000000000000"]) [ 247.554008] binder: release 14500:14509 transaction 471 out, still active [ 247.561056] binder: unexpected work type, 4, not freed [ 247.566396] binder: undelivered TRANSACTION_COMPLETE [ 247.567493] QAT: Invalid ioctl [ 247.580921] binder_alloc: binder_alloc_mmap_handler: 14500 20001000-20004000 already mapped failed -16 [ 247.584197] QAT: Invalid ioctl [ 247.597062] binder: BINDER_SET_CONTEXT_MGR already set 07:13:24 executing program 6: r0 = getpgid(0x0) sched_setattr(r0, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) mmap(&(0x7f0000010000/0x4000)=nil, 0x4000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000001fe8)={0xaa}) r2 = epoll_create1(0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000019fe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) close(r2) r3 = memfd_create(&(0x7f0000000100)='bdev$-\x00', 0x0) pwritev(r3, &(0x7f0000000000)=[{&(0x7f0000012000)="ca", 0x1}], 0x1, 0x0) fremovexattr(r2, &(0x7f0000000040)=@known='system.posix_acl_access\x00') pwritev(r3, &(0x7f00000002c0)=[{&(0x7f0000000080)="92", 0x1}], 0x1, 0x0) io_setup(0x8ed, &(0x7f0000000140)=0x0) io_submit(r4, 0x8, &(0x7f0000000800)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0xb, 0x0, r3, &(0x7f0000000180)="57279054d8936ac257f4a7c51c3529106f95a1ca1e3b21aca4393b8f445811a9913078d343f7dc029eb2f7add8655e8a3b869862c4bb6178b890ad2f0c3a", 0x3e, 0x0, 0x0, 0x0, r3}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xb, 0xffff, r2, &(0x7f0000000300)="84c3165b87861493f24842f013ab21879a9418ec84405db4d7b69ff3c88665ced827396e3fb5c0c9a8cf67a5c927fb837adee9404a23e9c9be713dd9cdf1f9d741dcddd50e429d7f6dbeeb53c61223613176d8fe529698c29d5877223fcb244c40d13189a51238a3ddad7c04492b6478a1b88aba8d0b200bba7c63423e2e5e88588101dbae71ea58c95fa8c0c8a68ab9c5bfac005db1c672c61f1adff057d7228cea1a2ab2517d437890fd476b94248b689ccb01ce8333cd2cd840d14ab6533ea3be6354744d65199d95ad91", 0xcc, 0x7ff, 0x0, 0x1, r3}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0x200, r1, &(0x7f0000000240)="7d633c838e3d11ad3e86fe6ab86790872e0a229b0546c93fa1a2d322b1cdded437ffe3661b133627d62108fd456d84bd1378c3e744d73241", 0x38, 0x4, 0x0, 0x1, r3}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x7, 0xba25, r2, &(0x7f0000000400)="3af5a9444501c1a517ceb0b53716f8ed77cf0c3bf9af0a77ac296d6cd9d0ecd707bbeaa944e781ecf8756df81813512d55bc014a5b9ea8ad343d2bc433d58380fafe719d3fe9561f08624d541bf168ceb937792255809e97777821000736b0872af8acb2ef0267", 0x67, 0x101, 0x0, 0x1, r3}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f00000004c0)="af464baf5a1d1daacb88dcedb6e3e02d132f632cd4e6c0d0c093649e61f7bd8ce10554ab552e75e302957b9be9520bf7b872d12df1b6f8b89dba857c68d5cfdbd7fe2329e77bd5d03fd12f5739d4426df15dd379820d738f27bf2dbdc7584ef54cf4227023700a259b4da2616dc7d5493e134eadeb589220eff9354391b6702f5e76e853ab9247d77a06e2c5f05ac078c4f85c3f42dca19a35784e727f738b63", 0xa0, 0x8000, 0x0, 0x1, r3}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x7fff, r3, &(0x7f00000005c0)="1686aa19c34471d42fc1a5a31c16cea4e4c7300f7cc32410013a8f31f9c7771157b7e6e041d364aa9bda5276e034031dc3ba490a6625a7309b08c508eac7c3e550aa82cbaab51972d6ef9d0ca4c8fb7d85095b2baa8dee897ba5024c89b79c28cd38f672d823f57b7179967f3f64fc12bd30530020349cac06976fecb0a54e3bd04f704970199886db83213985864aec099d07af3ff4749ecf1474fd3584cb863a5c0b870b64cf5df31204a1ca6b4a806a6c07f81c6ca4d840eb073210526c5cbc273a465a862a4f9515af2c0be38218b5dbe7c5076f82b6b5e3ddc1d02166932de2", 0xe2, 0xf484, 0x0, 0x0, r3}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x8, 0x1, r1, &(0x7f0000000700)="fa5992bd5cf792abbf3a551c79ed79c830f11ff4663450157f12da53d363bb8451c34d280c31d022dbf2c0b772a529e73e471e", 0x33, 0xff, 0x0, 0x1, r3}, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x7, 0x7, r3, &(0x7f0000000780)="d859171d80e79a05217358e9569e9b23728f24c2faef23484482c99551d6d0c1", 0x20, 0x7, 0x0, 0x0, r3}]) close(r1) 07:13:24 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000415fc8)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f00000000c0)=@updpolicy={0xb8, 0x19, 0xb05, 0x0, 0x0, {{@in=@broadcast=0xffffffff, @in=@loopback=0x7f000001, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0xfffffffffffff000}}, 0xb8}, 0x1}, 0x0) 07:13:24 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x60, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:24 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m#dos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 247.602848] binder: 14500:14509 ioctl 40046207 0 returned -16 [ 247.607435] binder_alloc: 14500: binder_alloc_buf, no vma [ 247.614394] binder: 14500:14518 transaction failed 29189/-3, size 24-8 line 2967 [ 247.625139] binder: send failed reply for transaction 471, target dead [ 247.633420] binder: undelivered TRANSACTION_ERROR: 29189 07:13:25 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd0fc8)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f0000e05000)=ANY=[@ANYBLOB="020d00001800000000000000000000000400040004000000000000000000000000000000000000000000000000000000080012000000030000000000000000000600000000000000000000000000000000000000000000000000000000000000ff02000000000000000000000000000105000500000000000a0000000000000000000000000000000000ffffac140000000000000000000005000600000000000a00000000000000fe800000000000000000ff00000000000000000000000000"], 0xc0}, 0x1}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101000, 0x20) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f0000000040)=""/218, &(0x7f0000000140)=0xda) ioctl$VT_DISALLOCATE(r1, 0x5608) 07:13:25 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000003c0)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000040)="0f019d0050b804008ee00fee8d1a000f23b03ef20f090f07650fc798a1cf260f01b7f3ff0f2199656c", 0x29}], 0x1, 0x5d, &(0x7f0000000580), 0x0) write$binfmt_aout(r2, &(0x7f0000000400)={{0x108, 0x401, 0xff, 0x377, 0x31f, 0x9, 0x343}, "", [[], [], [], [], [], []]}, 0x620) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000004400)=[{&(0x7f0000003dc0)=@in={0x2, 0x0, @multicast2=0xe0000002}, 0x10, &(0x7f0000004280)=[{&(0x7f0000003f80)="011676f8c18c45f1b5ba46a66f7d4e1f30b7baf6202ccd826c4e6ffc578eecf2713f35efd84e26c0ae05c333460ab8289dad85a69a5be525abeb28649b419d95e89505f927c8781405f35197e7c2643028b6a3bfa693889f0cbdecd4da1eb3fe614b7abaff6ca4099bd2887eb43b75e8cf606f10b97d28b6557b41577835f5cd85", 0x81}], 0x1, &(0x7f0000004380)}], 0x1, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 247.938103] binder: release 14542:14547 transaction 476 out, still active [ 247.945151] binder: unexpected work type, 4, not freed [ 247.950481] binder: undelivered TRANSACTION_COMPLETE [ 247.957673] binder_alloc: binder_alloc_mmap_handler: 14542 20001000-20004000 already mapped failed -16 [ 247.968749] binder: BINDER_SET_CONTEXT_MGR already set [ 247.974101] binder: 14542:14547 ioctl 40046207 0 returned -16 [ 247.974122] binder_alloc: 14542: binder_alloc_buf, no vma [ 247.985592] binder: 14542:14550 transaction failed 29189/-3, size 24-8 line 2967 [ 247.995552] binder: send failed reply for transaction 476, target dead [ 248.003499] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.395226] snd_dummy snd_dummy.0: control 120:0:0:Î:0 is already present 07:13:26 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m*dos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:26 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc020660b, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:26 executing program 0: mkdir(&(0x7f00000003c0)='./control\x00', 0x0) r0 = creat(&(0x7f0000000040)='./control/file0\x00', 0x0) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000080)=r0, 0x4) rt_sigtimedwait(&(0x7f00000017c0)={0x3}, &(0x7f0000001800), &(0x7f0000001840)={0x0, 0x989680}, 0x8) sendto$unix(r0, &(0x7f00000002c0)="47532b2417227015e0c207d26e15aab81d51aac75f6e472efc925e197f7dcec4deac3dd4ccf581481327bf22b73df453b87292fee2fd7264127496322910ec7b306b0d3cc0af748d5d78059d992f80884f79f790dae34cc162e1ff53c9c2ed7085dfaf09564ef003677a2f4819881ee6b1ab3ff1bdb8e3f07e11b753947c0f7950c0436d035f19ee3cd3988967d458d3c7bf892424db55ac0960aad119f5b42d91e6918dc84d2ffd2ffec455ffec268879e4e5ad94fb1927f893e2f2512f", 0xbe, 0x40000, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x17d) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r0, @ANYBLOB=',\x00']) recvmsg(r0, &(0x7f0000001780)={&(0x7f0000000180)=@ax25, 0x80, &(0x7f0000001600)=[{&(0x7f0000000200)=""/16, 0x10}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000000380)=""/24, 0x18}, {&(0x7f0000000400)=""/133, 0x85}, {&(0x7f0000001500)=""/198, 0xc6}], 0x5, &(0x7f0000001680)=""/231, 0xe7, 0x40}, 0x2000) 07:13:26 executing program 5: r0 = socket(0xa, 0x80a, 0x8000001) write(r0, &(0x7f0000000340)="240000005a001f00ff03f4f9002304001576f51108020100020804028001c9a800000000", 0x24) 07:13:26 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x7a00000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:26 executing program 1: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$SCSI_IOCTL_STOP_UNIT(r1, 0x6) r2 = dup(r0) setsockopt$RDS_GET_MR_FOR_DEST(r2, 0x114, 0x7, &(0x7f0000000200)={@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}}}, {&(0x7f0000000000)=""/224, 0xe0}, &(0x7f0000000100)}, 0xa0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'vcan0\x00', 0x9800}) write$P9_RSETATTR(r1, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) 07:13:26 executing program 6: r0 = add_key(&(0x7f0000000040)='cifs.spnego\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000000c0)="50ac0a83bd55e0ee7e2119b78b0f822f9d2ea8f7eb478cb8e3535f991191489a9c50ebeb67acb44d8b6eb3e04b902eb3a568402c63080c4b715ca471", 0x3c, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000001000)={0x73, 0x79, 0x7a}, &(0x7f0000001000)='\x00', 0x1, r0) r1 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x9, 0x410800) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000140)={0x1, [0x0]}) 07:13:26 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f000000d000)={0xa, 0x4e20}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0xb}, 0x1c) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x4e24, 0xfffffffffffffffc, @mcast1={0xff, 0x1, [], 0x1}, 0x5}, {0xa, 0x4e22, 0x7, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0xd}}, 0x40}, 0x7, [0x2, 0x6, 0x9, 0x8000, 0xd1, 0xc59d, 0x3]}, 0x5c) syz_emit_ethernet(0x3e, &(0x7f0000000440)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0xffffff11, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [], 0xaa}, {[], @udp={0x0, 0x4e20, 0x8}}}}}}, &(0x7f0000000040)) 07:13:26 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000780)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="78733976000898fcffff6054be13cfe62785ce10", 0x14) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_elf32(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="d86d9b3d6ca919f64e18215b9741051c1620e1f31e391182"], 0x18) flistxattr(r0, &(0x7f0000000540)=""/182, 0xb6) r2 = dup(r0) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000200)={0x1, 0x8000}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000600)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000740)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000060}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xa0, r3, 0x0, 0x70bd2b, 0x25dfdbfc, {0x11}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffffffffffff7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffffffffffff8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xb66}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24040840}, 0x2000c010) recvmmsg(r1, &(0x7f0000001280)=[{{&(0x7f0000000180)=@pptp={0x0, 0x0, {0x0, @loopback}}, 0x80, &(0x7f0000000200), 0x0, &(0x7f0000000340)=""/223, 0xdf}}, {{&(0x7f00000010c0)=@nfc, 0x80, &(0x7f0000000040)=[{&(0x7f0000001180)=""/161, 0xa1}], 0x1}}], 0x2, 0x0, &(0x7f0000001400)={0x0, 0x1c9c380}) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f00000000c0)='./file0\x00', 0x3, 0x3, &(0x7f00000002c0)=[{&(0x7f0000000440)="155f8604ca9f1584512ae6e894796a37a59f8fc3babfcee6f0a769a16549bdbee6b742feb340c33dd30cde20a117a5c9b654afefda9b71186234749a016a6b32b7b846d4f0f49bfa8317efb976c1eb0dcb51c168edc1251e831f1823e90eb83e4b524a6f2adc9b17cb0f73c9bcd6e115bf2429a8e0a0a5616395faffc1d01c874a7d4c48dc6e5afbcf97acb55c85e0323db452073e76d53e1d6bbacf79dbce7dba0eac61bcaff302300da5f5551f174a136d2f9b1601e6c30821db59fe5da9b3770bfce2094a5989e3782f3350dba8e39733fb2e77908f4bb8fdeaed3a6661189ed14023469127103c23", 0xea, 0x4}, {&(0x7f0000000200), 0x0, 0x7f}, {&(0x7f0000000240), 0x0, 0xb}], 0x40, 0x0) 07:13:26 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet(0x2, 0x200000002, 0x0) getsockopt$inet_int(r1, 0x0, 0x12, &(0x7f0000000040), &(0x7f00000000c0)=0x4) fcntl$getown(r1, 0x9) 07:13:26 executing program 1: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x101142, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'vlan0\x00', 0x0}) sendmsg$xdp(r0, &(0x7f0000000180)={&(0x7f0000000100)={0x2c, 0x6, r1, 0x25}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000300)="a74c1c5bac5511c3374b3bfd15f1fb09c9ba25fe440b1a4a63a150296934f9aa0da3a4d0c21aa0c40ac3192387d8f5acd2503ba2181f98b39d1b109bf07216c42a13b5ab5abf65d250f73ed2a234a33cfba041e296f247084adff1ae9606b56fa345fd5068235c265a005f5e749f0a4d7e8c9c05cf5b03f24688ef123e74ec4ad2298d61f3c2e4c76993ca00a08f7c69be8a8ce6b29b9c9b1cecbea73ea263d1501264e5ffa42dc4ee23", 0xaa}, {&(0x7f00000003c0)="4b1bc00682285c0956d0b87f64f948bf16e4f598ee6801473e26a6ced3a258a1c63f51cbb5c2cb86cf2307f57c9b01eaac95994d823690fbe3a6ce2dbddbd4379f2eb11dbf0e79cf29f2ba5178f6de57c0dce6a0078605fadf2e968df5a6c58a3f71651cb6f493e6435127f6c22d9e07c38375a9e55b028451383690942b0792e43abaa94b4b0236664a5b46291caf8075f15cb8ebd1b053f0", 0x99}], 0x2, 0x0, 0x0, 0x8091}, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) accept$alg(r0, 0x0, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000000)='fou\x00') mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="2c6163636571733d742c000000000000a4a3b3d414917ec330e55c5fa0d55df1dfd1a5fccc92"]) [ 248.869727] binder: release 14585:14591 transaction 481 out, still active [ 248.876742] binder: unexpected work type, 4, not freed [ 248.882036] binder: undelivered TRANSACTION_COMPLETE [ 248.893487] binder_alloc: binder_alloc_mmap_handler: 14585 20001000-20004000 already mapped failed -16 [ 248.904758] binder: BINDER_SET_CONTEXT_MGR already set [ 248.911170] binder: 14585:14591 ioctl 40046207 0 returned -16 07:13:26 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4c00000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 248.911531] binder_alloc: 14585: binder_alloc_buf, no vma [ 248.922731] binder: 14585:14599 transaction failed 29189/-3, size 24-8 line 2967 [ 248.935804] binder: undelivered TRANSACTION_ERROR: 29189 [ 248.941635] binder: send failed reply for transaction 481, target dead 07:13:26 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='m%dos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:26 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x3) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000040)="580000001400192340834b80040d8c5602062200010400004001000000005800004824ca944f64009400050028825a003b5fbe907902008000f0fffefffffe03edf8fef5dd00000010000100000c0900fcff4d00040e05a5", 0x58}], 0x1) [ 249.000202] 9pnet: Insufficient options for proto=fd [ 249.019441] 9pnet: Insufficient options for proto=fd 07:13:26 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) seccomp(0x1, 0x69721b360eb66a22, &(0x7f00000000c0)={0x3, &(0x7f0000000080)=[{0x1, 0x4, 0x7fff, 0x7}, {0xb752, 0xfffffffffffffffb, 0xfff, 0x6}, {0x3, 0x3, 0xa76c, 0x5}]}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="1900000000000000000000000000000000000000000000000000000000000000000000000400000000000000b64760f7453a74cd690dff63b929d6322a62fe1f3b42f6a4747050e7e38de14e228d374be72608871434e4abc06492a95cbc09c433e5cd3c3f20385f4b9190401ea1b12b2e31291d3574c8c3bf0a260bd218a7296c54bbf35fc2eefb3c18fe628ebb6cfaf1ea91e39031"]}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000000)={'vlan0\x00', {0x2, 0x4e22, @multicast2=0xe0000002}}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000340)={0x7fff, 0x0, 0x22cd, 0x9, [], [], [], 0x6, 0x0, 0x2, 0x7fffffff, "a8c6e9555ab529c4de113c1120697112"}) 07:13:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x100000000005) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000002c0)=ANY=[@ANYBLOB="0100000000000000010000000000000018000000ff"]) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000001c0)={0x2, 0x0, [0x48b, 0x0, 0x1d9]}) [ 249.210519] BFS-fs: bfs_fill_super(): No BFS filesystem on loop5 (magic=00000000) [ 249.213800] binder: release 14626:14634 transaction 486 out, still active [ 249.225242] binder: unexpected work type, 4, not freed [ 249.230706] binder: undelivered TRANSACTION_COMPLETE [ 249.238589] binder_alloc: binder_alloc_mmap_handler: 14626 20001000-20004000 already mapped failed -16 07:13:26 executing program 1: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xef6f, 0x2) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000040)={0x0, 0x7b, "1951daa0cc56a0f1310279090a754fc16859030c97c8ee9c921039f0db9541883933770f24b93f666b30a409d2b6819beb9dc25559769b3eb39b48ee8432ca9647ff292c2c5698e779da6655d6d41c53754d3716f0b70001fb5fc24c11dd5ba493bbd6d09110424e85ab0a787ef0871e1f054a4702cbdffa47d22c"}, &(0x7f0000000100)=0x83) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0x5}, &(0x7f0000000180)=0x8) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x1000000008912, &(0x7f0000000280)="024a903d6d345f8f762070") r3 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}, [], {0x95}}, &(0x7f0000014ff5)="73797a6b610000000500f3", 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f000001b000)={r3, 0x0, 0x36, 0x9d, &(0x7f0000013000)="e460019234060dc106621abc86dd6a00000000072ceb305660319056115082553800800000000000e8d5000000010000001400000000", &(0x7f000001df63)=""/157, 0x28}, 0x28) [ 249.265761] binder: BINDER_SET_CONTEXT_MGR already set [ 249.271839] binder: 14626:14634 ioctl 40046207 0 returned -16 [ 249.278219] binder_alloc: 14626: binder_alloc_buf, no vma [ 249.283812] binder: 14626:14635 transaction failed 29189/-3, size 24-8 line 2967 [ 249.301809] binder: send failed reply for transaction 486, target dead [ 249.312774] binder: undelivered TRANSACTION_ERROR: 29189 07:13:27 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x408c5333, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:27 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000000040)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', r1}) getsockopt$sock_buf(r0, 0x1, 0x3b, &(0x7f00000011c0)=""/152, &(0x7f0000000080)=0x98) 07:13:27 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mslos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4c000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:27 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB="d62ae2820002000097"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="850000008f000001000000009500000000f5a7e7493336015c7216d60cd701056d272ab6b6ec18dbcbe495553ee09277e0990e8b339daa6d1bed918b17ca4a430000000000000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) 07:13:27 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000000)={0x5, 0xfffffffffffffffe, 0x3f, 0x87f, 0x0, 0x0, 0x0, 0x5, 0x7c, 0x3}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x7f}) 07:13:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x7a00000000000002, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="000100000008000066000000c9030000ec000204000000000200000000000000002000000020000000010000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='A']) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = getuid() syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file0\x00', 0x3f, 0x0, &(0x7f0000000100), 0x20000, &(0x7f00000002c0)={[{@quiet='quiet', 0x2c}, {@dir_umask={'dir_umask', 0x3d, 0x8}, 0x2c}, {@uid={'uid', 0x3d, r0}, 0x2c}, {@part={'part', 0x3d, 0x4}, 0x2c}, {@codepage={'codepage', 0x3d, 'koi8-u'}, 0x2c}, {@uid={'uid', 0x3d, r1}, 0x2c}]}) 07:13:27 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0x0) mmap$binder(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={0x0, 0xf13}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000000c0)={r2, @in6={{0xa, 0x4e23, 0xff, @dev={0xfe, 0x80, [], 0x1a}, 0x9}}}, 0x84) 07:13:27 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000140)={0xfffffffffffffe7d, 0x0, 0x200, 0x4, 0x0, {0x5}}, 0xffffffffffffffa0}, 0x1}, 0x408c0) write(r1, &(0x7f0000000100), 0xfffffcc7) 07:13:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xfffffffffffffffe, 0x80012, r0, 0x0) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) 07:13:27 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) ppoll(&(0x7f0000000280)=[{r0, 0x1188}, {r0, 0x10}, {r0, 0x80}, {r0, 0x200}, {r0, 0x1000}, {r0, 0x4000}, {r0, 0x8}], 0x7, &(0x7f00000002c0)={0x77359400}, &(0x7f0000000300)={0x5}, 0x8) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0xffffffffffffdb64, 0x2000) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r1, 0x800442d4, &(0x7f0000000180)=0x9) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000080)=0x2, 0x4) listen(r0, 0x1ff) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000001c0)=@assoc_value={0x0, 0x3ff}, &(0x7f0000000200)=0x8) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000340)) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000240)={r3, 0x6, 0x0, 0x93fe, 0xffffffffffffffff, 0x4}, 0x14) ioctl$KVM_SET_VAPIC_ADDR(r1, 0x4008ae93, &(0x7f0000000380)=0x5004) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8548}, 0xb) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000400)=@add_del={0x2, &(0x7f00000003c0)='bridge0\x00', 0x800}) sendto$inet6(r2, &(0x7f0000000140)="d9", 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1c) r4 = accept4(r0, &(0x7f00000000c0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000f5effc)=0x80, 0x0) recvmsg$kcm(r4, &(0x7f0000002c00)={&(0x7f0000000600)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f0000002b80)=""/114, 0x72}, 0x0) [ 250.193980] EXT4-fs (loop1): Unrecognized mount option "A" or missing value [ 250.202515] binder: release 14690:14701 transaction 491 out, still active [ 250.209497] binder: unexpected work type, 4, not freed [ 250.214812] binder: undelivered TRANSACTION_COMPLETE [ 250.225805] binder_alloc: binder_alloc_mmap_handler: 14691 20000000-20002000 already mapped failed -16 [ 250.234234] binder_alloc: binder_alloc_mmap_handler: 14690 20001000-20004000 already mapped failed -16 [ 250.247424] binder_alloc: binder_alloc_mmap_handler: 14691 20ffb000-20fff000 already mapped failed -16 [ 250.250246] binder: BINDER_SET_CONTEXT_MGR already set [ 250.263310] binder_alloc: 14690: binder_alloc_buf, no vma [ 250.269066] binder: 14690:14706 transaction failed 29189/-3, size 24-8 line 2967 [ 250.283683] binder: 14690:14701 ioctl 40046207 0 returned -16 07:13:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = memfd_create(&(0x7f0000000200)="21a62b776c616e31736563757269747900", 0x2) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000240)={{0x2, 0x3, 0xfffffffffffffff8, 0x3, 0xa4}, 0x1, 0xfffffffffffffff8, 'id1\x00', 'timer0\x00', 0x0, 0x9, 0x9, 0x9, 0xfffffffffffffff7}) seccomp(0x1, 0x0, &(0x7f0000001980)={0x2, &(0x7f0000000000)=[{0x20}, {0x6}]}) r2 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x8) ioctl$TIOCLINUX3(r2, 0x541c, &(0x7f00000001c0)=0x3) r3 = accept(r0, &(0x7f0000000040)=@alg, &(0x7f00000000c0)=0x80) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000140)={0x7, 0x62b, 0x101, 0xc8}, 0x6) 07:13:27 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x3000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:27 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mssos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:27 executing program 1: r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) accept$unix(r0, 0x0, &(0x7f0000000080)) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040)={0x303, 0x33}, 0x4) setsockopt$bt_l2cap_L2CAP_OPTIONS(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000), 0xc) clone(0x3f00000000000000, &(0x7f0000000040), &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) [ 250.296071] binder: send failed reply for transaction 491, target dead [ 250.303400] binder: undelivered TRANSACTION_ERROR: 29189 [ 250.310979] EXT4-fs (loop1): Unrecognized mount option "A" or missing value [ 250.482682] binder: binder_mmap: 14729 20ffc000-20ffd000 bad vm_flags failed -1 [ 250.497959] binder: binder_mmap: 14729 20ffc000-20ffd000 bad vm_flags failed -1 07:13:27 executing program 5: r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffa) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000004c0)="e33921f714cfc684a6be36f9c71dbb2139eb0f5e11d408f30cc817edc3513d35185efa385f33db5eb4a52eefdabd86522b8ec7486fac2cd3c77e1e91ffd5fc5543114e7a81711239e64a90093d28d6870d5bc9c55d4deade442b4eb03bf3769810eaa3618cc1c2346ac1d181ec2d0e1e7750ad8bbca59d71185f36e2eb78fde98da3bc1196a1c35576ecc1fc0d7394433e6d72dfcbbacdfdf2255da3e6dd5e67c7dee538638461462dda9f4293a68ac35418aa993d2990846a82efd5b9ed8369358e7fb6ed9f58e8b2c5eb6fe316bd84ac7f56da2e705ab4c981173ddc5d46d453d999958ce45ec0f475b07048e089d76bf7eb91b30d8f16f2f0c89f702d65d08703eb41e2938810bda40e4dd62af97ccd3314c9daac03c1b21d4ec6457f1ba50e73517177b0a5481752593ffd0075a6c2f82766399ebe799c0d6af8ef3705d4e92e23ec59bb02747846cd72e8d0862f0c9df6c0d90e9653a78187fdb3577defd05ec885415832d3ec4f59ca4fd0f3d68e37117244f33b77e91a2a7962b18ec16bd4650367c861fdd1b3d97b21a9fd14698b3b18c4498343476ba598a8ae985b949993192a1b3c3f8cd47a6072164de3c16bacbf4255f16ed8eb8af944d3fd39583b0a99e20051141fdb55059e2de025bbdbf169c1fc4154b513d8dbec379cb435a13d46566afb9250464a717c2b003baad3fed1a588a30d829cf18cec986be5ab231f55fd0ece31652247528cde63317e226a3f1b7efd718dd28d5574ae211c4dc62f476f3c6d46631abc8da15f037b63d6827bc18a445e49959808bb307617713c61218920f4983f55ba903ce4650b61815d3f686c979d386c9414f3356a69692d940b8f9f923d11de7a4e1b6e78b6dae0bdda5a4a4b3e9b043c1c1c8c050b35887071a52051f01d17090537e903ba50321dd4af939b287cf045d9511dff4026b706bc89d683698dd874e3c07e35a6b65e5ff06715f9816bdb85b553e9af5ece64cc3980058a5b30aa6d762753f2748906c6c63e8072697456be407e9c176ec977ed880b8551b841770fe54e817bda22a88109002468edb7aeea314fda93c81a8f0b625606cfd1e722de8433775bc0fd55bc5d7e8d9338b354f8003f104898bffdd857df7467b0367942706c3233ce9ba4a05eb8c9f036c87b5799eae7335755fc6c0e601f4a38d3fa06e1e84407e10f5dce152f1936e78808f52bbda1b5ed0f4dc240d3f07c554247ba6b3eedb2379c7ef76eb79260455b60a4c0ce3614872a2c51348aff936390f5433a1c9232c7045defaa106499eefe8810f83d3dbdede8741f7690b108146f49632daad74c0cde1d77dfca202a2bea14d6283a3e6e06047fe4a14899e9e6d0c4a5d48647bf3d95e0d7112dbc7c73755b23cf28b6155d49ef092e8ea07d431d4dd1dfea7bb080f9048fb2d28ec99823e70fb893e7dc0f74b6c1ac243c63f4c1320e5c479dbd5433c74f4eb74775a7bc711b235830b1b4fb08ee9f5ed0a2b214085a962e20350374b1679a5320c81cc40e542ea808e66870d9eaf7c8b35b417d12ecd3c5eb23de2a54ce1196042ccdd4c486f2795429b3042fb2cb23fe4a9c09d05a820a21d3330f798ddebfd1610a27cf9c2e19600900feccc566aa24d9c45f18ed451fd1b2775daca812bece5ddcf829fdfe6b92a9a404657e78ca04fcd944b8184cdda3481f6e46b387e3284f4181045e56631440b5397228077e5d5e3c096563f196b3f448e7c1593eeb94d885ea0de0c2608b52f5c506517c327fac9a8b7f605bb92b70659066c4b9c12ac9f934622722fdeabcd737ffc1198855f7577097cad037c98d926dd4a729c11dbdcecf46e76245f6fb8bb90001cf5342a3a5512ae843764aa43abac2ce2d1fd03a1608d349d832458efe7a623a7220a5d80a93d4f3a2b024e30910f2e2eb1c30a113ef67433cad58b43e6d36b6241766d514f0b349b969d5152708c18c3159b737fdf002d19a9252b99331e8d06c5327829883694008604c2fa5a49f2a7e309b5ba13fb7b1d82d52280774c9ba0832090730d6ff0be6437374b902d27bae9201ec84e239e4d6ee9290576c31868778607d92883b6f9d44154bdd3431e0df9adfa2ba9cad253128aa3b1e7439f5e43d7ff8697a2d48fd5493525652b5b061e1cb6daa229b779e98771858d9afdd556bca3f38439790d1fa49f69af4aedf8c3ab381e26c46bf050ea5d091115175efc2aa048e92751b6ea90533916c90112e8cd0b5190075fa10f98ba7ee2ac4f05dce9d145764d9b23354e3c588030a140c01ea3dfbf1a38c87898c3357c0d29e06287f256345fec48ad96bade706bd846e6b8d0e92860cd6a2e91b8a112ff760ea01fb694b054b98ffbac7552e459883248d1c4347a6d798e81147b5a07f8f96f2328cdcd9b32c8a76c45031535b42da510c5ed7dcf55df1853b6d2678e8b49e9eacdc9df6543cbbeef7c1c6a0d0f9104659da6aa561256988fe4e1649aafa988b0473a301d28af24402da2298ca1d4bb4b39b5bf193782cb38ffe3856bcd12d7b66dda5b2633be85541e096879e8d37c07dba0bc03ca2eef4e63aff300d1cb55de999f08a47cf3856b903eeb7536b8f61849a2fee9c73387cf9fcfaf997bd0d43ad386a409861d0b33c69f13854ee7db288979648ba8cfcb01e11bafd88c4239d61f941ae93bc74c351161fa12b67fb6024e64ef4aa2d610a80d5f767e7078cd8b00e325fbc6f4f4dec8e5645d3fd2580bb3b11721f4f23cb4549c6cf907f0aa4c96526d71b9a79480cf451c692627bb223d39fcb40f76838cf788f9f8a1267f2b7e173c78f3f165b5b50942e3975e5f755e3d98ef826d74e40b154f789a166646ddc72ed0fa12dcad52ef4bae8d478c8265f14e3b983631f972be2966284257ebebacc32f09e5e702603b83a29377fbf7c536287ec4711d6e7d13803b92515b020fb4d93fbac3f320a31183361edfc503d8c538d386d016101f42163f0494fcde07c04aa1ce5708d0f4c534dae471fee0f1be38cdb0fff692a55c1cbe73243e87cc7d0dadf4b5ef6f914abafab67505e50e3dbadf553c2836821a831f2a157be0b2974e06ac59b0a10b46763f7f93518a8652733d5b67f48d9947c8009c45bf31dcf93754cd28378ae0bd1cad9a48b0c8e0761187ba72203d5404b11993169a3324837e4c9058142a47c60955c0f80d37fc574f9d366e10076e661c3269a60e7f3bf2fdfd99025911596e09a8f0cc6f380b12319c5a78a3f118bcf734a7fc7ab550238c80f44fa2870c87f3ed93dd632dc9597c28fe1249add4d7ca0efc8d62b9c1a49b7c4a7360997ad7209fcc96c6e8a8ba0aeb865353e80207bc22dfa7900c3e18e25172bb2033b238deb803cfe03693c6e97224998008b48a30f1edcc386ccb5cd46c8c365404ac1dc60581ef2c1a388880d7ccd3f4431f944b8cc61c53af7406d237d2daa7b8657d9fb9c8202db593a181154a24194070aadff21053de35112a6bf94a66abcb1caccd16f8677e38ab4174d014882a18969085a8efd41ed05cfb6f5d4ef6b7319f4e1777894918d89803de1122b0f02189ce3489ce9e731e2b225306822b3ce8fcc2b35c14b1a1b2205314f2ffd5b6bdbdc6670199ab09058a6893eb33ff09733625261d5c532ea7ff4ce79bf787cc9a0ff68095040308e14505d2601a63d7fea717bb615d5bf2c0f76a941dd9bf677bbeca4fbab622dda4bfd78af50e62f0a6d74db6496a6c39f60d8c447a97b4b4a2f1ebaf070a6babcbe356f5e3581b9bf044383cc479d9c3fd92e3cb98eda9a4c1282c495866dce13bcf01b83b9bc004a76492da6a6c8b102c64acda5907e8fab70a7bac944ec50e2585de534f6c43051e15a585b4741f34dfe349f82cf930f95117395b404b26ff4aa5b8ef6995f3f7cb53518b4c1df5b92d0e07dab489672d495c225d419cf539cb7fe61a8a6ad351fb680ffdb41d2028f9709e5fbe7e86a8c620b4d35f91c3f38eab67b7e21b2750a76ada64015a4a63e98babe04e6d542c5d77f74eb933e686433b6d9987f41bb21450195c419d113af548849308de3a6b4654b35a25075bcb3eb3f5583d1032d0b0d9b8634087255ae8b6e163d57db2541963ce826e45e5218a299a0d48ba3a3bb12af5c932d47d8975255f7fe40591b960d80e472941dc9385a22e50161c4e332fa858cc15ff2dc599e5c9ed4e9eefb816af10b5ba01fc975e45470e5d14382cbcffd933a0542efb91fc6f4077e8fc5bb9a846a76380ac7bf02cc7b674634d45a56edd4eed2f774127c32680bc4d9a47175faeee415871a53d33e03fbd9f212f82b6ebdc2571babacd7cf0fb54be8423d2a647f21e17fb653a23dc97aa251a41c572fddbcbc71ffcaed01037dc7a353ff737f07353d5691ab0e4eb093f352485cb9b8f7ec7f24ccf2e57098ebc38e43d4bd294932ad0002f5627ab9b25240b135819081f6ed6b91dfb81d8e84812d6e08e8740c9fceb802ae5414adca7c477259a4e89ebdeb1648d10c70135f4d086d44bb7bb9acd45ed5ede7af7cf9a57dd905088836fa485449d8ae0363c39d573b9f1e9f8037248dcd2856170cefba19f968f64656a20263bf294da99c1a601c8db2e989ee04e1c0ffaeef8e252988374fc9ff1d51b113d44aa1ee3f850941e081e6dc1a835a5ca10a300298b621c7c4231abaa3a194adc78ae09ea1e49479689e82a0e63702aea7fe0309bc04057a7b3a239782bfc662d4ccb48842bf990eb2e6b58fede3e16f2b65aa257cf89ddd061f09348b33c91599e9628c8cfaf82a6626de1edf8d10bbd3c183f046183f98f9aef954bd058b05af9099ff4876a09abdcd1441cec67a122ca37b95339caf37f637e5b68fb4214475f79b691318949fbf0d49d818d331fc547b7c88e60992a00829b245503fd27ee80e2a7631df09dc4b323e513d2b867004083518048735c7ca63493aa5d388a97a3b58966d5563cae05b8fa4de6c3a00547c62c3ed7d27be04d8a061451d1c4bb9575103e78d6583a4ce5c49e490e6cedc0ca4c3d440e7cd25127c6b68dce34d39fba98da16ca00fc2458e0cc6ff41b4763c6e350f86b5d7fc336d8034213d449e611dcafdc382943f37d4a801f8f7d12a94cf8103a905cee20c3da363dbb6d8e33de1dd8d87bc7681779504227048502fecbca09087d4eb3c5f524cdba1e42b667f9853fffb6327db36d95ed4dee60abb0233d7c9c218f23fda25431f8a82eb12f7917c99b163538af5aa64bdc5f277d62006ea19a70ce6e81bc602cf055356c84661ec20d1cc21e4dde7dc8f83edd380de70a42fe3324a8e81b3cfd33318f201e4c153a689086336d34cbd4745a241ac28906d4437d2ab3d39ff78439c5851492689d3d64dca302b48931b1bf2f27a21a63f0080e032e35caad6e580ded83b18b5bba82797dd3f09c4311beca000701a6151c0999127b9082b3cd5626901a574a08a17d229e7d164ae1df76f3802fd434d51abef274cb9e30836f1fab30ccc1bcb830e060cebe650c9e95827be3758e313407a94ae4f819a9b3238a5b71d10db108b5d8424013d8abfff3883dd508c296a8855570576de62fece5b1d9a41bbd7708b759663d0cbd9f569122701f9ad51bc1c0d75368e6972942a369787da8c6138ac92e412d1720dc639a690dfc026174c37a7055f69c6cfde31a4e21a889c631adeb81ad07ef018a2c381954d4645967c7af5ef56c0ff9b1b89db71688a17394792a486d8d791b98712184b7498acccc5ae6fdc68eed359de8ee45aed70da884b1d70e089bd7e159bfc1410074e", 0x1000, r0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="850000002a000000270000000000000095007aac73f8bf16000000006000"], &(0x7f00000002c0)='syzkaller\x00', 0x9, 0x4ae, &(0x7f0000000340)=""/207}, 0x48) [ 250.538209] kauditd_printk_skb: 495 callbacks suppressed [ 250.538220] audit: type=1326 audit(250.537:508): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14737 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x455ab9 code=0x0 [ 250.567391] binder: release 14741:14744 transaction 496 out, still active [ 250.574411] binder: unexpected work type, 4, not freed [ 250.579783] binder: undelivered TRANSACTION_COMPLETE [ 250.600284] binder_alloc: binder_alloc_mmap_handler: 14741 20001000-20004000 already mapped failed -16 [ 250.611260] binder: BINDER_SET_CONTEXT_MGR already set [ 250.616893] binder_alloc: 14741: binder_alloc_buf, no vma [ 250.617492] binder: 14741:14744 ioctl 40046207 0 returned -16 [ 250.622540] binder: 14741:14751 transaction failed 29189/-3, size 24-8 line 2967 [ 250.636697] binder: undelivered TRANSACTION_ERROR: 29189 [ 250.648116] binder: send failed reply for transaction 496, target dead 07:13:28 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x600, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:28 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$VT_RELDISP(0xffffffffffffffff, 0xb701) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x103000, 0x0) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000080)={0x15, 0x6, 0x7, 0x800, 0x8001}) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x422}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000001c0)={r2, @in={{0x2, 0x4e24, @rand_addr=0x2}}, 0xffff, 0x1}, 0x90) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000100)) bind$nfc_llcp(r1, &(0x7f0000000140)={0x27, 0x0, 0x1, 0x3, 0x7fffffff, 0x1, "508bfc464dfebc87bac1988dfdbf74f0440e88dfc9ddb90b0cba6a7d4508cfa76beb74f6af2b88680bb9fe77d1399e4ce91529c8471501637aa042ec6ef686", 0x1}, 0x60) 07:13:28 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms/os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) mkdir(&(0x7f0000000740)='./file0\x00', 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$llc(r1, &(0x7f0000000400)="14b8db6fb6dcc68a6381789cc035e4ff3882834fb405a9f63493f3dde275b17d380d644746ce56c27e818f095da3568ded49a2fd5d2877c7e6af2286528756f745ed7971a25560b85845a83b08373ff01339d4ae96e307e906877dbb98faa30d4e263a86e13d7b1405d1a1e6e31eb89da285758f168fbaebb3fada0522afa09af431c1f9201e2b37c710ddb66fdb1686ee7bb2f31c87d219a1c7da7d5288d51936a17acde6375154e0778b02ca4d862792369341e6649e19b3", 0xb9, 0x40000, &(0x7f0000000080)={0x1a, 0x30b, 0x1f, 0x9, 0x3, 0x9, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x10) mount(&(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)="7379736673002a864f4bc00bce1bdb20637213b1e894d120715f9dc1125b042c7226eb0136d9624ea1d23374a660fe5ac173722fd367ad22e8553025a2e8be0bc5514379af7213d32b8d5d06dc8fbf2c849ed9cdefc74b03dfa9cb5a90b28b4b24d7862c3d66fca53167d5424235435a3dbb76bc7d3c42fc2e9c696114a6f888f0da85277683cfc1c4d2bf71c2134d64cc3fed8e97798deb8631cbf7682c9fa2ed031465aa191df922f764297cba22a8499d177f49fba940f55bbc8b723fd374f1fed78c8aeec6811d9b5879487387d56594a14c2588274de84fa27610302b3fb54172a8c910a07e7c76ea465aa684020000", 0x0, &(0x7f0000000200)) chroot(&(0x7f00000003c0)='./file0\x00') r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000100)="2e650f983df3cf0f01751a6a000f320fae29670f01ca0f01dfbaf80c66b8114eeb8266efbafc0cec0f01c8", 0x2b}], 0x1, 0x0, &(0x7f0000000080), 0x0) 07:13:28 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x404c534a, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:28 executing program 5: r0 = open(&(0x7f00000001c0)='./bus\x00', 0x40, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000000)={0xac88, 0x2, 0x2, 0x0, 0x0, [{r0, 0x0, 0x81}, {r0, 0x0, 0x1ff}]}) r2 = syz_open_dev$sndmidi(&(0x7f0000000100)='/dev/snd/midiC#D#\x00', 0xe440, 0x1) write$cgroup_type(r2, &(0x7f00000000c0)='threaded\x00', 0xff4c) [ 251.449931] audit: type=1326 audit(251.448:509): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14737 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x455ab9 code=0x0 07:13:28 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_open_procfs(0x0, &(0x7f0000000100)='net/udplite\x00') syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x5, 0x2200) getrusage(0x1, &(0x7f0000000140)) syz_open_procfs(0x0, &(0x7f0000000080)='net/ipx\x00') 07:13:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000001880)={0x0, 0x0, 0x0, 0x0, @scatter={0x2, 0x0, &(0x7f0000000780)=[{&(0x7f00000003c0)=""/226, 0xe2}, {&(0x7f0000000580)=""/240, 0xf0}]}, &(0x7f0000000800), &(0x7f0000000880)=""/4096, 0x0, 0x0, 0x0, &(0x7f0000000240)}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x1000000000000085) ioctl$KVM_RUN(r2, 0xae80, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000000c0)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@remote}}, &(0x7f00000001c0)=0xe8) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x80000, 0x0) sendmsg$xdp(r4, &(0x7f00000007c0)={&(0x7f0000000200)={0x2c, 0x5, r3, 0x13}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000680)="640e08b226c6c08ef3c93a89a93828a1ae76dd53eb972926469e06eadeee9843c1f5d605ea57785c7a892d3f88fe2fd4419f52d03d039923b5486c6b52ad668aa39119c04fefdcf27888fabff683e6f116c9115c514004f7d4d2004d29b044d76c401c7e96a275d7600e3df32f0d3c62d867b1c726fa5d7f5c6b39ea73f9c2e02501eadd27075bbb9619745a8798cd3c71a184fe26cd6e70dc11e6b0c8c4d1772c66d478986b8e94d65bc44019f9be6d56705a2abe8dcea948cdfabe7ad2e86d3299508a42669b1ebd334aad14ed282cf2a8285e2c0f4da88013449980b83cf8b9d26c957b10dacf79c604cb1a8635dd17ae908e2f1b47ff845283655e", 0xfd}, {&(0x7f00000002c0)="3422bfa288a76a43cdd75d5b1d540baec38d76b57eca007f58d1300b25ca01fbdb66c6a4efd4dadc2eeb06314721e5022eefd8ee0be705f35f117d77cf420e60d087b42def3c43dbca3af1a57fe304c5725cef6d843bb4c6f6ac8d40d62ead60ad7c7a4a8af81275e8f70c54839cddb6edcea0d4105b78182654981ba13a", 0x2f5}, {&(0x7f0000001900)="932557e941d1839eb30c49b5dbe8d1223aa80cb00d637a8eb2b3db06eecc29ed2ef5cae62d3a2f05ad60f04abb5e5ea7d86033ed5234306531a12581ffc7fb363a825b42fb11a2ab8747ea526f4e9062a359e5942a9065163bb8b1650ca6340c5364b9b806159cea642f6e8ff78c9c400e115b994613cd98afe9af677f9800bd8631f8261c91f968cd27168817a644b71d4ed5a347a6b8cc90724c57ac42a6409de0ecb14eaf34512dce6d2c2bf7ab61449325be0097e3bec7f93a0536ed74a2095782323867c0e1bce5cf42e8e6ee791f74bf77f3c139dddf03e4113c4d0402298064a2944bfb42babfe717ea0e574e0f245ace36212139bc86fef63372352177e3a5a5be68d3d492af81d8a49f694a1d32782726456aa754fc78b507884e5cc5cbc1cc00fc406d073aad9bfd71b31b04f70626386d3e27d97f603d746ca33613187db283f4a908c640de18b10c045e0fa1332369f66f2108f280d4c669117188a544c3bb32eb20ac542d0ceca474717ef5e9b8dfd4830cc775161e57bb5d136d74e6d331b2a1626f0baef08178576e13f78c23e4a960a3b09a21d503e98fb2e9b69e60e5ad42d689c3bdfa6b9a6ad33246084add5dfdddd2411306ade433a41a16ffbb3a1072b3378dfd061fbd2252bab8e8116154afc0650f6834a13c65239bde17481e5e0506b53d5f016648fbc890a035e36c94ca5414eacb0ce1ec0932b4d6c849a310fd4f25c2b845171874641150d1b08dc35b33e60f26511ab2003ad1d16067636a2135e246a1f8980b4ec0b8b5394608b4c33619947b84c9aad260977e42901e4be2261ee6d4e4da52239105b4ec8d0dfc0ccf5c5e5b805327e89783668a75f4ed94222d52a85cbd978b4b1a9455512735c19dd3885b1bd81692a26649dc16f20fd9306cb7c0d17db6633674a06238076218d304948caeb77dae91f06f3988348754e7ea9aed9124944c320ccf4ac9f04bc37d8f3b28caa0a0a7be38ecfe0f5f7a48610c40d00a93492442b575b046ce08a9229ce7f57d9f207ba983b2de04a25bbd7ce77c977fdae5f3827171815eefd62a957902950c430d8898a87c518392a1e6f8238116f6048c4d4ec5da94c8e186cfc54960c8ee338cbb7ebb94820a184ea51818b5520f37092c20af914854299d480039c657dd469d0e78401d57cd9103f77df601ab669220f9e184f24d78b140859ead1cdc075710739a74aa59abf6e1d19f7ede370020bc7105cafc8db1ba5f94e81fa607afe50bf45117dc61564e67a2c8d88123598d8c31969a6d6f14833036b2b0cdf5353e20ec774ef153e52db06ade13e2ac3ebabcdbbd332492a37ea3a85dda6b6fb3fb3505d4d7509205fbdc6b70d2bc48146e141225b321a5dee3e3860fd7225f27c6f15d92b79c49e2f9706a182d4bd777f5f68f8fa110d6c3ae02fe6d1709519b696a98dc390fd2670c31adb45936fc01a7aee1badfb1c72fe18f7fb83a3688c3da38316765c595cfd8533907524766e7ac55de7637a4a5e45ec70f0a2781eaf44b9d2cc7fec7d967b22fa3fd3e99c8be2641659e187600c4625c580c67c10d8d529c53aeb84c3cf089af90aa616562f420cc7485ea465be76e5214b7afa42f52b221f743d72a63f11bdb95762ec09fa0bb34ccac075022690a129ebc5d5305ed045fecc914ddfd8e606557549885b1d08761b1f22b3a7f60e23980c73d6f63ff65a2535f24be9a879012c6d6af82c82d4b878020692da1ba3bbd7a3ff92ed8212b00b7786e8f3898edbc13f2c798f4dcde2927d13319d4514511436eacbaf98ff4a48880fedb980a4a03e9e908049b762fb59ca4ac83d9c3b2d0af3def81009da14e6c19a7dec027a929f08bf90a411c0dff7ae6dd160c63d78175d6ee47c4050827ff622915a9483f1b43f687bf01c4da3e209d398025c83edcc41d00d3a60cccaeda0e1b6af9936648557b8e7eb7121aa0eb19884d141d775874d90a29549581db4a30196d517335146a2d6d02b4675bde41a6d4207f8d8f63dcce3d869ee53dc9ac0dca5e1eb46d028f94bd09b9980efd4171bb6255afcee5040471758c08e0fbfc269d85e57542b3d9fea6756f83bcd6a81e5bb26f54e624fbe57db631ad393fd897fcca84f022dd8652c11d8765ad5c9651e5dea4bbc9246fc4bfbdcd32fdcba075c386ff0102aff0575159f8b44bcf62bba4907e16aef360c35578b896ab358a74f43f89d49f1e4181fa37966fb2b374203b4cbca40a3039c8ad5832070d6b92328226f805d44299a321c6bebafc97b6a072ffd9574a3e895a00d95a6b2f721b59ad0ce732faeb911d54fcd44dbaad69b9c0e29ada22e5018fb21642914a4b0850de1d1ced71b060c720711100eb5f5182d4bf51b03b441f92af57f6ff0588a63f6dae8731bc32611a680645c427a368c583ca238010c50ef755cb970c3562acf9bdf752df5f5f8f666ad36aacd55480e66cf96c54c7576b89a3d5c722a5b31a7f48bfa48b307b9b2aa61c56ede105ece0e81f348e02c09ae3a5c60b8bc49926ab2ee36d042120790849718d5493aebdccb042e7e13b82772ec6b4595e579f2f86793e170e2975c90f461da5031d2b55f3a296f9c591195e3bb0d258c170692ce2af73e4aa601e220060a2341031353cc54c57783d1717b1465d1b55b35e8517b57b0b09245a3427925f9b4f8a20cb17c7dd86cf9a03a929809f5599769b27c71097810a44041370fa99f4335091c532e566eb81f46fe7874e0fe4771928eac27a987e0791cb7f3ba652b01cd13e2526e0c09377c50e815061ee0e12117202b2832f7d5e89c866419c760cddb1ac207b3546d215c937d4389a8fbe68eb8820859a54bd6da2683284d88b573d2301e65aeea0c84c33ef0d4ad9b1440294b78e13b63f06d3a191925457ed5f5f1a89060ae20d84923ce92625ea7dd67a6e4f8fd55b5196b7299414801da436381534ffbd8a39e993fe33255a46c578cbde43f6c352bd26871ba3176c1f583737051e06bb12c1542fadced0e3e2bd2dd432dbd1abff4c4b587aed086f02a056cfa183c040bc46fa21b817baf87d0b1732fabfab400c06675b6fb9442b23b836c44b2a1047035d542515743ddb1e52ccfc40bb23f7b50c5ff05636098aa815ce9e73b1de8b357971d552cf55da3c7fad1b4b43597fd3eca7c672b19f9fa45ec25bcdbfdbbb7266ca58806fcaf5f4b3b99e28fdb4715a5363c0867a979b590ca0bf534bdaa25a59a56da8e687c53330825742aba826c89d27f909665128b2dff60929371f5396816286e4679f8aaa23846b947c3500c8da6063f29b798c8fbee8834fc3d0764254bdeb7f80009d24f36b59ddc94e7f0649dd75c479ce4f00631c65ace430d7ab71f1b58adb3dfb11e664c2fc9f45b2eaf52e5851ce47d82c544b8168e1999d5c41332d93fc653636b7f9b42640b247bafb5e084b2de1c93e9ab01b5026149ee2a2002ced89177fdbf611f735b556f2f67741fe8633973d3bc187dd2d76f8e8440c849d076ee84fe8c46a81fdf8c993074083953086f7e839d8cf373c175b215c5abb42c91bda203ef9f838f7f487ec53f3710e5c93e0c48fe8e60930ed2f9ad845d5572f6d02e6aa3d83bae73e0d553ad861373927222e18e44c539668d188e65c15ed088ab6b216c0f2087b2be9a38314dfec4f4aa83b00b7003618b4f76b479bef2a9bc6d4141c4d26d30c6f486acb00c25f53b205d8297c308e5ac3243d1fce961065d1c4a7004565b11c3af7e616b14593461c3095e971457e4b03aa27c06e886a4277f3315603cfb9d1f8b6f5eff2f95cc2a87d82db6cf00fe926fe3c80a48e5c3b7088278fb6658f5e47e9665c092a1bcf05f537d8132d17163c7069b44ba6efcc56167afb6996b9b8ff21f7358f65fe8b0fddeaf03e930c04be3985d901623cadea7f75f3500ac9f6e7586728c3b62afb0d47fed974be4462073b8a49a7198683996fff165be527c453e5e5a637352b8e39f8aafb78dcf76cc5c942cfabadb3078f015eaec5ff9897efe7a5758e22879fa7295a11d91bbfc857e75c094e6c605b19409deeba562933cc2652beaa5b76a533612d20bc0c7a1ee611a2c4716d6a46db783909acd4723a03eaeddb47c79f76b6fa7687f74e8fe83c8e8e6878382afbe5a7dbb86ddcdafa8103720120d27a06bb0483ef3e871e7ca16ff849acdd79ddc246a27646c5cdd938a604865d1a52d60ac0898bac1c12738e1e94d84ebeb4f70c01061e3cd52ab65bee5a5fe3a3f7be132e43ce47ebfe9a529d7e3968bdf8fbf04613a2e9f3ba4cb605f4813709ad6a8eb4be0fa36b5aef0b853b0a28f0a4b3138d23f4ea6cf3f9b9fa32018ba69fb91ad7abc09e38129dbc3c29f12ad53d997689e06f66fad9f03659d0835341dd3afe773b367dfd3bb0f211440030d0eba379c86754091113b34f443b507a5cc9f43bdecf85d5c386166367fe9793028be4a7190c6aa477f3b82b3b4c7a25a8a7926809901d56ff6ada0b8cd049f035cf292d6910367900cabbd2df12a248658875a421a892b9a4f58ff2ec4b0df14a6d41dad020d11611938ec40c3af80c0c312be29b701ea6d52091fd76c6d21c6e7f249ab2c1cef05d394d6a7534461ee104d128a1ea7864ba212d6083aec9e74ee56fb24584479e01bcf751478c7033c57fa17873218092f9dce04bf386990f94451ef2b644757533caa1d972e1443444bfa9a84b65362201822f6922ae7da87b72f5d094d3145657f112bfb471b95629604d7660791f0272fe982abc33d1e58fefc8ba746b8c4146f323085a3a08b65bccf9eb78a1dc124d741aeeda8de36901df63643af52a6afc88d9fc480d36cdbe90c4dc521585479ce4b9826e0bf728d9af3794c7b7561cee975ac2b0015e6b78d47752877aea5239c822a32ee9600fa9c0a2b5411062e8e2d7c2b544aaf56968efa0a207f1ddde912f79a067d0ab6676520ca41ba41cf21910247bea510d9abbe5361f1139b91c804676dbf9dead7f48dcea78035958553eb5a231d385ce9b6254a1733535c3cebc7d5e674a91394eada241e81aea684560d215874f79e4b3626a4fde7b41f09187a659bf6d4a2f03e93ccbabaf69a10c4cb8de1ec4819121a039862414631aff55f243af3deed9764f2451948a036212bdbfb59d1e3d6bdb93fa7d7c78830ff79b36ffa8436463f85b0fe0860e6c8c4806472e1421dc188909bbf93a0ffa93637d994516263a380b0b58064ebdc17b7f218c1a1352f15e390613aeafcffd3453589f896b06b0312f571b4e40badb84fb65ec1766de7f64bcd99dfc8084c7e5256ef93a29b3dc3ef7f54c96baaf729554d2495bb5ece2f5540e09ba163439fa1c5cf41bb04c3442436ae5129f2f48b3b9e63b1956ed9c271207be800b209612fc4acda78f7ce1761909a32f7193064bd4614b426aa1429d457fd885dc5839903e66f2d08b4d21965233870501a049324ecbd511cff4b4691107ba656d9528cd5c2d791861cc8d69df060febcba85b011bbc4c448b3cad219ff6f19cc5b50a965cef9e0aa823b84cff20b1ec34c1edf942c23d0f718a8899a8b705b82bec458f8dca35b151c39e8493fcfe8b8e0e2451eb558f58f987e091616c58ce67c7ddc4ee7db9b6d64624d6ee28cfcd221a5b3e7b477ba7e3a50f678dfc5106c6e196eed27080dbf2f3c2e8659c3c013775af31e1ae48f68336e9aafd87ba29e8cf34ba32398bccc9c0e40ace03469d82cd8a55e9b3b6b6ccb1aba0ba17e2379a1a1a9aec8108df483f4eacd0d2aa73c11b837ef5d40c82ec39724a", 0x1000}, {&(0x7f0000000340)="aa46366370e5dc04db", 0x9}], 0x4}, 0x20004000) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 251.521120] binder: release 14787:14796 transaction 501 out, still active [ 251.528135] binder: unexpected work type, 4, not freed [ 251.533439] binder: undelivered TRANSACTION_COMPLETE 07:13:28 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msxos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:28 executing program 3: clone(0x0, &(0x7f00000000c0), &(0x7f0000000140), &(0x7f00000001c0), &(0x7f0000000040)) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x5, 0x410080) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000180)={r1, 0x0, 0xff, 0x7, 0x4df5a98f}) clone(0x0, &(0x7f0000000400), &(0x7f0000000380), &(0x7f0000000040), &(0x7f0000000240)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='children\x00') pread64(r2, &(0x7f0000000040)=""/12, 0x10000, 0x10b) ioctl$RTC_EPOCH_READ(r0, 0x8008700d, &(0x7f0000000200)) setsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000100), 0x10) [ 251.583816] binder_alloc: binder_alloc_mmap_handler: 14787 20001000-20004000 already mapped failed -16 [ 251.595659] binder: BINDER_SET_CONTEXT_MGR already set [ 251.605125] binder: 14787:14796 ioctl 40046207 0 returned -16 [ 251.616648] binder_alloc: 14787: binder_alloc_buf, no vma [ 251.622459] binder: 14787:14806 transaction failed 29189/-3, size 24-8 line 2967 07:13:28 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x3fffe, 0x0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000040)=""/81) writev(r0, &(0x7f0000e11ff0)=[{&(0x7f0000299f3e)="580000001400192340834b80040d8c560a067fffffff81004e220000000058000b4824ca944f64009400050028925aa8f70000000000008000f0fffeffff090000dc2abbeabdcb9509000100060c0900fcff0000040e05a5", 0x58}], 0x1) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000000)={0x0, 0x33, "303666dc921c6b5fac890138b92bfd9692bd4e0087abe15cc7a0d0a7a2eb5e26f037c215e76127907ebd24d5fdc41ea7732955"}, &(0x7f00000000c0)=0x3b) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000200)) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={r2, @in6={{0xa, 0x4e20, 0x5, @mcast2={0xff, 0x2, [], 0x1}, 0x8}}, 0x2, 0x1, 0x6, 0x9, 0x8a}, 0x98) 07:13:28 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x7400, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:28 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000040)={0x6bc, 0x204, 0x8a58, 0x9b1, 0x0}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000000c0)={r1, 0xa3}, &(0x7f0000000100)=0x8) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KDGKBLED(r3, 0x4004510f, &(0x7f0000000180)) [ 251.640467] binder: undelivered TRANSACTION_ERROR: 29189 [ 251.646389] binder: send failed reply for transaction 501, target dead 07:13:28 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x8, &(0x7f0000000040)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000080)=0x10) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) [ 251.784015] binder: release 14825:14832 transaction 506 out, still active [ 251.791058] binder: unexpected work type, 4, not freed [ 251.796361] binder: undelivered TRANSACTION_COMPLETE [ 251.812259] *** Guest State *** [ 251.815677] CR0: actual=0x0000000000000031, shadow=0x0000000060000031, gh_mask=fffffffffffffff7 [ 251.824547] CR4: actual=0x0000000000002060, shadow=0x0000000000000020, gh_mask=ffffffffffffe871 [ 251.825964] binder_alloc: binder_alloc_mmap_handler: 14825 20001000-20004000 already mapped failed -16 [ 251.833393] CR3 = 0x0000000000002000 [ 251.833406] PDPTR0 = 0x0000000000000000 PDPTR1 = 0x0000000000000000 [ 251.833416] PDPTR2 = 0x0000000000000000 PDPTR3 = 0x0000000000000000 [ 251.833422] RSP = 0x0000000000000f80 RIP = 0x0000000000000000 [ 251.833436] RFLAGS=0x0020c202 DR7 = 0x0000000000000400 [ 251.871565] Sysenter RSP=0000000000000f80 CS:RIP=0050:0000000000002810 [ 251.878252] CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 [ 251.886248] DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 251.894244] SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 251.899140] binder: BINDER_SET_CONTEXT_MGR already set [ 251.902235] ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 251.902256] FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 251.923499] GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 251.928927] binder_alloc: 14825: binder_alloc_buf, no vma [ 251.931486] GDTR: limit=0x000007ff, base=0x0000000000001000 [ 251.931503] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 251.931514] IDTR: limit=0x000001ff, base=0x0000000000003800 [ 251.931530] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 251.931538] EFER = 0x0000000000000001 PAT = 0x0007040600070406 [ 251.931548] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 07:13:29 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socket$inet(0x2, 0x0, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local={0x1, 0x80, 0xc2}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0xe805, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast=0xffffffff}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) recvmmsg(r0, &(0x7f0000001440)=[{{&(0x7f0000000000)=@can, 0x80, &(0x7f0000000180)=[{&(0x7f0000000080)=""/232, 0xe8}], 0x1, &(0x7f00000002c0)=""/147, 0x93, 0x4}, 0x2}, {{&(0x7f00000001c0)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f00000013c0)=[{&(0x7f00000003c0)=""/4096, 0x1000}], 0x1, &(0x7f0000001400)=""/7, 0x7, 0x4}, 0x319d}], 0x2, 0x100, 0x0) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f00000014c0), &(0x7f0000001500)=0x18) 07:13:29 executing program 5: mkdir(&(0x7f0000000200)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r0, &(0x7f00000003c0)='./file0\x00', r0, &(0x7f0000000280)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x2) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$notify(r1, 0x402, 0x1) socket$inet6(0xa, 0x800, 0x4) 07:13:29 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms0os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:29 executing program 3: r0 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x9c1f, 0x40) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, r0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x6, 0x40) r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x4010, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)={r3}) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000000)=0x2, 0x4) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x40010, r2, 0x0) [ 251.931556] Interruptibility = 00000000 ActivityState = 00000000 [ 251.931559] *** Host State *** [ 251.931570] RIP = 0xffffffff811f4fc4 RSP = 0xffff88019816f350 [ 251.931589] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 251.931604] FSBase=00007f0bf0da3700 GSBase=ffff8801daf00000 TRBase=fffffe0000034000 [ 251.937174] binder: 14825:14839 transaction failed 29189/-3, size 24-8 line 2967 [ 251.945129] GDTBase=fffffe0000032000 IDTBase=fffffe0000000000 [ 251.989379] binder: 14825:14832 ioctl 40046207 0 returned -16 07:13:29 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x2, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:29 executing program 0: r0 = socket$inet6(0xa, 0xc1000000000002, 0x40000000008) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@local={0xfe, 0x80, [], 0xaa}, 0xfffffffffffffff9, 0x1, 0x0, 0x1, 0xb9, 0x1000, 0xc1}, &(0x7f0000000040)=0x20) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ppp\x00', 0x2080, 0x0) ioctl$sock_bt_hci(r1, 0x400448e7, &(0x7f0000000200)="0a57e3a45e02a016745f2935fbfbae6a17c0f2a8fefad370033e57eb6e5770c12adb0308a742573cc51e38111894e5afccfc64774b91ef3ffc55ee8f07306c69ddc0ae937e09e06aaad580b31e909b02e6371a99c1a91d5f569fb466b8f8563b05ea0d479b69c08d4493711e425f37745b11a30026b072cb6d06f6ba0bf695fcd8fe2578cfa419acd686ae43c4065439c4148b706b1f55c8d980f2658bbcf78b38199a73851243de8beab62349e9cb785a7b46781eeba7eeb732848bc494a29a3f8b1ce3e3b889039f914fe076ba5c32d7b84e3f9b362266c54e1357a61d525c5d7d93") ioctl(r0, 0x8912, &(0x7f00000000c0)="2070e6ab6b9cd6f43222e304510c29aac35d850f5288460fcad69feb8e61178b8eec652a8ceba1a3970ee5927b6599ce4a74ff479926966b62ccb874a3786dcbbb5880306caded73f171d3141d1c0341792a98524736992e575a8d900f39736895693ff341d5f83104b99e854147f8e3c602a52ca115505727b17f465d0bc129bf5af4a4edc0b0bb6b607d14f3f14b13a554d2e0d87eb8048ea3afac8478ae7d4fb0c5cde540d06ed05f379ae174ceb5fc4bc4c3f332e9500600bded5165abf285808ab9758d1501927680f03d862217b1280dd943696afa021c664b0b3a469347ac5546a9d5ad19b093") r2 = creat(&(0x7f0000001380)='./file0\x00', 0x0) write$binfmt_elf32(r2, &(0x7f0000000580)=ANY=[@ANYBLOB='\x00'], 0x1) ioctl$fiemap(r2, 0x40086602, &(0x7f0000000540)=ANY=[@ANYBLOB="8b"]) write$cgroup_type(r2, &(0x7f0000000080)='threaded\x00', 0x1ec) [ 251.992332] CR0=0000000080050033 CR3=00000001cccf2000 CR4=00000000001426e0 [ 251.992347] Sysenter RSP=fffffe0000033200 CS:RIP=0010:ffffffff87a01380 [ 251.992357] EFER = 0x0000000000000d01 PAT = 0x0000000000000000 [ 251.992360] *** Control State *** [ 251.992368] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca [ 251.992373] EntryControls=0000d1ff ExitControls=0023efff [ 251.992387] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 252.001621] binder: send failed reply for transaction 506, target dead [ 252.005509] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 252.005517] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 252.005525] reason=80000021 qualification=0000000000000000 [ 252.005531] IDTVectoring: info=00000000 errcode=00000000 [ 252.005537] TSC Offset = 0xffffff76274ad209 [ 252.005544] EPT pointer = 0x00000001adfa601e [ 252.015728] *** Guest State *** [ 252.029993] binder: undelivered TRANSACTION_ERROR: 29189 [ 252.032771] CR0: actual=0x0000000000000031, shadow=0x0000000060000031, gh_mask=fffffffffffffff7 [ 252.032783] CR4: actual=0x0000000000002060, shadow=0x0000000000000020, gh_mask=ffffffffffffe871 [ 252.032793] CR3 = 0x0000000000002000 [ 252.145538] PDPTR0 = 0x0000000000000000 PDPTR1 = 0x0000000000000000 [ 252.152049] PDPTR2 = 0x0000000000000000 PDPTR3 = 0x0000000000000000 [ 252.158541] RSP = 0x0000000000000f80 RIP = 0x0000000000000000 [ 252.164521] RFLAGS=0x0020c202 DR7 = 0x0000000000000400 [ 252.170503] Sysenter RSP=0000000000000f80 CS:RIP=0050:0000000000002810 [ 252.177176] CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 [ 252.185154] DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.193142] SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.201121] ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.209098] FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.217075] GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.225056] GDTR: limit=0x000007ff, base=0x0000000000001000 [ 252.233041] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 252.241027] IDTR: limit=0x000001ff, base=0x0000000000003800 [ 252.248999] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 252.256979] EFER = 0x0000000000000001 PAT = 0x0007040600070406 [ 252.263396] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 252.270876] Interruptibility = 00000000 ActivityState = 00000000 [ 252.277106] *** Host State *** [ 252.280315] RIP = 0xffffffff811f4fc4 RSP = 0xffff88019816f350 [ 252.286294] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 252.292716] FSBase=00007f0bf0da3700 GSBase=ffff8801daf00000 TRBase=fffffe0000034000 [ 252.300513] GDTBase=fffffe0000032000 IDTBase=fffffe0000000000 [ 252.306401] CR0=0000000080050033 CR3=00000001cccf2000 CR4=00000000001426e0 [ 252.313423] Sysenter RSP=fffffe0000033200 CS:RIP=0010:ffffffff87a01380 [ 252.320094] EFER = 0x0000000000000d01 PAT = 0x0000000000000000 [ 252.326151] *** Control State *** [ 252.329606] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca [ 252.336271] EntryControls=0000d1ff ExitControls=0023efff [ 252.341740] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 252.348671] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 252.355334] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 252.361911] reason=80000021 qualification=0000000000000000 [ 252.368227] IDTVectoring: info=00000000 errcode=00000000 [ 252.373674] TSC Offset = 0xffffff76274ad209 [ 252.377992] EPT pointer = 0x00000001adfa601e [ 252.416294] *** Guest State *** [ 252.419690] CR0: actual=0x0000000000000031, shadow=0x0000000060000031, gh_mask=fffffffffffffff7 [ 252.428581] CR4: actual=0x0000000000002060, shadow=0x0000000000000020, gh_mask=ffffffffffffe871 [ 252.437437] CR3 = 0x0000000000002000 [ 252.441187] PDPTR0 = 0x0000000000000000 PDPTR1 = 0x0000000000000000 [ 252.447703] PDPTR2 = 0x0000000000000000 PDPTR3 = 0x0000000000000000 [ 252.454216] RSP = 0x0000000000000f80 RIP = 0x0000000000000000 [ 252.460193] RFLAGS=0x0020c202 DR7 = 0x0000000000000400 [ 252.466182] Sysenter RSP=0000000000000f80 CS:RIP=0050:0000000000002810 [ 252.472867] CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 [ 252.480874] DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.482362] binder: release 14861:14872 transaction 511 out, still active [ 252.488878] SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.488896] ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.488912] FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.488929] GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 252.488942] GDTR: limit=0x000007ff, base=0x0000000000001000 [ 252.488963] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 252.495900] binder: unexpected work type, 4, not freed [ 252.503871] IDTR: limit=0x000001ff, base=0x0000000000003800 [ 252.503887] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 252.511849] binder: undelivered TRANSACTION_COMPLETE [ 252.529874] binder: 14861:14872 unknown command 81924 [ 252.535832] EFER = 0x0000000000000001 PAT = 0x0007040600070406 [ 252.535842] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 252.535852] Interruptibility = 00000000 ActivityState = 00000000 [ 252.535855] *** Host State *** [ 252.535866] RIP = 0xffffffff811f4fc4 RSP = 0xffff880195c4f350 [ 252.535885] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 252.565683] binder: 14861:14872 ioctl c0306201 200007c0 returned -22 [ 252.570207] FSBase=00007f0bf0d82700 GSBase=ffff8801daf00000 TRBase=fffffe0000034000 [ 252.570218] GDTBase=fffffe0000032000 IDTBase=fffffe0000000000 [ 252.570230] CR0=0000000080050033 CR3=00000001cccf2000 CR4=00000000001426e0 [ 252.570248] Sysenter RSP=fffffe0000033200 CS:RIP=0010:ffffffff87a01380 [ 252.576615] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x1 [ 252.581862] EFER = 0x0000000000000d01 PAT = 0x0000000000000000 [ 252.604254] binder_alloc: binder_alloc_mmap_handler: 14861 20001000-20004000 already mapped failed -16 [ 252.604739] *** Control State *** [ 252.616367] binder: BINDER_SET_CONTEXT_MGR already set [ 252.617639] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca [ 252.617646] EntryControls=0000d1ff ExitControls=0023efff [ 252.617659] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 252.617667] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 252.617675] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 252.617683] reason=80000021 qualification=0000000000000000 [ 252.617688] IDTVectoring: info=00000000 errcode=00000000 [ 252.617699] TSC Offset = 0xffffff76274ad209 [ 252.638593] binder_alloc: 14861: binder_alloc_buf, no vma [ 252.645074] EPT pointer = 0x00000001adfa601e [ 252.709156] binder: 14861:14872 ioctl 40046207 0 returned -16 [ 252.713602] binder: 14861:14882 transaction failed 29189/-3, size 24-8 line 2967 [ 252.729360] binder: 14861:14889 unknown command 81924 [ 252.755218] binder: 14861:14889 ioctl c0306201 200007c0 returned -22 07:13:30 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4058534c, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:30 executing program 5: r0 = socket$kcm(0x29, 0x7, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000280)={'ip6_vti0\x00', &(0x7f0000000240)=@ethtool_sfeatures={0x3b, 0x5, [{0x8, 0x3}, {0x4, 0x9}, {0x0, 0x7fff}, {0xffff, 0x100000000}, {0x3}]}}) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) r1 = dup2(r0, r0) bind$vsock_dgram(r1, &(0x7f0000000080)={0x28, 0x0, 0x2711, @hyper}, 0x10) r2 = syz_open_dev$sndctrl(&(0x7f0000000200)='/dev/snd/controlC#\x00', 0x4, 0x2800) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x40800, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2f, &(0x7f00000000c0)={0x100000001, {{0xa, 0x4e24, 0x4, @mcast2={0xff, 0x2, [], 0x1}, 0xfffffffffffffffd}}, {{0xa, 0x4e21, 0x1000, @local={0xfe, 0x80, [], 0xaa}, 0x17}}}, 0x108) perf_event_open(&(0x7f0000001000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r2, 0xc4c85513, &(0x7f0000001000)) 07:13:30 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms.os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:30 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = request_key(&(0x7f0000000040)='rxrpc\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000000c0)='fuse\x00', 0xfffffffffffffffc) keyctl$get_keyring_id(0x0, r0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d}, 0x2c, {'group_id', 0x3d}, 0x2c}) read$FUSE(r1, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x102480}}, 0x50) 07:13:30 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mremap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000000000/0x2000)=nil) ioctl$VHOST_GET_FEATURES(r0, 0x80044df9, &(0x7f0000000100)) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=0x0) r3 = getpid() tgkill(r2, r3, 0x41) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x3000001, 0x12, r1, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x400081, 0x80) 07:13:30 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6000000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 252.791757] binder: send failed reply for transaction 511, target dead [ 252.800482] binder: undelivered TRANSACTION_ERROR: 29189 07:13:30 executing program 0: r0 = memfd_create(&(0x7f0000000300)="0000000010573860b48e03ab0b8110408d893dac540318386fc7e2d740bd31e757e1ae2e3d919d036f2e3d2a17abca4287afd240c0f4b24d623af9f16312755a71654bf931e5704191541d13f5762dadc275e112a8030bf0621fa161bc744923b22b21b6ababbc86cdc1e0a0569fbd31345e7978c3c7175089f36fc12006e0575ef969c45e8fb854b36f9a3319fb30c0a76fe0f7a3ccb89b7c7bbede0de110c40d2ed349c687122fa098892b87a16cc3540fdf9cb289a4509aaddcb1e389bf2239dcd6c886587dcefea2204935721c83bacd0f177f5f229407ced0623ac9e98abb967cf5fd5b867eb063f3ba1e0e046aeb0da0312d171f4aa734acc712e6f7273a832227698f5c25fc87f25e961c3fdc9d4e0f2a1ec6a0ef46662046e9ff54f225e07b831d6bc401043f360748cdbb1e750d1d3de8f0b8bddb94362933c22f69bc71c1d69edc4c49f191925f48b6c41c1fd5deebe6981ea2b653f17d8ead11da91fdc4f377722ce6332852d3101c063105191e585ba7cbd3fe352a3e1889c84f626500000000ff2e70", 0x2) write(r0, &(0x7f0000000100)="885ab5c21e27", 0x6) sendfile(r0, r0, &(0x7f0000000040), 0x7fffffff) fcntl$addseals(r0, 0x409, 0x8) fremovexattr(r0, &(0x7f0000000080)=@known='system.posix_acl_default\x00') clone(0x0, &(0x7f0000000080), &(0x7f0000000000), &(0x7f0000000140), &(0x7f0000000180)) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") write$P9_RLOPEN(r0, &(0x7f00000000c0)={0x18, 0xd, 0x1, {{0x2, 0x0, 0x7}, 0x80}}, 0x18) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000180)={{0x3, 0x3, 0x8d, 0x2, 0x10000}, 0x0, 0x0, 0x101}) 07:13:30 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xf, &(0x7f0000000100)=@req3, 0x1c) close(r0) 07:13:30 executing program 5: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40046302, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), &(0x7f00000002c0)}}], 0x0, 0x0, &(0x7f00000003c0)}) 07:13:30 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x21, &(0x7f0000000000)=0x10000, 0x4) socket$kcm(0x29, 0x2, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) ioprio_get$pid(0x2, r3) sendto$inet6(r2, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) [ 252.967240] binder: release 14907:14919 transaction 516 out, still active [ 252.974334] binder: unexpected work type, 4, not freed [ 252.979704] binder: undelivered TRANSACTION_COMPLETE [ 252.987545] binder_alloc: binder_alloc_mmap_handler: 14907 20001000-20004000 already mapped failed -16 [ 252.999491] binder: BINDER_SET_CONTEXT_MGR already set [ 253.010862] binder: 14907:14919 ioctl 40046207 0 returned -16 [ 253.014113] binder_alloc: 14907: binder_alloc_buf, no vma [ 253.022367] binder: 14907:14921 transaction failed 29189/-3, size 24-8 line 2967 [ 253.038382] binder: send failed reply for transaction 516, target dead [ 253.050120] binder: undelivered TRANSACTION_ERROR: 29189 [ 253.153670] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 07:13:30 executing program 6: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='memory.high\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=ANY=[@ANYRESOCT, @ANYRESOCT], 0x2e) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000080)={0x0, 0x11, "94ef66cf3343496512c5fe3e4dd280c788"}, &(0x7f00000000c0)=0x19) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x2, 0x6, 0x8000, 0x8, 0xfff, 0x4eab, 0x0, 0xffffffffffff0000, r2}, &(0x7f0000000180)=0x20) 07:13:30 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:30 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msXos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:30 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x2000105082) r2 = memfd_create(&(0x7f0000000040)="003fcc78ff0b9e", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f00000000c0)='S', 0x1}], 0x1, 0x4081003) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r1) fallocate(r1, 0x11, 0x0, 0x100000001) 07:13:30 executing program 1: syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000200)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x2, 0x1) mknodat(r0, &(0x7f0000000040)="2e2f636f6e74726f6cff05", 0x0, 0x0) mkdirat(r0, &(0x7f0000000100)='./file1\x00', 0x0) renameat2(r0, &(0x7f0000000240)='./:ile0\x00', r0, &(0x7f0000000280)='./:ile0\x00', 0x0) 07:13:30 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c000001000000000070") syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f00000001c0)="bd", 0x1, 0x100000001}], 0x0, &(0x7f0000000380)={[{@sunit={'sunit', 0x3d}, 0x2c}]}) [ 253.388193] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x1 [ 253.454271] binder: release 14957:14962 transaction 521 out, still active [ 253.461344] binder: unexpected work type, 4, not freed [ 253.466637] binder: undelivered TRANSACTION_COMPLETE [ 253.475661] binder_alloc: binder_alloc_mmap_handler: 14957 20001000-20004000 already mapped failed -16 [ 253.485925] binder_alloc: 14957: binder_alloc_buf, no vma [ 253.491684] binder: 14957:14963 transaction failed 29189/-3, size 24-8 line 2967 [ 253.498285] binder: BINDER_SET_CONTEXT_MGR already set [ 253.505322] binder: undelivered TRANSACTION_ERROR: 29189 [ 253.517091] binder: 14957:14962 ioctl 40046207 0 returned -16 [ 253.524911] binder: send failed reply for transaction 521, target dead [ 253.627329] XFS (loop3): Invalid superblock magic number [ 253.723840] XFS (loop3): Invalid superblock magic number 07:13:31 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x40a85323, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:31 executing program 5: socketpair(0xa, 0x89b1dcb8205c6850, 0x0, &(0x7f0000004500)={0xffffffffffffffff}) setsockopt$RDS_RECVERR(r0, 0x114, 0x5, &(0x7f0000004540)=0x1, 0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffefffffffffff, 0xffffffffffffffff, 0x2) signalfd4(r0, &(0x7f0000000080)={0x8}, 0x8, 0x80800) syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a40200010000100000000000000000000000000c0908040c", 0x7d}], 0x0, &(0x7f0000000140)) 07:13:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:31 executing program 1: r0 = socket$inet6(0xa, 0x400000001, 0x20000000000) ioctl(r0, 0x7f, &(0x7f0000000180)="295ee1311f16f477671070") r1 = creat(&(0x7f00000000c0)='./file0\x00', 0xfffffffffffffffe) fchownat(r1, &(0x7f0000000080)='\x00', 0x0, 0x0, 0x1000) 07:13:31 executing program 6: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x4000, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x37, &(0x7f00000000c0), &(0x7f0000000100)=0x4) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14}}, @icmp=@parameter_prob={0x5, 0x2, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x5c, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14}}}}}}}, &(0x7f0000000000)={0x0, 0x0, [0x0, 0x2]}) 07:13:31 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msuos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 254.032264] binder: release 15027:15031 transaction 526 out, still active [ 254.039272] binder: unexpected work type, 4, not freed [ 254.044667] binder: undelivered TRANSACTION_COMPLETE [ 254.065153] binder_alloc: binder_alloc_mmap_handler: 15027 20001000-20004000 already mapped failed -16 [ 254.096751] binder: BINDER_SET_CONTEXT_MGR already set [ 254.112410] binder: 15027:15031 ioctl 40046207 0 returned -16 [ 254.126272] binder_alloc: 15027: binder_alloc_buf, no vma [ 254.131881] binder: 15027:15038 transaction failed 29189/-3, size 24-8 line 2967 [ 254.149380] XFS (loop5): Mounting V4 Filesystem [ 254.158668] binder: undelivered TRANSACTION_ERROR: 29189 [ 254.164834] binder: send failed reply for transaction 526, target dead [ 254.171766] XFS (loop5): totally zeroed log [ 254.182319] XFS (loop5): Metadata corruption detected at xfs_agi_verify+0x188/0x5a0, xfs_agi block 0x2 [ 254.191930] XFS (loop5): Unmount and run xfs_repair [ 254.196982] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 254.203672] 00000000667426df: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.212550] 000000004ef3ab75: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.221401] 00000000997fa0d5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.230275] 00000000728bf244: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.239125] 00000000aa036656: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.247989] 0000000089c7517b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.256841] 0000000006943f36: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.265816] 00000000c3cbd2e3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.274766] XFS (loop5): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x2 len 1 error 117 [ 254.284161] XFS (loop5): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -117, agno 0 [ 254.292814] XFS (loop5): Failed to read root inode 0x80, error 117 07:13:31 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ntfs(&(0x7f0000000200)='ntfs\x00', &(0x7f0000000240)='./file0\x00', 0x0, 0x3, &(0x7f0000000280)=[{&(0x7f0000000440)="5971f4d7fddc8ea66f62c49049d70889f5dc50f9e535bb0634ed3a653723c111e6ac53c24d655f4d4eb38c2005dc5b1abd4da4de2cfef714494fd3f91b67f0f0e6cf14760d6e922c011a453e5e83435c8f14bc08ccaa58ba611f68d35b652af51de2418cce8a035c1e158cb76f52849e4f39c0ef2f811d81cb41c62edcca7d8fa687a2b6cf43267e2e47c806a629ff0e07946b6eaa0dc1e53c5ff71d7987580afd3a785a1d5518fe6bb376929693c43951ee7c3d781a72f8692eab96ee6d628b9bfb11f15ece2a56412ade606fe0934d1e7206f941b3bef1b4", 0xd9, 0x80}, {&(0x7f0000000040)="b355f333c70122b115673319792219", 0xf}, {&(0x7f0000000140)="5d07d7f2537dd03950c457756bdb0522a319ce9ae4c6dd78d3cd309477dee44478f867fca65801671967c16a37619de55b6b78ff5a415bf22eb7a6e38451", 0x3e, 0x2}], 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="73686f775f7379735f66696c65733d7965732c64697361626c655f7370617273653d6e6f2c666d61736b3d30303030303030303030303030303030303030303030312c6572726f72733d636f6e74696e75652c6572726f72733d72656d6f756e742d726f2c00f611b8699d6a1769122954ec80f2ace872072d1081f4a46fe0a52ff481cd2d27086f384f44c943624fd79b57e729bf97b722cda9b16dbbe522b41e074fc83efb8210793e6e1d54a33106154134719ae203e5"]) r0 = inotify_init() syncfs(r0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x97a2541dfe24b94f, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)={[{0x2b, 'pids', 0x20}, {0x2f, 'memory', 0x20}, {0x2b, 'cpu', 0x20}]}, 0x13) inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x100) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x20000000) 07:13:31 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = accept4(r1, 0x0, &(0x7f00000003c0), 0x80800) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000001980)=0x309, 0x4) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x9d5ba2d8201dca0b}, 0xc) sendmsg$alg(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)="4a282f3f4f98a2916d79dc1d6d88a2a657b17448c49101f59b03700092fc1a5765a5c417791284211d225152b5579d0bd8edb98bbf2bcb6eec3184114e51971a0c55bcd2a65ee6c2cc83fc008d1ff501b98c8cca1f6e641967635bfdb2d18520601bbfa5e4e97877ef6b7370e8d6c66f20ef5521a4bca58e0095480ba30cac3a60fef31d2334b086876cf122d6c11371497532554e0fc5132a362bdfdd070d1b16232109b363e6de863b29b10e006bf520684789963c19b39ea510b7c4447d6fbf6f0b52244bb0b531864073079d40a75741734b129fa8959c9d67146fe9cf5786052b750442ad5f1f5d818cdec1343a9ebe7b729597bbdb215cbe2aa14e", 0xfe}, {&(0x7f00000002c0)="415de2f94fc34aa547398277c49ab80d6ae62264dc2f2c94c5794e26f3c5648d7d8d7cdeff85625832afd512c0595d2eb249166702471e0c3c82e7b8c4492e4ce39bec54f0ffdbcdc6bc6cf58448080224636700ab2aa4920958b49cb9fa8f1ecd80cbc394e909545094cf299e3932bfff40cad92caa1dbc1b35435f1388e68adbd7f1a600e3b571e2e2", 0x8a}], 0x2, &(0x7f00000006c0)=[@iv={0x110, 0x117, 0x2, 0xfa, "182ec8449153be7c6db59bebd82b53ef578498ec77492fdb3f874ee425fa577ef09390ce7c11a1fa0f316fc9909bedaa6468fd6efd133d337402805939f87e7ce4c5d4cbdd4ca1a26de78285e79f11b740bfad3d794b140f682b3971b6591939d8c34842eac6bebe113fff4655ed5fe339921773b79ba41f51a5eaa752915eb10c0fc4480c6c9fd1f4338d4e79f04be611f0dbd5f0a3382585f1864f1dd1590dd7ddf833ed1b92942124b508a2a4cbe5aaba19a71f7187cf9b49c15f9ce8fe84663e955458bf1dc89719fea919148047532b54a2b7984dbc110be67522245ba0e6cf41c98f5495dea458c0956125b8919764c35743ebb0cb3adf"}, @assoc={0x18, 0x117, 0x4, 0xfda2}, @iv={0xe8, 0x117, 0x2, 0xd1, "cc52a2a366f3a2db9a1c076deb9aeaf03a8148f1b29c78f72055a8e310630be5ad4942a2e34c96f67f78df0c5336b2658918ea7ba4dfb266625ccb53bd1f12bab9cb340a4a8bfc45a5b9dde3b9f1ef12fd2829dad8a45ca8b38200b6f1028c881128399f57194fbd663450fce451f54ead9c454d68b15555585404a2d9a109f4b558bef7b5a26b960ece707c1b166d581d54027a7401551630f23e526427e78f4bcec123599bbe07a1b094dd096d382fc9f2b37fa541e764d8058368358b3cb62c62f0f707eb01eba289c6c3218ea31b09"}, @op={0x18, 0x117, 0x3, 0x1}, @iv={0xa8, 0x117, 0x2, 0x8d, "b1394eb87fe7c5e2818b5a0c68e789e91e734c1fc815b6ee11532ed356ba82e743e17b2a5a8a0abd07bcc6254c42e6fd775a65e954b1ad99185e105c77ebe49d416ad5eb461494cc8aa1a54e5572873e2229afd4f7f5ef0299d7720cead0283f771fd62c625d8246331fbf04f33b4ded37a345631ff6702bad165ed48ffe3fbee8a6274a45ae8e6bddc4c5b1cf"}, @assoc={0x18, 0x117, 0x4, 0x9}, @op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x1}], 0x318, 0x80}, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000005c0)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in6=@loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@mcast2={0xff, 0x2, [], 0x1}, 0x0, 0x32}, 0x0, @in6=@loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x90, 0xffffffffffffffff, 0x4}}, 0xe8) sendmsg(r1, &(0x7f0000001700)={0x0, 0x0, &(0x7f0000001680)}, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x1ff, 0x50881) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f0000000100)={0x101ff, 0x0, &(0x7f0000ffc000/0x3000)=nil}) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000040)={0x7}, 0x4) 07:13:31 executing program 6: r0 = socket$rds(0x15, 0x5, 0x0) close(r0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fchdir(r0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r1}) r2 = gettid() syz_open_procfs$namespace(r2, &(0x7f0000000040)='ns/pid\x00') 07:13:31 executing program 1: r0 = socket$inet6(0xa, 0x801000000000002, 0x7ff) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$BLKALIGNOFF(r3, 0x127a, &(0x7f0000000080)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local={0xac, 0x14, 0x14, 0xaa}, @rand_addr}, 0xc) setsockopt$inet_tcp_int(r4, 0x6, 0x1, &(0x7f0000000000), 0x1f1) r5 = inotify_add_watch(r3, &(0x7f00000000c0)='./file0\x00', 0x200) inotify_rm_watch(r3, r5) close(r4) dup3(r1, r2, 0x0) 07:13:31 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms+os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x7a000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 254.378375] XFS (loop5): Mounting V4 Filesystem [ 254.388396] XFS (loop5): totally zeroed log [ 254.394549] XFS (loop5): Metadata corruption detected at xfs_agi_verify+0x188/0x5a0, xfs_agi block 0x2 [ 254.404218] XFS (loop5): Unmount and run xfs_repair [ 254.409273] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 254.415979] 000000004d904edb: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.424848] 00000000722a5f73: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.433842] 000000006d1db5cf: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.442740] 000000005b4d9582: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.451697] 00000000a8979d84: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.460552] 000000005c01203b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.469403] 0000000072ba667e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.478261] 0000000042bf6e77: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 254.487137] XFS (loop5): metadata I/O error in "xfs_trans_read_buf_map" at daddr 0x2 len 1 error 117 [ 254.496512] XFS (loop5): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -117, agno 0 [ 254.505035] XFS (loop5): Failed to read root inode 0x80, error 117 07:13:31 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x101000, 0x0) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000040)={0x2}) getsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080), &(0x7f0000000100)=0x4) 07:13:31 executing program 3: r0 = socket$inet6(0xa, 0x8, 0x4) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0xc868) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = accept(r1, &(0x7f0000000000)=@ethernet={0x0, @remote}, &(0x7f00000000c0)=0x80) ioctl$sock_inet_SIOCDELRT(r2, 0x890c, &(0x7f0000000100)={0x4, {0x2, 0x4e24, @multicast1=0xe0000001}, {0x2, 0x4e24, @multicast1=0xe0000001}, {0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}, 0x81, 0x100000000, 0xf07, 0x4, 0x5, 0x0, 0x1f, 0x2}) r3 = syz_open_dev$mouse(&(0x7f0000000280)='/dev/input/mouse#\x00', 0x7, 0x400080) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f0000000380)) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) r4 = accept4(r0, 0x0, &(0x7f0000000080), 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000180)=0x2) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f0000000240)=0x101, 0x4) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$SCSI_IOCTL_SYNC(r5, 0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000300)={0x0, 0x1}, &(0x7f0000000480)=0xc) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000000540)) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f00000004c0)={r7}, &(0x7f0000000500)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000340), &(0x7f00000002c0)=0x8) [ 254.533323] binder: release 15077:15085 transaction 531 out, still active [ 254.540306] binder: unexpected work type, 4, not freed [ 254.545621] binder: undelivered TRANSACTION_COMPLETE [ 254.552970] binder_alloc: binder_alloc_mmap_handler: 15077 20001000-20004000 already mapped failed -16 [ 254.565151] binder: BINDER_SET_CONTEXT_MGR already set [ 254.570894] binder: 15077:15085 ioctl 40046207 0 returned -16 [ 254.573869] binder_alloc: 15077: binder_alloc_buf, no vma 07:13:31 executing program 6: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0) r2 = timerfd_create(0x0, 0x0) readv(r2, &(0x7f0000000180)=[{&(0x7f0000000380)=""/230, 0xe6}], 0x1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000200)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000340)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r4 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r4, 0x400445a0, &(0x7f0000013000)) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000013000/0x1000)=nil, 0x1000}) close(r4) lseek(r3, 0x0, 0x6) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00000002c0)) r6 = syz_open_pts(r5, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xe) setsockopt$inet_mreq(r0, 0x0, 0x27, &(0x7f0000000000)={@dev={0xac, 0x14, 0x14, 0x1e}, @local={0xac, 0x14, 0x14, 0xaa}}, 0x8) ioctl$TCSETAF(r6, 0x80047456, &(0x7f00000000c0)) 07:13:31 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x60000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 254.582432] binder: 15077:15090 transaction failed 29189/-3, size 24-8 line 2967 [ 254.592969] binder: send failed reply for transaction 531, target dead [ 254.601383] binder: undelivered TRANSACTION_ERROR: 29189 [ 254.716319] ntfs: (device loop0): parse_options(): Unrecognized mount option . [ 254.741976] ntfs: (device loop0): parse_options(): Unrecognized mount option . [ 254.808431] binder: release 15119:15126 transaction 536 out, still active [ 254.815482] binder: unexpected work type, 4, not freed [ 254.820796] binder: undelivered TRANSACTION_COMPLETE [ 254.830877] binder_alloc: binder_alloc_mmap_handler: 15119 20001000-20004000 already mapped failed -16 [ 254.843581] binder: BINDER_SET_CONTEXT_MGR already set [ 254.849704] binder_alloc: 15119: binder_alloc_buf, no vma [ 254.849918] binder: 15119:15126 ioctl 40046207 0 returned -16 [ 254.855393] binder: 15119:15128 transaction failed 29189/-3, size 24-8 line 2967 [ 254.871745] binder: send failed reply for transaction 536, target dead [ 254.880210] binder: undelivered TRANSACTION_ERROR: 29189 07:13:32 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x80045300, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0xfffffffffffffffc, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xc00caee0, 0x0) 07:13:32 executing program 0: pselect6(0x40, &(0x7f0000000040)={0x0, 0x800}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000140), 0x8}) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) pselect6(0x40, &(0x7f0000000000)={0x4, 0xfffffffeffffffff, 0x3ff, 0x40, 0x1ff, 0xfff, 0xffff, 0x101}, &(0x7f00000001c0)={0x30dd, 0x80000001, 0x9, 0x5, 0x1000, 0x200}, &(0x7f0000000200)={0x3, 0xfc45, 0xe000000000000000, 0x3946, 0xf799, 0x0, 0x20, 0x2}, &(0x7f0000000240)={0x77359400}, &(0x7f00000002c0)={&(0x7f0000000280)={0x7}, 0x8}) open_by_handle_at(r0, &(0x7f0000000040)={0x8, 0x2}, 0x0) 07:13:32 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms-os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:32 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x300, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:32 executing program 3: syz_emit_ethernet(0x7e, &(0x7f0000000180)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x4, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x133, 0x0, @local={0xac, 0x70, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14}, {[@timestamp={0x44, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2=0xe0000002]}, {[@multicast1=0xe0000001]}, {}, {[@loopback=0x7f000001]}, {[@broadcast=0xffffffff]}, {[@multicast1=0xe0000001]}, {[@dev={0xac, 0x14, 0x14}]}]}]}}}}}}}, &(0x7f0000000000)) socketpair$inet6_sctp(0xa, 0x0, 0x84, &(0x7f0000000240)={0xffffffffffffffff}) accept$inet6(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, @mcast1}, &(0x7f0000000200)=0x1c) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) open$dir(&(0x7f0000000300)='./file0\x00', 0xa0000, 0x120) openat$vnet(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vhost-net\x00', 0x2, 0x0) syz_open_dev$midi(&(0x7f0000000380)='/dev/midi#\x00', 0x7fffffff, 0x400000) r1 = dup(0xffffffffffffff9c) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) signalfd4(0xffffffffffffffff, &(0x7f00000003c0)={0x4}, 0x8, 0x800) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000040)={0x0, 0x200, 0x9, 0x6}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f00000000c0)={r4, 0x80}, &(0x7f0000000100)=0x8) dup3(r1, r0, 0x80000) 07:13:32 executing program 5: sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x8040, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000140)=0x7a4d21a5, 0x4) close(r0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)) syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x80000000, 0x20000) 07:13:32 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) fcntl$setflags(r0, 0x2, 0x1) listen(r1, 0x5eb857) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000000340)={0x2, 0x4e23}, 0x10) r3 = accept4(r1, &(0x7f00000001c0)=@can, &(0x7f0000752ffc)=0x39, 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f0000004fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl(r4, 0x2000040044103, &(0x7f0000000300)="e7") ioctl$BLKDISCARD(r2, 0x1277, &(0x7f0000000180)=0x9) sendmmsg(r3, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000002140), 0x0, &(0x7f0000002180)}}], 0x1, 0x0) accept4$inet6(r4, &(0x7f00000002c0)={0x0, 0x0, 0x0, @mcast2}, &(0x7f0000000080)=0x9, 0x80800) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r3, 0x28, &(0x7f00000000c0)={0x0, 0x0}}, 0x10) memfd_create(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x3) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000140)={r5, 0x0, 0x10}, 0xc) sendmmsg(r3, &(0x7f0000000c00), 0x4000000000001e6, 0x0) [ 255.269290] binder: release 15143:15149 transaction 541 out, still active [ 255.276365] binder: unexpected work type, 4, not freed [ 255.281672] binder: undelivered TRANSACTION_COMPLETE 07:13:32 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms*os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 255.326359] binder_alloc: binder_alloc_mmap_handler: 15143 20001000-20004000 already mapped failed -16 [ 255.361922] binder: BINDER_SET_CONTEXT_MGR already set [ 255.375612] binder: 15143:15149 ioctl 40046207 0 returned -16 [ 255.381124] binder_alloc: 15143: binder_alloc_buf, no vma [ 255.387279] binder: 15143:15166 transaction failed 29189/-3, size 24-8 line 2967 [ 255.396479] binder: send failed reply for transaction 541, target dead [ 255.409813] binder: undelivered TRANSACTION_ERROR: 29189 07:13:32 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RREADDIR(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="2a0000002901004a5600000000000000000000000000000000000000000000800000000007002e2f666925cb933d4af1459061ea7e555f0a20033c35c634b84ecbfbf344e0f322237c4409014dd22284a2630186df20b8dc7b8d60b01f1bd5da0c339f6b1618c1b7af73e1b0bfc75508c45ac2fba92acbef589b53a048f0ac25853583f4673fd4ece7fd4ed0610e23f5d0c46e3931957529e543920d46e0b0d40fc8be7e252a3020c8cde470d749dd2c048864718680b58b6280b00aa7c27006a0a7bae25736e4926c207375f1fa"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access', 0x3d}, 0x2c}]}}) 07:13:32 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0xfffffe82, &(0x7f0000000100)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000180)) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0x0, 0x40, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 07:13:32 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4800, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:32 executing program 0: r0 = semget$private(0x0, 0x3, 0x100) semctl$GETPID(r0, 0x3, 0xb, &(0x7f00000001c0)=""/224) 07:13:32 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms\nos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 255.569095] binder: release 15195:15200 transaction 546 out, still active [ 255.576126] binder: unexpected work type, 4, not freed [ 255.581428] binder: undelivered TRANSACTION_COMPLETE [ 255.589109] binder_alloc: binder_alloc_mmap_handler: 15195 20001000-20004000 already mapped failed -16 [ 255.600750] binder: BINDER_SET_CONTEXT_MGR already set [ 255.606244] binder_alloc: 15195: binder_alloc_buf, no vma [ 255.606424] binder: 15195:15200 ioctl 40046207 0 returned -16 [ 255.611858] binder: 15195:15205 transaction failed 29189/-3, size 24-8 line 2967 [ 255.627949] binder: send failed reply for transaction 546, target dead [ 255.634817] binder: undelivered TRANSACTION_ERROR: 29189 [ 255.687555] FAULT_FLAG_ALLOW_RETRY missing 30 [ 255.692132] CPU: 1 PID: 15206 Comm: syz-executor6 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 255.700519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 255.709854] Call Trace: [ 255.712430] dump_stack+0x1c9/0x2b4 [ 255.716046] ? dump_stack_print_info.cold.2+0x52/0x52 [ 255.721221] ? kasan_check_write+0x14/0x20 [ 255.725439] ? do_raw_spin_lock+0xc1/0x200 [ 255.729661] handle_userfault.cold.33+0x47/0x62 [ 255.734318] ? userfaultfd_ioctl+0x5430/0x5430 [ 255.738888] ? trace_hardirqs_on+0x10/0x10 [ 255.743111] ? perf_trace_lock+0x920/0x920 [ 255.747330] ? pick_next_entity+0x197/0x390 [ 255.751638] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 255.757161] ? __perf_event_task_sched_in+0x24f/0xbb0 [ 255.762334] ? perf_trace_lock+0xde/0x920 [ 255.766466] ? perf_trace_lock+0xde/0x920 [ 255.770606] ? perf_trace_lock_acquire+0xeb/0x9a0 [ 255.775433] ? zap_class+0x740/0x740 [ 255.779134] ? perf_trace_lock+0x880/0x920 [ 255.783355] ? finish_task_switch+0x1d3/0x870 [ 255.787837] ? lock_downgrade+0x8f0/0x8f0 [ 255.791987] ? finish_task_switch+0x171/0x870 [ 255.796497] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 255.801091] ? trace_hardirqs_on+0x10/0x10 [ 255.805343] ? lock_acquire+0x1e4/0x540 [ 255.809315] ? __handle_mm_fault+0x3a38/0x44a0 [ 255.813886] ? lock_downgrade+0x8f0/0x8f0 [ 255.818028] ? kasan_check_read+0x11/0x20 [ 255.822168] ? do_raw_spin_unlock+0xa7/0x2f0 [ 255.826559] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 255.831125] ? kasan_check_write+0x14/0x20 [ 255.835342] ? do_raw_spin_lock+0xc1/0x200 [ 255.839568] __handle_mm_fault+0x3a45/0x44a0 [ 255.843990] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 255.848834] ? plist_check_list+0xa0/0xa0 [ 255.852964] ? enqueue_task_rt+0x632/0xfd0 [ 255.857195] ? lock_acquire+0x1e4/0x540 [ 255.861151] ? handle_mm_fault+0x417/0xc80 [ 255.865369] ? lock_downgrade+0x8f0/0x8f0 [ 255.869513] ? lock_release+0xa30/0xa30 [ 255.873479] ? mem_cgroup_from_task+0xcb/0x1f0 [ 255.878050] ? mem_cgroup_css_online+0x3c0/0x3c0 [ 255.882801] handle_mm_fault+0x53e/0xc80 [ 255.886871] ? __handle_mm_fault+0x44a0/0x44a0 [ 255.891456] ? find_vma+0x34/0x190 [ 255.895008] __do_page_fault+0x620/0xe50 [ 255.899078] ? mm_fault_error+0x380/0x380 [ 255.903228] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 255.908250] ? futex_wait_setup+0x281/0x410 [ 255.912585] do_page_fault+0xf6/0x8c0 [ 255.916391] ? vmalloc_sync_all+0x30/0x30 [ 255.920544] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 255.926083] ? drop_futex_key_refs.isra.14+0x6d/0xe0 [ 255.931193] ? lock_acquire+0x1e4/0x540 [ 255.935171] ? __might_fault+0x12b/0x1e0 [ 255.939230] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 255.944066] page_fault+0x1e/0x30 [ 255.947510] RIP: 0010:copy_user_generic_unrolled+0x9e/0xc0 [ 255.953115] Code: 48 8d 7f 40 ff c9 75 b6 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 4c 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 <8a> 06 88 07 48 ff c6 48 ff c7 ff c9 75 f2 31 c0 0f 1f 00 c3 0f 1f [ 255.973128] RSP: 0018:ffff88019362f7f0 EFLAGS: 00010202 [ 255.978485] RAX: 0000000000000004 RBX: 0000000000000004 RCX: 0000000000000004 [ 255.985745] RDX: 0000000000000004 RSI: 0000000020013000 RDI: ffff88019362f890 [ 255.993013] RBP: ffff88019362f828 R08: ffffed00326c5f13 R09: ffffed00326c5f12 [ 256.001076] R10: ffffed00326c5f12 R11: 0000000000000003 R12: 0000000020013004 [ 256.008338] R13: 0000000020013000 R14: ffff88019362f890 R15: 00007ffffffff000 [ 256.015626] ? _copy_from_user+0x10d/0x150 [ 256.019858] evdev_do_ioctl+0xb69/0x21a0 [ 256.023907] ? perf_trace_lock+0x920/0x920 [ 256.028135] ? str_to_user+0x90/0x90 [ 256.031831] ? do_futex+0x249/0x27d0 [ 256.035543] ? kasan_check_read+0x11/0x20 [ 256.039694] ? rcu_is_watching+0x8c/0x150 [ 256.043824] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 256.048471] ? zap_class+0x740/0x740 [ 256.052182] ? exit_robust_list+0x290/0x290 [ 256.056489] ? lock_acquire+0x1e4/0x540 [ 256.060449] ? __fget+0x4ac/0x740 [ 256.063887] ? lock_downgrade+0x8f0/0x8f0 [ 256.068030] ? lock_release+0xa30/0xa30 [ 256.071994] ? save_stack+0xa9/0xd0 [ 256.075612] ? save_stack+0x43/0xd0 [ 256.079229] ? __fget+0x4d5/0x740 [ 256.082670] ? ksys_dup3+0x690/0x690 [ 256.086380] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 256.090953] evdev_ioctl_handler+0x144/0x1a0 [ 256.095345] evdev_ioctl+0x27/0x2e [ 256.098866] ? evdev_ioctl_compat+0x30/0x30 [ 256.103170] do_vfs_ioctl+0x1de/0x1720 [ 256.107049] ? ioctl_preallocate+0x300/0x300 [ 256.111437] ? __fget_light+0x2f7/0x440 [ 256.115391] ? fget_raw+0x20/0x20 [ 256.118825] ? trace_hardirqs_on+0xd/0x10 [ 256.123053] ? __x64_sys_futex+0x47f/0x6a0 [ 256.127275] ? do_futex+0x27d0/0x27d0 [ 256.131060] ? security_file_ioctl+0x94/0xc0 [ 256.135449] ksys_ioctl+0xa9/0xd0 [ 256.138902] __x64_sys_ioctl+0x73/0xb0 [ 256.142794] do_syscall_64+0x1b9/0x820 [ 256.146687] ? syscall_return_slowpath+0x5e0/0x5e0 [ 256.151613] ? syscall_return_slowpath+0x31d/0x5e0 [ 256.156535] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 256.161550] ? prepare_exit_to_usermode+0x291/0x3b0 [ 256.166649] ? perf_trace_sys_enter+0xb10/0xb10 [ 256.171312] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 256.176143] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 256.181312] RIP: 0033:0x455ab9 [ 256.184479] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 256.203656] RSP: 002b:00007fa0c1cbfc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 256.211362] RAX: ffffffffffffffda RBX: 00007fa0c1cc06d4 RCX: 0000000000455ab9 [ 256.218629] RDX: 0000000020013000 RSI: 00000000400445a0 RDI: 0000000000000016 [ 256.225891] RBP: 000000000072bf48 R08: 0000000000000000 R09: 0000000000000000 [ 256.233146] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 256.240397] R13: 00000000004bd1d2 R14: 00000000004cb9b0 R15: 0000000000000001 [ 256.428501] FAULT_FLAG_ALLOW_RETRY missing 30 [ 256.433070] CPU: 0 PID: 15206 Comm: syz-executor6 Not tainted 4.18.0-rc4-next-20180713+ #7 [ 256.441449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 256.450779] Call Trace: [ 256.453349] dump_stack+0x1c9/0x2b4 [ 256.456959] ? dump_stack_print_info.cold.2+0x52/0x52 [ 256.462131] ? kasan_check_write+0x14/0x20 [ 256.466348] ? do_raw_spin_lock+0xc1/0x200 [ 256.470566] handle_userfault.cold.33+0x47/0x62 [ 256.475222] ? userfaultfd_ioctl+0x5430/0x5430 [ 256.479789] ? trace_hardirqs_on+0x10/0x10 [ 256.484006] ? finish_task_switch+0x2ca/0x870 [ 256.488488] ? preempt_notifier_register+0x200/0x200 [ 256.493576] ? dequeue_task_rt+0xa6/0xd0 [ 256.497620] ? perf_trace_lock+0xde/0x920 [ 256.501749] ? __schedule+0x884/0x1ed0 [ 256.505617] ? zap_class+0x740/0x740 [ 256.509314] ? __sched_text_start+0x8/0x8 [ 256.513445] ? kasan_check_write+0x14/0x20 [ 256.517660] ? do_raw_spin_lock+0xc1/0x200 [ 256.521888] ? trace_hardirqs_on+0xd/0x10 [ 256.526019] ? try_to_wake_up+0x10a/0x12b0 [ 256.530243] ? trace_hardirqs_on+0x10/0x10 [ 256.534467] ? migrate_swap_stop+0x850/0x850 [ 256.538855] ? lock_downgrade+0x8f0/0x8f0 [ 256.542991] ? lock_acquire+0x1e4/0x540 [ 256.546949] ? __handle_mm_fault+0x3a38/0x44a0 [ 256.551511] ? lock_downgrade+0x8f0/0x8f0 [ 256.555643] ? kasan_check_read+0x11/0x20 [ 256.559770] ? do_raw_spin_unlock+0xa7/0x2f0 [ 256.564162] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 256.568735] ? kasan_check_write+0x14/0x20 [ 256.572953] ? do_raw_spin_lock+0xc1/0x200 [ 256.577171] __handle_mm_fault+0x3a45/0x44a0 [ 256.581563] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 256.586396] ? lock_downgrade+0x8f0/0x8f0 [ 256.590533] ? lock_acquire+0x1e4/0x540 [ 256.594491] ? handle_mm_fault+0x417/0xc80 [ 256.598880] ? lock_downgrade+0x8f0/0x8f0 [ 256.603019] ? lock_release+0xa30/0xa30 [ 256.606987] ? mem_cgroup_from_task+0xcb/0x1f0 [ 256.611550] ? mem_cgroup_css_online+0x3c0/0x3c0 [ 256.616299] handle_mm_fault+0x53e/0xc80 [ 256.620346] ? __handle_mm_fault+0x44a0/0x44a0 [ 256.624907] ? find_vma+0x34/0x190 [ 256.628429] __do_page_fault+0x620/0xe50 [ 256.632473] ? mm_fault_error+0x380/0x380 [ 256.636605] ? mm_fault_error+0x380/0x380 [ 256.640733] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 256.645729] do_page_fault+0xf6/0x8c0 [ 256.649509] ? vmalloc_sync_all+0x30/0x30 [ 256.653636] ? do_page_fault+0xf6/0x8c0 [ 256.657591] ? vmalloc_sync_all+0x30/0x30 [ 256.661719] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 256.667239] ? drop_futex_key_refs.isra.14+0x6d/0xe0 [ 256.672329] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 256.677156] page_fault+0x1e/0x30 [ 256.680594] RIP: 0010:copy_user_handle_tail+0x39/0xb0 [ 256.685764] Code: 49 89 fc 53 89 d3 e8 a6 14 e0 f9 31 ff 89 de e8 ad 15 e0 f9 85 db 74 62 e8 94 14 e0 f9 0f 1f 00 0f ae e8 45 31 ff 4d 8d 75 01 <45> 8a 6d 00 0f 1f 00 31 ff 44 89 fe e8 86 15 e0 f9 45 85 ff 75 3e [ 256.704932] RSP: 0018:ffff88019362f7c0 EFLAGS: 00010246 [ 256.710276] RAX: 0000000000040000 RBX: 0000000000000004 RCX: ffffc900031fe000 [ 256.717536] RDX: 0000000000040000 RSI: ffffffff879c5bbc RDI: 0000000000000005 [ 256.724794] RBP: ffff88019362f7e8 R08: ffff8801c6e90500 R09: ffffed00326c5f12 [ 256.732047] R10: ffffed00326c5f12 R11: 0000000000000003 R12: ffff88019362f890 [ 256.739299] R13: 0000000020013000 R14: 0000000020013001 R15: 0000000000000000 [ 256.746555] ? copy_user_handle_tail+0x2c/0xb0 [ 256.751124] _copy_from_user+0x10d/0x150 [ 256.755170] evdev_do_ioctl+0xb69/0x21a0 [ 256.759213] ? perf_trace_lock+0x920/0x920 [ 256.763428] ? str_to_user+0x90/0x90 [ 256.767134] ? do_futex+0x249/0x27d0 [ 256.770832] ? kasan_check_read+0x11/0x20 [ 256.774962] ? rcu_is_watching+0x8c/0x150 [ 256.779093] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 256.783740] ? zap_class+0x740/0x740 [ 256.787436] ? exit_robust_list+0x290/0x290 [ 256.791743] ? lock_acquire+0x1e4/0x540 [ 256.795695] ? __fget+0x4ac/0x740 [ 256.799132] ? lock_downgrade+0x8f0/0x8f0 [ 256.803264] ? lock_release+0xa30/0xa30 [ 256.807311] ? save_stack+0xa9/0xd0 [ 256.810933] ? save_stack+0x43/0xd0 [ 256.814549] ? __fget+0x4d5/0x740 [ 256.817995] ? ksys_dup3+0x690/0x690 [ 256.821695] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 256.826259] evdev_ioctl_handler+0x144/0x1a0 [ 256.830648] evdev_ioctl+0x27/0x2e [ 256.834173] ? evdev_ioctl_compat+0x30/0x30 [ 256.838473] do_vfs_ioctl+0x1de/0x1720 [ 256.842343] ? ioctl_preallocate+0x300/0x300 [ 256.846731] ? __fget_light+0x2f7/0x440 [ 256.850684] ? fget_raw+0x20/0x20 [ 256.854117] ? trace_hardirqs_on+0xd/0x10 [ 256.858246] ? __x64_sys_futex+0x47f/0x6a0 [ 256.862462] ? do_futex+0x27d0/0x27d0 [ 256.866247] ? security_file_ioctl+0x94/0xc0 [ 256.870634] ksys_ioctl+0xa9/0xd0 [ 256.874078] __x64_sys_ioctl+0x73/0xb0 [ 256.877952] do_syscall_64+0x1b9/0x820 [ 256.881821] ? syscall_return_slowpath+0x5e0/0x5e0 [ 256.886731] ? syscall_return_slowpath+0x31d/0x5e0 [ 256.891641] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 256.896645] ? prepare_exit_to_usermode+0x291/0x3b0 [ 256.901642] ? perf_trace_sys_enter+0xb10/0xb10 [ 256.906290] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 256.911116] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 256.916282] RIP: 0033:0x455ab9 [ 256.919535] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 256.938706] RSP: 002b:00007fa0c1cbfc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 256.946397] RAX: ffffffffffffffda RBX: 00007fa0c1cc06d4 RCX: 0000000000455ab9 [ 256.953648] RDX: 0000000020013000 RSI: 00000000400445a0 RDI: 0000000000000016 [ 256.960900] RBP: 000000000072bf48 R08: 0000000000000000 R09: 0000000000000000 [ 256.968152] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff 07:13:34 executing program 6: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4002, 0x0) io_setup(0x5b3, &(0x7f0000000040)=0x0) readahead(r0, 0x0, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x3, 0x101080) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f0000000400)={'filter\x00', 0xbb, "ea36b57ca127459a28da152a7738a97c8f4e339213b4fb7e0075e7909de060e5b66a21478a5b527a1d7f6fe0e0c4af2c581b55f009f4e7e063fb7d7ff95f347aeb130e2d84dec8e1ab6c1f6796de2e7bcd5cdbe6906253ba5c1c124cb3722c519271e7fff07ef1b1aa37f71d85ee57db7958ee6c414bdba1aa54f545e85ca05535c14e9c22791c67b8a7708336d2e7b5b52e5dda5ea39b0fa7df47298058b89e7a6aaceccd16c71717036ec74a45eb4a37c3768e105c314786d281"}, &(0x7f0000000500)=0xdf) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80048}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, r3, 0x100, 0x70bd26, 0x25dfdbfe, {0x8}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4ca}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x101}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x300}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x0) io_submit(r1, 0x111, &(0x7f0000001540)=[&(0x7f0000000140)={0x0, 0x0, 0xd, 0x0, 0x0, r0, &(0x7f0000000000), 0xfffffce4}]) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffff9c, 0x11b, 0x1, &(0x7f00000002c0), &(0x7f0000000340)=0x60) bind$rds(r2, &(0x7f0000000280)={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) getsockname$netlink(r2, &(0x7f0000000380), &(0x7f00000003c0)=0xc) 07:13:34 executing program 3: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev={0xac, 0x14}}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x7c, &(0x7f0000000040)={r1}, &(0x7f0000000100)=0x8) r2 = inotify_init1(0x800) ioctl$INOTIFY_IOC_SETNEXTWD(r2, 0x40044900, 0x100) r3 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x3ff, 0x400000) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000080), 0x4) 07:13:34 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x200000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:34 executing program 1: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) truncate(&(0x7f0000000300)='./bus\x00', 0x800) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) lseek(r0, 0x0, 0x2) sendfile(r0, r1, &(0x7f0000d83ff8), 0x8000fffffffe) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x3c, @broadcast=0xffffffff, 0x4e24, 0x0, 'fo\x00', 0x0, 0x3, 0xc}, 0x2c) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000200)={{0x96b3, 0x401}, 0x61}, 0x10) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$f2fs(&(0x7f0000000080)='f2fs\x00', &(0x7f0000000100)='./bus\x00', 0x0, 0x0, &(0x7f00000004c0), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="01"]) truncate(&(0x7f0000000140)='./bus\x00', 0x0) r3 = semget$private(0x0, 0x3, 0x100) semctl$IPC_STAT(r3, 0x0, 0x2, &(0x7f0000000180)=""/68) 07:13:34 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000200)='io.weight\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="393a34390358ee9f255ccb621d23"], 0x5) 07:13:34 executing program 5: syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010a0fff027400f8", 0x16}], 0x8100, &(0x7f0000000040)) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) recvmsg$kcm(r0, &(0x7f0000000240)={&(0x7f0000000280)=@un=@abs, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)=""/89, 0x59}], 0x1, &(0x7f00000001c0)=""/49, 0x31, 0x100000001}, 0x10000) 07:13:34 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms%os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:34 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x80045301, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) [ 256.975404] R13: 00000000004bd1d2 R14: 00000000004cb9b0 R15: 0000000000000001 07:13:34 executing program 0: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r0, 0x0) fallocate(r0, 0x0, 0xffff, 0x4) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x7, 0x11, r1, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000007000/0x4000)=nil, 0x4000, 0x9) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x4e21, 0x800, @dev={0xfe, 0x80, [], 0x12}, 0x100000000}}, 0xffffffffffff0000, 0x1, 0x6, "7e5eb745a8dd336c8eed93af018b1a4a96c75d8a51eee6be3ef31d40895617b3438e8ae195bb2e4a83968f5fad8b71562064cd2c41d99f3ac976c2fe8bdd0f01edd09ff3ef3c6235680d65b7f8841204"}, 0xd8) [ 257.055065] binder: release 15247:15253 transaction 551 out, still active [ 257.062250] binder: unexpected work type, 4, not freed [ 257.067594] binder: undelivered TRANSACTION_COMPLETE 07:13:34 executing program 5: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x2, 0x40ec0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000007400)={0x0, @in={{0x2, 0x4e22, @broadcast=0xffffffff}}, 0x1, 0x3, 0x6, 0x7, 0x1}, &(0x7f00000074c0)=0x98) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000007500)={0x7, 0x4242, 0x8204, 0x401, 0x7, 0x69e, 0x0, 0x8, r1}, 0x20) sendmmsg$alg(r0, &(0x7f0000007200)=[{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000000c0)="21b6ef6d02ede86a665d3383bcfd3e2d3ddf91cd29d5a6551856e6abb7c54fa0e574532ca2304e6be48f06e12f70e12dfad48d27e2aa354bfb52b13ae92bfa5a2f2c87e4c5ade089c2d9b79c87e0cc58882e21e9160e65bb5dd397f8678ce19cd0d4e251be451c1c6a4d3351657b075a4de26758176f20d5da", 0x79}, {&(0x7f0000000140)="0c5960d115563bbfedf186e6470c40947aa9915d8f96b362f17ae2e26104a1a0e94fb07d1a301358f1a436d205d847be6a2d98cc80a350de347f6e5d6fb2b1508b155e78612da2c0c3f56fbd714c177cc22e6fed638563538cab488e1fba529469a9579c5336a8be7b96230e8e65217cd1dd6cdd5bae543feeb264b56fe7e9", 0x7f}, {&(0x7f00000001c0)="6ddad08307c544f8a9c330f0049000999b99449d92699f33380647892feb5ae6aec88549793b7c44017ae38b5adee1fb04eb3499d4a290324c1f491de6d4d0a0c60186a04a00a0140e08c4f62ac2355f66bee329059f8539c7ab4a1879a6fec33339eae92b8b1a10ad600e8249cc636334611faca40831935889c6cbc2143d718747e21c28c74488ac45cba8252151f83773e773ca89bfb2b01300ff0def", 0x9e}, {&(0x7f0000000280)="faad07b76580010588ee17bca93c038a56a248916805e38ec7a40e68428670583592fc044eb9533d419dae053a4260072365548a0ee657267fe774f861642c784ea59a68bddc7e119b13f31224050ddc2fd45b83c852230c2ba9c6d926fdaac663eb003f73a5d0b041c0dedbdf3f2857fe0b3b68e21f2cc406aeb489068b7f7c6150b8157361c8bf1fd45fb79661c0fe8b66f4ab867812309203b8cf493b90a0aa07b6d5911841b4aab84341c46b3d2f13e8ed555c76d8cbad0b7653c2302ec8adc73705dff40c8726b015b176ac2abac0726727c8bc5844e653b527d930771a2983020420f835d3c4a6f4ab5bc9f66de16875ddf0b6ef2732e190c7fad65c3a2431ce16a0526e845f909cc3d8c48b5665c60690e587691814eea9758f41356a17373f19664b57a2d4e4c079b675d8d5d33cec49e7b6126bad6273889bb94eba68f47baac5cdd348ac652e8139f6ded509ac35311b1fcef9f37e75f8b4c5ee5c8cacee8b972144c843fdaf9e21e567d85f2f6ba39051d94f1f9f2f908d30cb3eb5766d680ba2e32134c41f01a0834dadeb4eb43e78c7ee7307adf41a092bca6a5628ba2b5345f3a853a0911ef1c50d6d0c87636429d107f41960272b2b1f0aaa0ae36cf51aa16e818edefc7ae3c3caca61f265ca6f7e28458e6e39459cd193d88346bce063450159bec9df1006bb2b7c065d1dd7a7b12a81f30dc3da7f2b69bd6f6808c0dd90cafe30f6d8bb892f36c2f8085ad3b6268b3530aaa91569d787bf904faf311b009816782371f342f3a569cb36e3e42297deaf2b9ab0838df4e75f1db65815112c3ebfb0780a98aaedb2852d4f6846348580835bad653b71087bd88311639bb11d2557e70b3a1f34b75044ffd53e56917ab00c6d5266f225913e9c6a5b34ba5de48f1bedcea569d2ed37efa30a017b4e62c86208a8bc8065cdfb9c5386b6721bf7d88986fbc0191f1607fa3eb1ac837d77511f521a7ab81b9c8c70580cc7d60afa8248b4f73b076b537608b6454c4e144666752f4367030663402b1b1a07d92c373e471aee26d0a75dcf1f3f77f142597575935d7799284c965bd583bc32afefe866d539364f8745bd5a7ca55dbd6536b65c780aa64a9aecb8f8e48a300d3ac8c3adb2e5465b20c293914831f77778ee74447e6a2e4a4b23ba0dceedce3b04dc576aa35520450b4c8362c9c8939448cb005371a14140056f0627d6b7fc660898a30adf13f8703d00fc5ee09e8aa149221a353a469180ca606922677c3eeea4a1e81d84f12dcb1d68fe6712d857a51b71704f3c7d6157412321a7a0e31fb5c74922ab75c83629f57743a3054888b7d192eaf1cc08fcf375de0e7394a72c3d43a4c23f951d02b99b9d8275eb9fc4b05728e34aa1e8e388c83736912c7f23ae58f1f8689a3a4f44088753112c79d0587fa01aaa46f50e0830fb71c72548f9a344874d1ec833ee958bee5904675ce7215c81f6dc803561617ba74f6864601252d807a537eb5606212e5db68259d6effb7cb9f0083c201f8cf8f1566c158eedd8dbbdefce0248493f51064e36132b0ba5e2b607d95eb019fac537b540d132d15472d896fe846779fdc935a6c820de11cf1c2e24d83b8abd0eda1588bbef304ebcbc49bb31ae5db884c3bd05d2ee9d6022103b8097491ea1b158114f5d85c8306db647af2f00b487fa012ed5a6d5f04b65e94cc9a507222d729afdf21b2616ab2369efb841d8d7421b272c2e527269e583cebe54ceace784f4de2cdb1ee047d47e0e3bb7ff386f8e4d5bb66f263537809efdbbba5a7143f6d0a9d583ef64b23042747778a43141b6272846036c05d7f47c20bcd96c71e2aea6b0287aca5d7423bd2b56033f91777168cccf1d581eaaac61671e6d1b662ebd0a27919de19d73dec927b4f737232a46ef3356c175ab8c7f30325133832b79e2728be76224bacf5eba95cb1cdc129400a140829131e62eef368a28340e082ab214e9822d8b5250ec4c97e0dcd6be81e6ddd06da7d0ede7a8c6aa308e399cdda803a87dcad4c0bcd964ff68a623ed6964adfddb731926185d7838b69b20d042f48c6a0755ac5dd25654fe8c57a8b900936b73975cd3bab1b7f5468424f2886a580d7b904e96cfb0578925b7dbd8bfdab2a15cdc93eef738ecefef7e8bf37c99c7cf707c5e0f0955ec48e81f672f23a86cec47ec788837ec6a02d55e6844ac2d342b0636b9971332143721e3fb6e8a749c4944339d666a21257be50fa1a5287400399f03604ad8425805525f870855b672c5917aa3c95b6dcc5e69425f3d2d313276eba51ee7bda52fc4b87f70fcb71a0e6d60e4ecca81a1f0ba3c8ca89c1173f67b4890ebf691f880c83e305f1f640f4be1719f048662424b690587e818f7de0edfcf27dabc5edabf83849aff9081e61cf90af7b3ddffcb62bb1b064104d4076429e4b21c454bf76ccf51cfb51f884a3fbec110d0758b6fa1738222659233760e6d80fb534c03086d743f01b5d24f40ef1bca81633d332fd368c4a54f25f7618b0ab3ac3a19b627a5a3379fad8ca80493c8fe4623340055bad594b1c56e52501a07ea39089f9fe310d3f18d9f411cef495b5835892c00f8b5e3f575b1a8550e687a7620527ead3ea033b79d0ed915b6c15bef0f29968159e155c00cbaf84b4c861b9b146a077c8cb040d5e2e6907fe3595abdef1223beb222508091ece2df65c0bf96dbaf493ea55f1c113fcc391482dcc24a66e90aa03e59e7e6ab4bc64e221973730f81a2f9400b731dfcbf0b433dce4135909c8549de0bf2d5b81d2a0a6358a7e16c1b6ead5e85f78737e25399d4a8a5ac76e402733b2ef7f786ddbd4a3b5e2940ee9b23c677bb39535ff924141954dfdb27cc4033accf18a5cd3a52aff8449798945523f90c94d2d06bc93c8e5c0f89e626c6613113a0de59d3c07ece9d90fed053f3810657aab962ec5a7e6fe5bc8d9f470dc25156d85657168028ab74fcc5eca7cb58dc5882db9ad14e718308afc5570a0e49b6992d8fb142908a73dc8632d84d1f33eb6da1c975273bdda0b738cd08149da2f4e78e859e3e2793beb30f5f9177862556d3e943347c0076567bae05f23341196b6320452bb2e5f4ae14bc7cc6abb0c14cf943ab476db3a07cc0e7aaed16d9dd10c69e75b57c3aed3d76b4bae753785a2a79a3c37145b4d54418d1b98ccd369c0f9e18c2842fd4f4c78f50f035986c76fbf4036c2756a541cc961cd0c84575fd6512e0c0c13c77f00222f82306b5e42b1bf32f53b2a45dbc38ccf14e8e4c7255ee5bc8afd8116f9d43f286f33b036b11589ee3f2ad0ff249c80e5c520ea0c97ef0a8ca2cdcc77e8df57d533c89f29311cbbecb17570de8cf689a8fc6464fe4ff87b0c04780e9f646d30e1362729223c5715b3c642f5fce398e07a48478fb811f89a643367b3a968d2ebabf230711b33c8504ba80133e7f4382070f67941aa3871e0cb6dfb9e5255684bff6242545b2ee570b97d7e23a8cfaab6f6fac8bf042311b2e4f04b70166ffec02dc83bf581d5669c00674579c0db9d096d072a9f977360d4dca24545d27933a05d867953b1775416fba29025069e877a3529b561ea20db454dcea18721cf464e6098fe04ae86f3e7185febd8148ba2ed1632db4a33b2d0926e5050cd0ce67209173d2bbaaba20b3745350e6bb650872ec9732691f06df4d8795da788acc3d8427379c41aac48ff6ace11e8cd5ec92a74a5d2e645533c6bd9ad670e5926098c8ac31285b9c73de0b1c8290b24a2684a3e298f98938f354d9123a9638efde9dd61f0574d86c7c88763360a522d5b80573ea485e6a14d404935e5a129693662ab77ecdfb0f5f7280dfa0e751b00857a85e34844e2e348e6888849b481a73c5ffd632a147faaa242e9fbcf8c42cf3df06b725d0e4975cfa113df746a4b27e2fcb6ddff662ea301fcd0af690fea055d47e0fe90acb9bd65582d962b4e6dce74517fc331f194606e0ef06f8002358cc1399b44c91f7a5b927f835dde73b7af86e8630e38b4b812cfe66a6ade9574ac0a51280f24b00a0f247cabecc36d880bbaf2c98c2dccdcbd69601d350f4bc311ecc99d3a1f700e2b7a82aa1d76da35b04c6efb49f6d64e448804fbaedee8914424f9964b9fbc074cef26139d4cb5ba221e86a7729d5d3fdf54a4cf2bc04e7a52a39a6ac32721415a1ea6d3041603c6da063ae83c627d151fe269fc35e76b2207e63cec54745144bf35efa30a0e7683ba64e2bb77197f7e051f900c4c5e9cba8e8ac54067ab61a437cc9add5e2f273fec2810dc17649d8f54b997f15f87759e232c2b2d37c478a7c8db73ddac1d649e3c6ab593d050e30104ec5ac8e7039962068e1f1876cdfab098838fc1d55fdb824becb009c90cf504fc31091b83b523ed787b23f1c01553545f8630bb370d13eb47254e018595ae03cb767883979f53828e9a326d0ea5d33ec6de34a55af3b0c2f4e12307fdc31d74bca26e79b27d52b24a4bff4c018cd22081f7689759ff2fa5ae3aa702ad88cb66a2eefa6d68d24b216072a5a560f5c3ff303d497d488977c727268becee4cfb4bed931e01a1260ec1259330af8e0f58c2684c5e33a9acf5b4481172b7bf76fa1b0bed16a16b3319ab2612bf20d4f6b212fd4a6d212ff5b21bb868682740bef8f86c00440e135871548b7c7f5f80ad5b3edc9502cde700b0eec485c7931a17856eaef0e97dec11286513b6e0a8ec2533c649fb74d312ab9540ae667b72329b4da552db7d7b8151a29ab03c582266d7566ad49d54d89fee005bd07531f1f12643f6564c66d02436e729389f063c92324f5b7913a40ebed60d21f6e01a05af003a43acd5dea4355d293d843e7c67c10d3d69173c25bc482635024932aefd74c634f4f06851c365ff63dbbfff62b6276d92ca8b1f9ae730c65a56dc634c31d32dd27158904a8e8c845c89a3e0b3b60c5e4b26b6703d3b788b5bbf0d849e7a96644d9d5a6d37fd02923e39e941a7ce577b7e470a3200b3fe20fd3bc9acba31be32368167921998f16e6014cf42d33b5e61f0530712e34814172f5b6ab654abc1fdb26b21369138b54222c8c4f1722c176b5c34a49ea3f38c62a4d2da066257b26b9348e5ea07b131af5613cb63a6d32da43f8561fda8cbaab8818eb2d1186f86f456bb146c9ea460158c2377fb9279c669de0cd1da2a02fd88d52383fe22e68d75335447c3dc9b12584813a0160890d3a9b0d2d72c97b40400ef752a44483574b61229aa1047b9616c13ad7d6d247f12d81a947b212388d089eabaf0fe00e84bc5615e4103a322769458e8e10ed05ad7b66ca95f9d4595723d57416ac6f8b18919d307c914e9ffa8db3da60afcd090077884cf94b30491fc2247dc648044555712d22135f4af699649426dbe6f521b37723176beb11f52126925874b4b3fb17859bdedf62514946e12e844ee9b65e2bb1ac02ab78f6a4ae5aaf66ada47b9319311866811cb401f36960dcaf59927475e747e9083531b27b6f3cb0e7c339ae792169cab85a60bbc141c1d1d0b3230990ce2333350173a75b510f440b94f9eac814bd88d0dbb58062415fdf8ea64970f0bc14b8d5fbca6ef36a798f67a1b883b2c114f13ae44a82905a6ab9fb17266af0ccb20f6c6fef8d7a771b7f422bf6f15a566de60d0e20157cfb7a3134a073a931a9b20da61f512520883b65fd90b147f5b120a097f2e418af2ab7aeb8fe73eb9ceb682ea33fed13225eddd76d8a9fa55564c6d7537e6767a915ffdf7dbd7466bb2e9ed6d30c0dbd03fe0901ec0fa91354919f39a07093fabe", 0x1000}, {&(0x7f0000001280)="2d9780f013c1fc370646e33509d1fc9d1f5d97d15fc4708b81a97ff7c6cdd13d4efbc721600ad0158809a128f3e3023d1d777afdae57984f5e622acec1c9617089a515f6ef9599269a3be78fe1fd3336777d35fedf296cf4d5469e15fefb7d7d9b9423b6bb617dd708d1ba1aed478c8f8d7ff4ccc496aaf0a3177577de89e9cbb645a20fea5ef5b96a111570042e197355e70c9e1fda36386455355a368ed23953fffb539258f8363a04afaf4fee094eb27017cfdb8185dff68ae3e8024ba50975665d19be8191be4d12606d2458bd220a52fc81ca37fd0e02d0a7ba842ae499b5ae40d291d2d70d0e8a66b6f570", 0xee}, {&(0x7f0000001380)="afef5ecbf823114383e70e3e3526498d9812d914578ebb5b343275c9eb1e93db05d9060b08a45e2cb4989482309684d6fdce2aa1d1d74dbc84ccdac91689f24f0497ff0c76d238f328e85498c158782818036d9cb1267aafbb4a741fefe75cbae53e58100d74307806fc8d30d6c32bb8856033942991d56e9f4d3d42c358abe42b4010b7cfec79e4592586bb0e56a8693ee6126941abde93f8d84828f24dc59ab3797f50890cc8c072c571d13246efeb43090a162eedfd696d65c9ddb5879d1745", 0xc1}, {&(0x7f0000001480)="e61ca616800616b93012914de8dc59ba88c098963eb5f15552dc6dc43471171fe1cb7f9683f9325de3fe7fc3771d2179667297ea0c7b71c03434fb4663dbe0a4312ce740bd1b1dab7b32f0ea79f5506208fda2d61feaa238345fbd61ae8a29c4200a09ae5bf227178d7916d54193034df2a7f40c8dcff385a8a58e735c44886ed0f7369e2510023442722c89d2cdc10b65c7a4700ec734f5119bc0617a1528ad80f142c5b3502bdd6edd56d68951652e6bd20aab37bee9319601d2614a151d3293599a1c57181f4504109596f9dff26170c1a00102edfa4d799e1093c5e1b9e3c1c1d9fb3cf623a709f153be4e40c8706ee5223362fb5954", 0xf8}], 0x7, 0x0, 0x0, 0x4008000}, {0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f0000001600)="409be2d3b00c7bc7d9320539ab699db3489a7d1e52c131a6789f21da68d1267e1f6a8839552b6833dbc5387a7913260940c13900940ea3621118f2185f2abf9840a9cf4e62b1ccf6c307349962d7343689241e7ac1caccfb693c3f9dea0d1f3e898282cdaacd8a3b7f04c7d715e84282a29cc7fc6e53953ce63738df939085172aa5020f5e77ae09d28927290a845a00a3ce43adaf76b929b2baed39c12c8d0489d9e8f3f5d5732a38e54dfa8cee3d050fac9dfae6c5f5c98c7131dc635770361030365fcf526b622d86a95e1940bf046aa656a123f2e85c8e02e59b90deffd842f9932aea42930ed2", 0xe9}, {&(0x7f0000001700)="acc94e5695e73b89b7866a4297f14d0da38c98d97ee2169b395f888a2a17fa1e03c79b0d317a15098221ee4e3f2084163079bc206d9fc17ed6", 0x39}, {&(0x7f0000001740)="7c3ffc200860c17b3a672afdfe81129e535b80a160ecf4f964b0150881acc506dfd5a9000435226a41ee863e123cb42b8e817e601e7a805bbd50dc9fa525917bfbdf8db7241bf7a495dfd61fc037beff2067a8433838ee34ca0e02381fc02ecb3694bba9af56010df7f8af14b27e811eabe30418ed020aaeb687e7e38c5eca5bf1ec1a9c33e38924348aa65ff8d2952e09d3e89a93d823500f470ebd089021fd536fe062b2c5e0b04a182b1dbe065354fb11f0a1e2eee78810b73a09cb67a358345a8917d4b35d9c44c67cb3085a5ee0542fce34904ed477", 0xd8}, {&(0x7f0000001840)="d7acefd9e264d920edc8d75f08bb04ab888e4d5922911f8bfc78453421f92f66cb976c22a167f25fd5b77ef622db2ce10ea1c46bd190521b4f90e5ea1aa53cfb41263af5a4b9a845", 0x48}, {&(0x7f00000018c0)="efa0b564674ad3496a7d061959ae3b27676caf2a5481896811c3482ff367b3839acae31e0f05ea5abef7e6c221737eae928dec1d23b44a5f5916622733fb2d", 0x3f}, {&(0x7f0000001900)="b24c153e0ad03b39b4cfd22e48adaec20e81c1a638a17e62142f4d156fea39b250da3ee440ab065e4e2997565b28593a1ef1a963bd0d282ca2a0206989d7af71a9c166d3b2e3d6ba76e3b73a39a61941465565c874bd2e2c1c7d015dcd9b18caed724188b4857eb67bdd5d82e714775096dfeaa0cda065a6fe30d20a8c141c2e1d3d117cdef574a6d69fd82e65911fa43ab779f215dcbeee1cac8ef34c12a6d75e75e0fe990d2238901589c38161bb520ed422b36fdba2cbafae659f2432", 0xbe}, {&(0x7f00000019c0)="af38703a2337caddc160e7509993bce27c398ee34a606e82c906904471a85a2b2e08bc5ccf9693ea33b1976f13eccab41486038cafc7683101cf6301", 0x3c}], 0x7}, {0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f0000001a80)="844eb249e06bb4b683b49c8dcdb2abb0c5541252e8ffbaafa7d848b1e4e478c2af2c76b4bb1640", 0x27}, {&(0x7f0000001ac0)="93cf09b333ab978fc1df512befc92576e3124d7531c3868939ddce60eba2c08811cd10e85fdd8b74d5eb0397e8421a4cf5e3566f43534c5e77886facad3a28e462e6881bd49c29c8709712dd81d6cf4a9c84485adabb1375462d98383c2c3aa5f326a8f4526e4c588b9bfd04c8d4f2470ec744e484eb01911d329ac44171a79fe4eef594bee6859838a3d889dce849e34c98366eb0ab19e83022e4fc2a8f02946d58c3d7102608b811cf27a4c02639073e616b1beb383d3a6bd8aec7a45a251c40e9ee8e4c283723276603b58c9aa4f744ca6ac0d7efb3e59a508cd40392227f51ae7a7129f84523c674ed3e84255cfc31f38c2d821713fb989d7dcfef19145de3ffb01d930ecd433895887704463325821669d39752ba9d791b9e4812b2eb98f492a5db624fe63bd49837e4c213d6bcb5f28bc335741b95441125b766ba7062f9a3a564f104f984fff6ea84dbfa4f98cf9b98d8f51281697476f56006182c2b73f6be674c831ed1826f5a3bd85d95c37da39851b5b841ff3c625673e8800e2bed27098a39eab4754e4b5eb64142cf743afcb8e207ff6f391db65954673a6b31f8c3e8cd4e9b4be68896c9e22dfd9a8fa88a87e11422a3e6ad8676fe4398549e995d06a5d2642a52172ac6cb73324e722ee7c14c032d26d1304a9e94ca155d2558ff1d7995f9a322c13c1b3b83683146b1daeb29aa9a33685a9151ae9e6c75f68feed6096611fb5d5b071f47d67f5d85063e2adf264f6a9cdacc80bb299cb546114dca7d5a9bde6965e24da01876b3092d7ba1f8e389d334ee1d79a39879968a5942bf3e6ee63a70a797f92472156249abaa878addb3b326fab3b201c499c9e367d84fcb848da14249c5a2e52a2b8f103ec16cf02ad30c57af50cf46de99e5a7908d8cf72e402d17ea3ff93fb502cc040f43974cde86482bfebef70cf16a27315bc3178d7e30c8dfd13093da2a378407b5411ec2886110921421ce060f67a38db6507fd950617b2f82ab8b3fd235df6366dd418a91d4f64785b1ef083c1ad13260237b7f3389c55f7409d47b7c14f8aabe8f6ece24aee2d345a53946ca85fc9f9f75b2fc50b2534438823511d4d773b358fa0ac141a44b66360acec3a2fb9c9e6ff4cc77075d739202de810c56cd93fa117b0da16d0d8179baf1b750323af505b8a7eccbf129ac9aa9db5bfec8f575c87ee670415682e1d20d2466e93d867346485bc81b99aaf7ecbb832ab747f7be4cfad1abe61d3e2b1b5ee70eb59715c484a2e39cce3f110ee0f0e735925ab4559a991c51c16c4ad671280ff75ff92665c5a7b5a88851d70a4722e942d3074102f6ccf39b0da0ff993c56c6919af35762f8fe73a86a46a63393016f5da664a42b20304ea134929260b791d81e73bfe161cd8b70687b74454a4493e368304a0b8f0c2e1906827fa3c3e316ce5d3cb5e745f16ea65cbc696f956b6a0e8866436414a52a2656c71ef39801cbae8078aa29760d115ea0dd266bf76390fdd542f6f06ecb853041d0a42e2fa3dda1724c21b4f3ecf92ff4a39b102f42b5d62d3ab86481a7e0a4d196652491072bfb89fa6a3eeb05b754efd75251df3dd92c6b3c689b0c7984733aef6a0447d2b93c3e5453fc3ecf99c54f0581fca890feab87272b4a1ef2ff44db80581346fcfe6a8ace0bf13eafdd585bc0a8a6ba7d08223469755c6f10702f3f863c05fe05fbd5ea076cd0246ace1bbf1f9a4242e202f8acbbc68267a0b96b64d33d53fee3e4d1b53b404a4bbcaebc46d075bfa94bf78a17d3768be5701022bd4602bc7149038bf05a9b723deacf46a684b347839513aaa887733aeffb328d69e41e7a01a98c381597cee6f2caf6a900a62999231aac56ee52ae898dddea52e831b11cb37c147f05115dc822ceee00af755a6a8ea3acb21def611a5eb17c67fd19517de474e8ef1cf8bfb504201c92a02148b869ca89610d5ed1ddf24400c116317b9eb81647a8f00d3805397b6e51ea424cde9749b03a489521e7f64f4ba767bd1302756282b5fbba622050d799ec0fcda905adefd8596853c381babc954d9ab2428979c8a26f0b72f0e8a3b86b394ad93134f2ba88258c32fe2a1c1f3c7a02dd5ec55da0ca11ae43d08b060a835639a3e44c34eeca196410ef96e4e5d8ff7eb31b4b30d25befea11fadb518d25b9ab0e1e0c049432465ef79b9e680ade6b5346844d84d95ca4449cded532ee6edbf7b08b510e0319e9df793cf907221998dd92388a51b4f2cacaad330f56184d52ce5d77fc6146607db0501decd551e7f4832f191e4da47109eed2d7a70ccd58d9246689e6e84e8370565f5cd45b2e47735abe15e1b9357909dab78848eb03a2a09e3c9d730149131ceae7fea6d0beacb0228f717c8175eb23876a4914d4f07e404a02cd42452b38afefb41ee3c7307b6a8375f23b0dd9ea6253d291af8671118525ed0422c653f40eac740dfc62272ca628b5de7807abf6c77ae02e3cfab6e48b8083d907565b4c5138d98eef7d064e5fd692b72b49325955e870012e45c23e34bf2659d6c939f48f58606e69ecc2bc6540e8141c12ff691d4dcac8c00936269d8bee88c73087d208600a1e4676ec59d3ae35038935f2d5cf251fc387b5b5df5f695351e2d5493f0a9e40391980673b0a98d01ae84564d150d74cc25bd7a4988d7936779cb3614e1a91620dc7a23e5ac1be42e18a907487980724464f9e51d74819835838fb658b675c88401526d5568bd2505950f016c9182e48af2175bfbf5b257df9ff1f2e270812e985a7c550587b599b7fb2b72d1a55a8ae692304e3c31b8ccc2e5b05963af8c125b083f3863227b6a08cbc380efce51ce5794678d07817e9759375c2b7e63f5c9bc8258c455d4b4893864f69d810480c9bf9dec616f35e2d8097641a218cc1a8abf1bbebda10d8e602b0d39e6ba900014949112258fb073f711c06d69a25f64f4cf4e5e045b1287be9b3e568fa98804b30952550fa42937693823778ff0c3adf14b5a86d8eb55e12849f82b43038291b981c8ba6a620e619b7dd1e7c77ab304873eb2a66b50fecd3fe83fc750f0693b7703840b6111a52714994ef8eaa5e6612431d4d71b8e9b5da520da9ecee3055149098962e732824e84a4cba97519479694c3484735cb3428b3e9b47a4913816dbea9091741e297ce2e28267013b9e70b40483c4524c561ddaa1ade8907ea014af496e9b869627d16453148e054b2be7cc1a8b4a0524819ba65af115ebaddb6daaa5b09c160a85a74d16d6cb7aa28800fc2b7fc00f428176d41fbba43e0583e0943a5b772cfc5f35c6ea247727937a56740e46ab384efe24bc1dea23b1cd629fd77e88ef9bc4d131ac55f00a41b44cd159d91f122c9f5919252dbecb69d155f4aae043fb6aabc275856c5b68bca8c0918a8902084d620c61ce2dd3ef1de595f8fa1034f4618c539ada5cc6b3834818669dd5b7ae2c0fe4c98775d2c9e264798385d5cbd303511753092c34e2f22cf8ce964eaa18fe697ec1f50232911f69a26bc62ba70c290bea2d7902da4fa8f2acca78e8b133d0cfdfe7bfc46d13dc88d4a694fb5322162a9470a032d9a94e1ce6fd9def5f9471dc21fa21bea305a4ce64592f7c3b0009c580a618a05a114312b6ed572f4d76ed6e86df43cdc98ef994f730af664e83a4d25d0d43027bc13b79fd440544be4ffe5f2416d652a75c852378963bee55be7cb165e7995093acdb980cbf3a9fa41434f80f1ac433a45ae352fc586c53b8e6291ffe8699bd92d9edf692fea09b9c2ed67b84a9773540fad466a8c1dad39a2561486a4bd2eb33aa8a43dce544eff5143912b5cf848e422eae1bc8639633fb08a86fa35b5c0aac4ac9ef9e58983b7d3961b8b02ad8a9afe8132a561467b3d950bf1f4f9778d321af09ca99eadfb1560ec139f7be2cfdfe505faf85633ab0286745ea21513153b3fcbd3beee6eab248c5da00df6fc2aedbc6987e72fa8e35868d0899010a446d783b563848cda66300ae5dbd070be5b4e7fea27c2991d8e8c1c29417eb68c1c535cac99705ac35322aa0d0fbf038aff1ea0b40dc8ead8e74e045e526308969ebe0aca8b10a45b0c7385ae3fd4c0c428a657e5ab606b765eb3cba1fba9f5d309aff1ffc6c52f983eb13c728aa96d3a65561d1df71d62638fb13c82b36b14a949cad678d4ebc1dd0207fd3735f6c2669bd0fe577ede2b363cdde90d80b446224759883e3faed223db64627a70288c8891bd6161c1ee44939db37e8e4242e359633126b91d4bbe09e6abc26b3cb801ec54cc23f959ec294fb13a5b89a15d3d11af2b1829877152339f15f54772ab3a9c6031c966136bf74bcb6854b17f153e99bf791cdf2914d0849384e84f6865af70d77ff98a4f8a40ff84e6f2aba48ea810ec00390f04f46a279891b919174feab2c2fd911529e3e9aa7895441ca646b916a889a392826d92b9dee095122062151470df0857b0d0a39c1ecc8421f64a465ac9c9ca99110a45de6b2612929a599e22af928f8b4f39d015fd16fb89a86b8d9d521169d4addb6dc6bf64a1228504c879d3bf8338b05e4f80c26dffc84d9470677fc6aeb7d84ac1d5307e21389e8250895c9cf7bd6e0525975f59d7046a68822861cf4c30cae1c85e5d50a0d6469cda56bd62de6d2399696b4388f1d6f1d17530af9f64d8271830783f028dfcb50e4585f5c215f9d61daac5734fa07c41a8510b3734ee686008f58b03aefe704c71b2b924adfa4f848a5b5bc22880da3461ed3ca2e2608623ee383c04f5c3163b206177f0d10633f76b28152a2f1607cb2c530fee02b964d4084284cef4f2e41aad32e3f464f33b79a216861237b11eb231065bfc04846bec4dab19dc29b26ff27708a19949a3e26baa27d45a774f641150e5aa860c3f290b9a0d2348a723fb38abe67cbc02d5679d88a45504b3b303958d9b5737ee8a1e4954a95bf4581c3fad1e68991dd7bc4a2833b11088fc201cd294656a294e8cbe828d9d54489bdc51bdc792e77e7edd434e2d55581f99e354315b46241183eba358e5766b7330b037cdc44801019de6d3a6424e7d4628100ea0fb209cdf8e004598a8318629d5ca1094ce30f2c898a6a046a49c834e723d40b32fdb25ea4b67079b429431f78493bd82465e31f8d6dbba725d2de976607f64737832109308fa9da559aec73b1f7688a305b8c331b778ccd0cb440ded23b672094946f26d01442c405a36aa0afa87298461b1dddbe58ed3f62d3d3ff0dec566eeaa97e4a1d258b8e6c5c1c066039066a40c03b8a81711690ce53475c88cb3da31f1c29f065f9557c530427335a9d5e365aaa21c3630364aeefcf0b828787a1279e3692252d870cd547e122c46ab9eca7660b714fcb8d9cbf852a38a7b342574cd3b64f508e8538b1ebbe404ccc0bc6868f9d519d3a4bc9c01a86638d972f90ddc3e2bb7d7b055cf1e68177efb6750be90f1747d39c74b6e4ace4f90dff0da248926e692b204c961921f02e9d3ef4873dd8d868898c8b88aa0f4add7caf95b859f0776fdc15daef2d2b2c56cfbf46d2472c8fe37e2a902d0ab501f1206db9bb8310410e008201fd8d5d64647acdb9402f3cbf26ba05750c8b69ba5f8d29bd4cb9b619e54b03c7bb2b22e694225b3f4f087501298c5b80650141eeafbef8c1b6b83070bf1bb518be5614f69f37acb70de8774e5c6f4098b1f09ebb654baf6b898146c06ae20ba9c22889a06cce1dad86c997285027bf6cadc778c426ca3960fa01b5c1b4d113bd1d565f585fc219f3f5e20b3b810f7de5fe113b300f8c88fc441f5f", 0x1000}, {&(0x7f0000002ac0)="cf86dc305e0bb046a80e5a2a61c34d74", 0x10}], 0x3, &(0x7f0000002b40)=[@op={0x18, 0x117, 0x3}], 0x18, 0x40}, {0x0, 0x0, &(0x7f0000002d40)=[{&(0x7f0000002b80)="dcbb685cdfbd812882cac5287fc1c1e65119f48179ef7671283b74379df13a1a81c746c0170276021087b212959d708889bb831454511201b850c030e2f9355cdc5e2eeab88ecd648f7c0fc207671f6d988aed0668d625984b9da1c4732cee1ecb7076efc1b4addad7d66496701e9a3972b9bf6ee0fe007efb2a5286868c960a591b045bba9b2d6161b5614ce614bca4da9242e6cb0b55d5727313d7a17ce7742c84825db693085b15f42104cf9c649d293af9e825fb5d9f7aba", 0xba}, {&(0x7f0000002c40)="707215736e4c4afa1a2394cb87033fca3ac2f04b3643294deca9a7b4", 0x1c}, {&(0x7f0000002c80)="579715ff342be709d26251156363692ae6329fc9810873d3ea8b1f2e1732ce30af81c8985672a11f0515eec14fbcf4c09e5fa940a1b586695828e10af629dcc42212fc36101175d651a66d3830c33d3301fac73a42d855cd9107db9e660399401890d57858ee038e1875fbd6c902b72d5caa40f94108f9501413969c88db639d1f575476d14b8ee52107275805c2", 0x8e}], 0x3, 0x0, 0x0, 0x80}, {0x0, 0x0, &(0x7f00000031c0)=[{&(0x7f0000002d80)="78aa56f921fe0c9129896c8fbd86e88d764e4ca9ec9a0d54cf3d41fd99b215701535ea490f10bb8d4ece1a71e45c2723bd26db90cf432f70d0a22bb4431361a2a17aa2900dc671f29584d240dabae982b0a1f0f5250b0b907ffbb9097b91729ba2ceeeb14c3b08d253c349b9f7faaa810c014f018062e249de619f9b3f0e645ba46c80bac2000d7bae12d5b368795f3463141d9512", 0x95}, {&(0x7f0000002e40)="9ae5507bb77818f1e97d320dcdcc8eb2e819f554bb9f146bf473c94386ae883969b943cfba051d37b8208e5ad562e19d47bd4b3978205a0d4a125e31fdf0128be40f11f46a7a5323ecf1e74336f9a2f460d1b46f7090daa6b41dc462acf4d118c50ba629c59f18155d226482679af69eca2dfe4b78c2d0d867173ff1171024740ea2b13c7e245af7701732d161fe3ead0e0c20fe71df93e8724c7364d4019ede1f1ccadedc794c7c94bb4714e2f9a669c8bc6e44f0277002806d12f19152c2", 0xbf}, {&(0x7f0000002f00)="ca6be968b1f95522f469615fd6230b8a8baa4e3f8f08287df5bdd24a6ce8686a34082495a00cb74e5b9e4436cc8cb8b8bb5275763dbbf5d88728eedd7156086990a234d98304ddfd5d9e0d", 0x4b}, {&(0x7f0000002f80)="0e715f159fc49827ea2e6457ca7d08e7f0227e6f1d341ff56204b72bb6f39172582fee51489a66d00451639f2a61bd26784501b1e7316c18eadc15bee648bd1d1e2abeb23fc0753313a9958e10ed5924baf1b0559152ce1ad07c5b3a861d8b8efec741a2d0c83bc2d52927d2f9b629d4d226610761004640fc13b1bce5d1f9f2af8a78a8e3c9cc549db3e674a54b475dd408afc63a7ca9b2d9d4f06c9d88776a9e26b983b9ea3531ef1dc822a0681b0952ac2b9ffc93238e7406", 0xba}, {&(0x7f0000003040)="c30b13905e539dd437fba7ef9a87cb7041134ef9e377dac8cca7e7f2a5783db2df07e15b2775b6394e7a09", 0x2b}, {&(0x7f0000003080)="2f7475372f137afcfc895ae706b88a9e5e97532ab8fca4e2489eed63e30f946c878e9e4d943211c69ef15acea83f299a86d032467cc943efc37541b8d72c19a0e310b87bb773f455a10e50f1e3d975345ff5cf20e523bd34f3f313879b99e5771e3f2adc7c5bd1dcb90f0e2ef6398e25fc27c89bdebae7d7a30ba6aa4cf2e385c5ef257e0ccb13c8688184728acd58fa8d4ab52dce190a721ae3ad40da21a04d47250feee2c10c7e9399899c4e4420788aa4ceb7dc44e95135d96435ab0c83588df1b5cf4a7c4983", 0xc8}, {&(0x7f0000003180)="60ad7f894e474d402ca5080211a81cd92aeb7556f366db1dba1cdb1c37056df64e11b61f02e60b9efe42a3118ca7f284fb", 0x31}], 0x7, &(0x7f0000003240)=[@assoc={0x18, 0x117, 0x4, 0xff}, @iv={0x98, 0x117, 0x2, 0x80, "39469281172bf3556f5ceabb891928bae3c4b8f79fd82d298d1ecba944bc0bbe182e130ad7cc9508e98f7cf8ffad6a561c502a9ca80e384851177c8e0591e8b2ac59f77e654e7738d1ee3faffcb184ffad0d5d60c56820946b0de71dbefe5679c69d849648601f9ec3747bde38e23769433cceaed2c61e24bd8a54f245a3c5aa"}, @op={0x18, 0x117, 0x3}], 0xc8, 0x40000}, {0x0, 0x0, &(0x7f0000003600)=[{&(0x7f0000003340)="f1a518107f2443b6bac91ed95bd1aa5d2d7416ebf5915073cccbdeacf20b7c63060c58ab00df363c46d94a128157c90d18b5bb1100ffdb028a6bb604c6", 0x3d}, {&(0x7f0000003380)="b4c877d25ad87b11c4060128e8415f786e203ae3cedcd5370a233b2a31b553071898028b16cdcbc17d15d918dd0abdb6cc7f44498900e69557b8bf776ff1604fcb8561398e1fa7a6f3ca4b6b4c5de373377f8b24a4237b660f63b58bc266a22f074a8fb4574c6912b6034a057fbb2f8fb500bd0b4da74ecef718f7449000dec08fc95c95e7ec1028629246f86f413f68456377df102b81fc366844667ef2bff2026111d6bba239c2648be77a58f58c265113c9726af3fd0835979d5712f0b8aa8dbc9b6f0fe7b56e8097cbff07e3e237f9f56c5d8b04d4c55206abacf84f90319f2d4e593aa829854387536678926a2abc8de288b37ddd99454b75cf83a0a7", 0xff}, {&(0x7f0000003480)="d6b49376f8d8a2e7a834b7a8e84ca3efd946849e6da0e39249798cf6413bedc2244e09fcd94ef01ab764164bd2029a2c2786e54c224c5f5b07b2275cfd82475a9b37208d73511b6ebbee6b84f349ee408054abb5d8a20bd85377cbf59ba430b364259327b5cc9740394f2ae2b6cd7d4cc1676ad08f51d6080514002482a23a2eb442601dda4e4053f3df35cb0bdbf7843fe1109e672657bae4aa71ecc4b09c5201ed9108ca0f45b42e071c94a77fdebeaba5cde17abb68d66e62b40f60df1ba2491376dcc1104e32d13fab905a42cf271cc22c58c1930f65fefc1a7740b4d077a9f21ee28bb2e223b2cc13cd8dba9e18bd", 0xf1}, {&(0x7f0000003580)="b0b46fc609dacfb4861755dfa69bc5c5bf1cc01967f41d3ceea75d31a8e41b575921022eb50f83fefafdd0899494f15603c2b1579d5b6852e8c7eb991a363b39fe8d29c1bce5961009574f66", 0x4c}], 0x4, &(0x7f0000003640)=[@op={0x18, 0x117, 0x3}, @assoc={0x18, 0x117, 0x4, 0x9}, @op={0x18, 0x117, 0x3, 0x1}, @op={0x18, 0x117, 0x3}, @op={0x18, 0x117, 0x3}, @iv={0x1018, 0x117, 0x2, 0x1000, "71f33161f3feb6b753ae8431e96712d97c600d55131351ed47f470fcecd6ba7b6480e035bde5154f4d7d389c50ceece11df20be2386fb972fdcc60036fa5f8126a4f272c5aa67ce6797030450e1a210650f6cecf37e71cde2591b483301ea96abaca8337d687284e60fd1a4b8c716b2073e2703ef0941b5f55611e2b8f08672915d0ac6f1ad19983b1a91868e9f6a2abf76b5bb6a8fa34ee88024a6387e84a67194a058d80bdff2994a7eeea76d451f15427a9123da7f2700d30b9bc25f5b0044b302ca652ebee44542a3f0e8f83c5800f8be1dc35c97f00f17d5bd888035d490860a278f88bc7689075e228136d490f4c0fa374820cf484c133afc2c59ed31b04d5645008b96713a4cc40f92e35fcdb911adb7d04e2d8fd3bf11c24147bb08c6672a14942d5389ff643cebeec078e1e92b052e3d0ea0d9c34999f84fbacd59e097af08e29930af0928b3fb21fde61e77dee42701a9b27d0922e48d251e66e99d2469273ffeb4c41724c47811a7058f8959c8150b423498fb9308c6b2195767f21986412791e485ec0723b6c6be2fb465fe0dc87669f117a9450113fc0a4db4c1de3300b52fbfb227f90cd59a83c175284aef1856b3e68a4f77522aa524c43b4a56388882edff105e7eaf2ca0b57c7f0b0dc8a6e767907b070acecd21df582c29a86cc96adac72711fd4090dbaabb62a5cd6ed5c161148b3b5412a51ef1c4818c3d327f85328a7ba49805070db2d92f157f27dc282b19e826bfded4327e3457fd98b18ab069976ca533fb4cd7cb2d718df4e3a8de25d0c74d8f5d1f880a9ed252f9b07a24971238dce1ac6f80da1e12762b22fb81f89a36139b2178e06c5b8d2daaf50356fd0537a7e1660313a64c0eaf9df9ba58751d99336e2493457d5ecbc7875d23f35ca72960df1cddd390e7694722c7b9c823390462b2076ab1264f56695860c372ee2858aebc4961f59e2ab2b43ebb268f36eda21b33414fd7851a6d11c07e5c80c948dc8a211c0ae1bbd6db79716a2791d493f4667051581d27281dcc05c4ba53f10fdb95a8915d5c9bfa0792ef53d7490e29bfb74693791f60413cf7462636d19153bdc5ba42ba126410e9c406de564a04698b4ea023d76668c31de218499cfad70f6f2adab0b7dc6ed64550bba674d75869a6847af173cd1dafbe07981c73318aac69de9ba1ee466c9b83a34d2108aae3df6e4c17edc8b96e0bde5fdc7023772869d482e79ac46c402a149edb52c551747ce8f6b9a3b75adebf0265d9b28dd7ac0f0cfd705a1363be6f47e6dcb58a2294267a730ad76c8890fac7f0e63bba4308d2422d16bd3968a734b7355d8f727d255b218b93397e705c77b7d71d55fb2533fb04c6efab52f6ed04a3c6e9d589aeb552446f92e7de244923d8e50fb281b9766a8ffb9a3728164ceb9e0bd9de4b145518b920a6bc8d57aa40bbe5d5e018f708b041a8c42c2dfcd0d56987d66e7cfac82ba32527d4e7eee69f6b400c9f61344914c7f9fddcc48cd2d7ce2bbacf20f49b521669e997d297248afffdbd75015f9e7f7b93c51bcd1e8870458b666ddde44615d7bde140c0d01aee27c0d5bcb63b255f73f6512eeb8b829d115d87a8a84e9100909451bbdd42a0a827ad5056133ee8e1121ce2068b7278404cf7597280b3b8734c9c5a9fd21df290b231a756da2144dd036c1f6a5836a6b370f323e1bda2ed4ee5dd5e9f9d95c42462622a50d66f825d0312e1964d14bc5b2745c0d7ae7032cd2e72eb72f0c045a8dc3b140dc8d655eec3137c60cb7f1ba26b0bbcb98ab4e28acd320304e84e559344e67cad41294cadb7656a08a22b725d04faa10c6f4fe4aadb84ea0403b3174df73a0622ff464394b5d44132c6a3c5b218dcaa242135d83d8b385b45f9fbb4f093d3f06523220466f7bf0b46f47e813c2ddf5184ce0f795e26c2273e2b2d6fb5779ba1ad4f7f47f3eb91f0ab5324f0f4a23eaf2c06ba94b0ae242a3885445ea07f399714a38f5df02b6b4519884c18f5f8d353d53d6b988f659d0e55c3a9223657d503ccb41b501241e83e48e64eb98633ff62aff1bdf0a3292b49e813c63285035d735758d61cc1c1cd78230bedbfd8c34dc4efb24aec6b43ccc6a8e11bd3beb100f85ebf5a7f4fcaaeccfee6bf3f8d9fa8e0ae206d0cc051cdeae8f96c69d3a35137670c838724b7e3ff3c6d9f831cc89265ef1a66846e294a9ee888fea33a3412409c31a33af961bb204cfae0b7cb04d11f8fd1a4a887f448bc1f671fc7aea7188f3beda7a06829156f736c36d742fc6da23b89783abd879e7b98ae9ebf4d1203cf6a8bc6cfbaf6eaee553afc02d94d5dfa1ea807aaeb290376e88a39c45c44bece00604fdf6cba9c00eec5681c1ccc39f8b8193ee1646a04f327a0acd708e3a6585524dbdb14233aa8db744c2967b1be32e1a0fa2137d023290f28f12cd14719bc18eb271d74997a4a3563a66353d29af61ba5f9d6ad5623894565ac85d77613a3d82eab2bfe8825c3422b696c10b61a73790267cdbbdc253eaf1cd94fe1cf46ffcacf753a102c7128431fa01fead6d732e519e9c26d0216739cc221b3f58ef2f34c5e9cb387711ae0ec0d3559da7004f9ef0c7460697c5d3e211d409993f628dee86627936b9b70b9878e72b232aa53c219e0c0326daa2c1a57c1b1da1c39690ae364d625e222f1a71db420fbb437b3003eba7061ab3fe0fee2085249fa034380e954ebac50cf6a464d8c4febdd28eed2ff46487d5a9515e1faea7a58bff0bc9f2bda1da5d923655be79631e904e8453b16649e2a01d64a78c408e40190f3536b8260e8fe1cd9c0ce7c3419f5df1ff645b2d38fe7bba8b3b2df79c246e29d69af999af3e9f208ab3d11917ea27ebac9e8d143b73a919b968b86fb4dafb3e5b9d73794527a0f941a6e14fdc65f83e121e6f188c018633b76594c19522523384a2e9bcb36bb943a7a397f7a81fa773343d2a5973b08074437b3c207d0f41adb7853a9398bb42b08494c14d04cce394ce6c70f4562e7f5297659a2e3f8566593d1cade9d77f4ea41996887e754dea2beaf582559f9344f3cc1ea201c675b3fd6784f31d1f569d356602de9d2c01d5ecb12d3529dfd6390a97b89ad5d53ee92e5b81ab096e6a0a67ff4894e21b1cd551da2f8289414db3d779f0dfa86457efb08b7afb6dd344910fcc4afb3c00bbd4eeefd72138a0bd4171040a958a5f8664a8dddf6a602a2eca247a9a2783795df131c9611c8d88c6854070bc2edce68879625032f1dad2ecb5ddc44620fd314a55172289b8821b59a4a22bd1987162aa7a69d9d4ad2189634b1ed75abcce27cb5f7be3e65c485a1d401b7b3cfaf2bf059609ae71bf150c339803d0789df3b73e1ba255ef15600f737905046f868ee102e9d704ca186848f83146641c97952f3e32d3cc6c6e4c86fe50700c5262aa99b4a5d95b1eba6c21d70b56a1dade7656631db34c0675bb6425ed62084813b2a6c540377a9fb397a31590f11530318201f8698e6b7c20b80c9544ad28a4c5af00bde06ce28865cfeb9f70e3f1eacb21b7209a6ae08e66a274edf8901ebb6a80619f5b0927fe6d6ff365c9381669e359891c59f2960cd4cfe800d71b829949ce29045dfdfbbb1fbd68e558bb962e3591fa76d7fdb501983abc720a1a845086ae3e4a5a8b4edab0c712fc2641af1294d911bf9b7acd3501e520041ed759055258f395f43516dd800b87f93ecace4c5512dde7f043a83b86fb88b54c516c89e752cdb27d763fc8685b88af6dbaabe5be62f4d940fbf673e2a469ce2be9acf8dd2cb78172b675b62921b73f41f714a44a0aca4128d91786782d1ca14c4fd2defb5c869710d43886990e76a7d672f7c995177f89590ea3eb940ac622682856b05e70076851a7ab1866f7385b3a5e43b1233afdeae9ca6165de046330933c0193ec92966b1d02efd4ac85f912235e92fc589782368c0d365c284d462c7061f1b13eb898724bb57442164339f267d764167c64ebfe56372c7d44610b1bbcd1ab75d69ae8e9266278b16f6c7f4e81d7647f8d876a13394a636f135084546e2b4c449df4607568795a38962c14ea2899728089ccb6e4c7bd97326a08d10c3aae87fd283c9b56494175991558e83d9210988c87199d22ca9f00f84a84b42d52998c4357200d6f431ad0a3956b08b5ed034468c705f717fd559dd1ff833ff85abd330e960a10614ad64bd79b8461b5a51dc870d1b29aa13966c34de7a981f0acdae17d58771a68615dd9bc53dc02f769cc44ed458dae3a3c1e141a64ecf588cc47b1a65bbceea2c344e91bd1ffdc6f863417e00943f6b31e6a08658f10aae7742ba7a5afff5cc26d07ade9f3cb63d61e859122333fb00100b63294fb22d97ea08f7c29c67c22cb6a39c0924d30007bffaebc77968ebb835307f1de54e45978de9f92cfffee27c61c6148d0df06b64e8d85942f9e2610ba68fe852e077e2ceb05ab32bb4fb2d114e2c279b7efd3ed29c8d0ddbd8e22b27254fe430ed3d2caf35717611f3bc664f7ae187ab0bf5d81db6e01ac201d68e0a9e91150d189b570278c460896c1ba9aec4d13321ddd867d7dc32909892174f101a4f211d1d22339ad0711a7b0c29e651717792e2ca96f59efaa57c09fe04d515b6457d1bc61bdab2de015c5211afd0f21f1b1d53d3c1b2c3780e0ebfbb125fe177bdaca6248eea129bf5812133c8fdb068856f0a27306b781596bf53cbd2f89b6d111f241f4baeecbfe7436ef933aa802a9accf988c337e13dde4419f63c3670c96cb9e9e97b16093b80041a90a2df9d88643dc9d644df67dd6709ceb668224b3d353bd711d253326b07e36d2e736985c6fdc419b72417193c369c2af203ab1284b0e40be18fbeeaafb7446b458770cd9d5cdafb27a53204ccabc96efa6a5d99e4211888d0144b1f006bb4549147ede48224349e6fe9d9f99c0ffc79163789f62aae5459d25ae93b82c4a2632c5bcca3a421a8c2729bb61ccbe9f9d2fc95fc12fb7187179b05e9cab88369b18c0edbc947634fa662869729931257e8d2711140c768e83d4c07b1387f4b4ef8205c28648edc7b265e6a9a3464788c8e4c5d630156c4ba4d84cf5f6635c3be94eb4d798ea14abce461ef6b1579843627c7d4275e421bdc6338582bc4a5a8e8a9c5c52652b5080e6709e7421e7c8d0e04bec00e117438ea86cad0f356ba87e164ceac34592ba803db13d80fc51ac42a0691298389912a1713cbe4bc011233f92882c43061b610ba18eee1977ee59b8ebdd4213fa5fe1c7ac0497d4cbffec5c8b96decd6bf6ff8ae16794b8933e759aeae36f25384647a77251652b89a544f3ba1643358c8124239c357013d85c890907b555782e1f3986285ffaf4aeb9e320bfd9f52d566f4831c931d6313a0bac3457b880a097a5a5c706841b9891ffdf39bb3f47c2fd611fa9ab615b3ef9d6b1fe3d10f6f6c32b3bff9984891f57ab57ee388b822bee488f9b774d47a5e4a1bb1cdbc99b0533fc42e5672f03ca24926d5d647c798d636696f6fa024fb2b93d2b46893cc25a69e1061ae22f5e3f9de040dbe31ddbc706696e34311b7264908fd69ebbd47c747917a4adc2316b2c4cfac6e33234a4ba9ae146e23afd703d5e9df564dff64c934f9de700aa383f4fad2fee9b61f50a3cec80a2be6410518e51a2708947f21802813f49bcfcff8dc7df43bcab6dd11a0881a8228943e492d6be4c0e06a2db51f55dd79064e1b5305fbed4d0cfbd5f2c615204ece939a3b31b4078757a10667ecfcb9881d1beca75872140c6f27e6c365fe9b9e9efad"}, @assoc={0x18, 0x117, 0x4, 0x1000}, @iv={0xd0, 0x117, 0x2, 0xb8, "e724a8466546d010eff62521d83002ccc1310645c727c33feaec164af51e02ea435ba560001428ace4506dd756349bb7579aa9313c4b8f99766355b7ebea8c8e8e99d9f419cabb7e6239adf11ac88efe49a356a9b880c8d90285e46809bfa8f30cdd73b5120c7d1169c8eccac0ed6fac145f8dc272f3e0281d84e43d285faf76199ebb9f0c15c07f2d87b92b80013b48b1be9f1dce7048ac603676ffcfe64df5eb542f0f4b2a121f87f9fa2086d632b55d953bc0866e3980"}, @iv={0xa0, 0x117, 0x2, 0x8b, "855d15806952a1944993c5012f52e8e28ca18fce1e5810bfe331f3d0cfa74d178cbbac007327c133cb98edd0777e1a2dd50111ee34eac5ca236339528208c697dbb0d5ed916fa531615b401330ab5f7644b9be0f54446948cbe39bb7e4e94b7f2f288d857afbe06b8c6d2721b7eea3d0370ace132f41b3a3d62a32ea5ae6effda12f0fb53c4efd407037c1"}], 0x1218, 0x80}, {0x0, 0x0, &(0x7f0000004940)=[{&(0x7f0000004880)="732b324e8cefb9839f7b26f97739eaab2f2bbe85c175de56423c09e831adddd3a19441d3e2546c0f2d605323f50b8309a5898874df10a1722aa1f6aa4db0f142a2a5d83dd97f34b19a0f6572396ab3ffb5bcc495b293c4ba00fecf874a417651e2ecc215fc55c36341679d77b016d099db5b52a72f7439e882b8da66cc83df6eb892ba3a0434e7768491353e8ef0dd", 0x8f}], 0x1, &(0x7f0000004980)=[@iv={0x1018, 0x117, 0x2, 0x1000, "6df5f8bf8d69321f7cd73cb2edb1b73d5fa864f130a83f5ec9218ab61cf42af1b52a0e872063c61a624c83434882eff61317c8baa440d3e9eef76e7de7940f04b11bf9adad99cb17a2bd1b4eed88bae7cc00cc54c510da3cf866194b47704de2fbd9357595f4a7727b26b6ef209b46152607e72f1e3ce2215a7b75ea5a93e31a7234361fc9708b15f09d5ac3dc31f77fb6c8baa67d057cf4d548f8d2f1a37e852e88b56d23550c377462e2d93e4141e00f8842debeb93b6d0da267dd2d2e3466d6b3744e7c558ec8abe75ccec743bb0d38083d7c3bc9d7d10d2faa7f118be0cef3700ad56fbf78073f9ce190864b076606bd37abdc63e0f7eab1c108cd6808d4d9c0d4f48c441163c6471c5e48a6e08d200c13c630d6169356f2d60c993ba7a2928eb8af1b42c7c758c342118c4fa98886f1ea95f55ae34f33edd2e058c8ec4298a8615c80a66f26d1d183100db6b2681471ff2ba07d687364ba49d7fbedfbe1a800cb654296885957263b1a5d35a438a8c6fd99aee877b038130266c50e2cb5ba57684370316c8d81d1c02fa869e72783ba001aba815474606fcd835062acf360225528cd9fbd6a97a57f02a005d3bf39d25fdf9f0daff327710412e9f47e8fde4ff9799f24e265e35032db09607cc156903613c9a24f060196928bf986c97c82175f80b944b1097eea024b13525fc3235f7f3736c3e26e12c3a687190ec0e777a730614dd30d2da7dbf364aea6a5e2540e716e04f1b64acd7a47d11b0c3b9221e4c714c4ff5e60d5cc44b9f95b51a4f855f1f916b9ba77dd285d1d6cdff6d9fdbfda6c4dcfc0b0d3135c8a721303f1777f1fe5edb6e4fd16af18eea8e8181f5e0c308d95d39de54ba16c3789b22b5b890cf2fc0d82f5517be1dc580e87265962b74d1efc7403d9fdbb564be9b50440cc83120d83431b5b85ef4ea7c3b76d99437d68adb48698f7317cbeba0c0b4979f32d771a39a8dcb6d1b1f1c672eee7ce996f47f4d447802b1add6124ad2f09a497c57e17b682463ce1593a8d6eec7aeef68daf008455b83fa45c5a6fbdf00680453dbddd863539875176bdf4ef92d88e4bd8cca38c43fb56d0f59de5c95befcf70b985ee1b88401bd00fb82192e20d7b95c85deec392b962312a480f15d61a749b5e6102dd9cd06b90804c5545da294415022b61b98fc0f914bfb8e3697445fc96346bb6cf2ec7aa61941b2af27be7ddb14b74ab29ff19ab45320e61958975382c71d36163ab67f3d822ae06733055bde941bc0d3fd5494d15bdf269a8b810ad4a4c4c4378e0c436c7cf9caf14d6f89ce82edf92b3f26aed2d09005b5d7620820a43a8092b1cf9fdb17b53b9a808ecf179be92bab1c20233dc0dcb4efc162690959708f6dd4cf7b93e1c442732dae5c4fc0008ef492310c70da188e2f65614fea9f6a86982d9c918ae71e0abd16ae366a29a668b7c43a0d12dd0785ef9c2511261aab86bb03c3622c8d50786da47ebcd1e69332512fdee246b02ebc1810fa4630cccdc27911299bbf9c4b54195de539d8bfbdf1a478fa64f5693cc60a8a49d4ca4953962249bfdd2bdbb46d2f2295bbca4c796b989dd5b6f8555f9c9d0985d3bec22b9799de049e6258c04296ed11b971df3869760c20c3cc01cdba761c4d54d13db3bd2c7f94d277572db5f489e920d6d25b99a1338909749245a0fc217c76f1c0813cd4898f0819d45f8a84476967e8f3bd03ddcc802459f1eb2dc6cd46375fd6cbb9f3ca6137e14b966dad523708847e3b5046ae026f57495672edc371ab1480e0e8c33647f95b75c494b9a64ef587b12a35cf01ad0fb956d2cecb61ae3d79319b59f3458fa72821e97eb4ce191ea81a99f8db2316850002afab4b6e4eb83939d81e9a7583acf7da69059aefbfe9af1bbcc607c49523d17533373329c5e98db49d865508016f7c51387bbf28133e9257038c6a51ff2cdc75aa00f2de1f8cc7629b5b141c9f82c7e3e768bacdd13f30449117d0c57427b106d9b19ff8945b7f67ef66334312d9cbd0c7221818b09ea4f3f3cf46187f362e62d5644d48e9b2942d8db88c8dbe2f22c654e4d8ba9f578bb90b43dcc624336b4aba78d31baaec3f0639c34e843bbda674d24260dc1924db7ba79fa7485f3293b07220e93e6d0bbd493262de42f17eec511447b04d4d303df27a1c17f9d52ac9fb7b8a7c2bbe7fa9b231bce79e9188276e826d5f5a20b5d9626d36662378bd67f4e6c940172712681899f7dd9aaeaa76d44512d8e9ba8e7839c8cca0db7204871058987b0c3f9a89099254e39466201aff8fe04dd1603003341d554a9f05143c83e71817d44939493dedce903db42bba3cee07b5618af1735a94fc8af30ee642f6900f89b514120c0e071a290a5123c3fc6af31f75226d1b3d5993df3da80842f896d1bc51fd8ad7f89a160905e59b01d2d00486e2f4b3ff0d8926466244a6848252e1fe5e8e5e19b750a511d164869c3b8d4155e4d51ccb776fafdf6f5807bf743f485eae20fa528f28c41f3c2ad689b17676bad25f33de08d2e3a6574c761121f210693cb44ef0bf3f5ea596f1feff19760fd1d583977356c61f8977b2fb7a029c593a9591809c951c5100d75b5a08fe52942b771fbb909378d0a5e00a05f3cd5722d64a94df0f69228c02f8c4dd7a5ba5123eba01c75ba34f515690942f76edbe5b41fc1ed971ae8e10aada363d3626029be630f2f143d336c8f1a6b2c42e59e83965f429c43b5b793f621e9ff6b0abfc3aff399eb32db8c40eeebe2e22a8f7339e1cd55eb021b8b3ae9bd09d24698b744609cf808fe1eb7504680832c210abe3c2d2a67fcc169a58ad42e5e50c8a7bfb1dbfdf9dce92bacf216a9609159d75fd1d49ea405474badd92f2e24913d886a647611f4cd5ee564e7eec8e7249396f15b3bf9484e3516bc16f7164867f3c7616dacb08944ff80c030c14c9da6d39a992591b7cc1b29dad2a04a3c52559604c44fd2543ba6cfc3434b3a96009ff1a7b2f4bc28872dcf4d3064723975ee65708051770238ac2d189853a75d8138ed8f5d6113ded39ab899d5036eff818cb8df95b0da572b1e83bdee4f43413879e222cef42b31d535b19eddb0463a04129a8736cc1132072a20e04182a1ae4132707094467473ed417ccb01db79344de491228e7817f7d0561e43f0e0e3da0e4d9a850a39c2a42f8d9cdcfaa15322c23ed0efeb399346da7e326bb86d3a041cc38032a8b74c2c3f199cca9d4f83bbbb9cd1208690c927c576b81ce4eacc0aafa8c1c6f5852a96e9a14de886c5774d229741c0963ac96b44883f0ea8207d1b60b0af19f6805295966ae0748b114dd79507698b6fae84df0898d29fd5cf973fbccd4dd9f94a3ab563e1cec150843ffc43693b080f1da1e21cc50d5d7b6bc9e700d700849287e5434628b8200d82ad177c712a84ef5b7e6c184bd024face9ae92e392ce2a4285a336f34e8d482fe5cb9f7d809c84b11ab9d2c8e3ee82be70e46da634e6ffa6430ba7ff821b20902b22dfc19d72bc2b832148f63fcb1c11745837645526d074397d8e467710625fb8d863de2affaaec89dd1d344cbd04889bbbf4f04236f728298d6e21d33e9ffaf8e230388ce3ff657abe61871f5290a8b3b659ee62c455a675e1f12c8914357cea7d6dcf541790b5521239ee7bf0539cd45fb7a43a200fdc464306706f2e4997c4fdc6c29576ecbd17e4b7280968d67a1bbae69efdec85d444d28e550e3807904febbd1fa56b73d705b2f82c2c632a93f4d2621d6002d644a17ea3152dbc9747281124ef49e61f13e376e8746a97851cecf4bbd500bc3a980124a884125a3c5450aed3fc53df132777c96d93ef82c20bd945d58e980bbbc073932cafcdb6f4c9e2184343fd4cfc171666967ac11b905b05f3366e9a8358cd59705af47fcd2b42f16c70f2f24e71ee29ac2f668245f56683cc50020047eeedaf9720684e2a8808ec4c0d2ea8b5a3b84b4a00002fe756ba05dd05574f962856aca9928943df60584c088493008babd715f2f76310b82243aa8b623767a4bb2cdfa51b03bc4baa68df007394a338e39910b3faf9972ab52d3806c9fec5bff2618febd650e4a33dcea5d764a3b0f6459266b139f9d6cc86a460ead6493c14b3c680645d0cfab4df7208c6fbd629797672db55c72706184eaf18ee1c2fe0e94e244d4ced968bb348a9fa6655227dc7b722e601be35be1fa735c84c6bb8c9e363c6d2ce077a80049b05fbad7c693f18fd95de956f8d85957da1685225c35c46656a6b5ad9120cc1e3cb3c8dca4906d97900b42af50806bf7a04f1945003c12c910791609f7df3da75eb221349e09e9508f9a772501456c0e8f8fd59e24205986be6b3f349921b507771dcd59e92d9fbb1ab87f59fc2446fe0e4b0837cd9c9e10fd55494496e737317db1c1e699d37129134f9fce957b0b0d44614c3f0c5db9a611d267ee5de382715ae0f784f46d2c5257d1fe162f5a3854be1750fc5c768069ccb8457edb31e1c496121ceba2a50ccca15e8ba52c90d4e41a3d1c07b26062955ccc5e1d636554fa003acdfa0a1a6dd9666190464e70f522d6454d105430f039bfc057456bc7db5bff711856c11144dca7989cafa23ddaa988fd86dbaec6c156daf0481aa8d3a1cec95b28d416fb96b6a58d153cf33a981ded0cfe862db0541718a255caf17623313caa3c580a3d2e45408d0ff048f00b5d64f2107a1d1fc5a557c9cd4222ddb4b9acb11409def8f01bf725d4a6e0aadbbab8d751334391622c91b1be2ea1f8f6fb2e25121767f284bdf3981740acbb478e99ba76c2069e5160030dc2a65378238c9b08211f2998b7f42ac67368f15b58ee11b8b14df9edd0b2bc226a27ab6d513ed97fa09a2c65303ddb2be7bbafe7b305fe3fc940611df0bf9a9caf3be0f14b7a720a445551e5ee9c27670b0eb6d510a7cd81a66ce7661a93f2641ef55598a3d10d33bc974b649549602bd4f6e3d88f46a10e1e7ce9835d8144addd6d7e4e8bd2ca156c443d465e2884904dba8b09578cbf573cebd2258f79fb7a5beea4ae6f23bd947151ad092cc64678be3825d271968ec171f7e5a9746ab26d6d86984839bcbd1fcad60e0faf9e03411fc51a7b348ecf32d3713ea35f46c1acd266c7adc9176e80b4f6c4b128f237d3600fae0cef974a476a125479bc943609a10f1fe963a541bbee15ccefeee1fa7b33c4ebc087b31c70a7463f831e76606afa0c8aa662d00cdf129a7a99a9ea6a3c7b664bf26c5f89e1b66e36cb762e92246f7ea3e71931b7c0256214d346040e396a45b7ecfe8fdcbf4a51b20b8b006e8f5669f139466a88c5069bda13b87165f07b4e4f8eed62e85d30190ecbce6202a5a9b027c59d2658bef9c121f650ffdfd0520afe5333a50fe61c1fa4a0dcbaf5e2adb020e00358c68d52470540fef6da8bc1aa5e99d145690aa4c6819e42ec879dbe2aff012e7007a61732092a861b024f1c10c473f2c2b943fa789dcf65898f4b5cc898bc4afeeaf806ea6cd55a05d4d6e9c5a160cbb6236d07e1a718c941948c9d5285d23e2c4187a0755082bffd2145f9eaff2b47c79851360c34919546abc7bd55a1a0793365317a863e309e169b3510dab765611aa75e13552bdcc53a9b286a1c5f42ed9a849bf91d60bb8869c6aa641c39ea75b2ec2e832c0166334a12d1e0bdbddb789a98fede73e96a00b6c6e1f848c4492857233912ff89aac57593cf1727bca0ccc6e188f85c7f3f09a98de9615998dbcb9b6521ff5bde12b5ea9b8e0b33fb49cda5af543c6e04933d032201f064853087"}], 0x1018}, {0x0, 0x0, &(0x7f0000005e00)=[{&(0x7f00000059c0)="1fd3f05af9801642026bde7825a2ef2a17e8a2175b93a2038f47cf7f262201b666abcbc9dfbc9a5e4f45bcd7268738bffbf8e919dc06e7d1f0480a5627e3d90ffb4f557f30c58e741083884b94beb4ead3df0fba53c5c325f669ccedb37f861fc5ed726a8fcb913239e704e76227441ce32f9988ca8dd8d1d62f496638a2b9299e7660c26d9cd788807cd09b5c55d70654cefc0dfc3719294fd938e2efae4d971c4fbe7368ba84059c90b66edb43", 0xae}, {&(0x7f0000005a80)="ef472ec64695cb7d448f950b3f441ef708e06120c0ee82ee271a3537", 0x1c}, {&(0x7f0000005ac0)="8c98329530b10f366319280055a798f72f28f56d9bcefd670440b10d825c8b84132e2517c42405d4c31ff9d8aa64f9a6ef7a9093ac93786ae19ecb9b0f96e009d44d679139e1d648d0a53064533ca83fb0bbf979ea48c10bbb67a0b59f8e79e744f806658a9b1ce9baee91f455a3f4462cd99bb6edccc78c26c8d5490f97a96fe8190df12ae140da23284555ed92f05a40532cbf66ac797dc5c45367717204e588b0a6e1efc186a0900524fba147e1dbc514816dbee4e49226941bd519416c220e8f84a34a36ac323d375337a03da23dfcefcf", 0xd3}, {&(0x7f0000005bc0)="89aa4ebdeb677b1bc08264ffd0561a71036d52b9af4c642907a4e778e0b236f2f6839b376cf678f4c685c5834e961e7b97319aa5e75041c2934a8aff685e6c31581c2c95a607c284f1a1b557eab05f3446331aa1efb663f9b0dfb7867962702a9504c3", 0x63}, {&(0x7f0000005c40)="989471a9426d8f597a46598e8bc02e2bc623be49a8df927f13dd2509f9fd047171f746dc3505beefc4a307d3a91aa397323c1bc18dd4c657adf00019a74fe504bc37a4aadf624abf169fd8efbc2b12574fa6237d91e31d08edfe4c2361571d269324ce1334df85573bcfd7c1401b80540b23e69795069bee5b71abcf7e21fedf4ae1d3c8cf199bc10d6b879aebcc6416dd252c412445310adfd9237afb3b", 0x9e}, {&(0x7f0000005d00)="bbdb8235fb5727d0cede50b64f6e74b3553468ce3f0984c5bdc88400cfff85f396514b8b2fe9035c0f4bbebd835b6d0e9b40df2d683fef21c4f6e1e9330922266420dd1ee8219154365a7a2d90", 0x4d}, {&(0x7f0000005d80)="e4803fa473a0ee4d74396fd39c01b81f3e806dd2d4f32ed476c19036702ad040d62d2d9fb0ed6065983adc67197c0daf5646fb5bf31d3578c514438f343f5d172c71c79fded3642eb45d6071043bae5b55a4b499a6", 0x55}], 0x7, &(0x7f0000005e80)=[@iv={0x88, 0x117, 0x2, 0x6e, "711506ed6a6edfdc669b9e50cedcdb53c23250599ec9def35f3d03876630849a26e0226c32fc4d8be7617752e59b7fd0251798cdfb83210aabb15f7fd9fea253e50dc7b9391090d4a084c70efbf23677fb374e271294395fedbdd5b00c5e3ffc09ba64551f63eda3a86e72903baa"}, @assoc={0x18, 0x117, 0x4, 0x7fff}], 0xa0, 0x8040}, {0x0, 0x0, &(0x7f0000007040)=[{&(0x7f0000005f40)="b92aa7ad8a0ba06004a9ee37992d67f4fe85c9cd30a350a9f089e3b5814b5077cf73c50f2c8e1c7041765d055e7f5ce51160eb9ae4257c4d21bd609cff27d89fbfa38eab7240eebb676ca3a97576bc6c0f86acb487ba0b623c374f22f3257670affbb6b67398b422f50098088fa57e1c9dd632459cab61d5031eeff5b840942b4ede1491a7a51edc9e12b89d65785ecc1a655c990719c97f0907734d0fde0ce0275722ac51bd1188ca9002b1a8e6e31ae54462bf2fd92070a36e45d1c4967d11d45f22d8f9c1b37192b55d266d3e344530ac9254ffb4169e3dccc8794b642959bb09d54feaf47a3969e4e0836b4eb8cd154b3e492d1cbc7245f71171bca3521592e52467f6cbe5b5693eea015d3c7350b6149c527c082d9f404f8bc1ff684602b60bf051681b6fb5c0ceaf0ff7a5918281ae4de88a28c9c3befc52e03a59d784b5e03f3b503493f00176f2c86a3e305d657d6c13ac423f73aefebeef35a460c0c81ed16b720a167970d8772e4f5c64669273f1979fa6a1d7485a21752677c70f71d431ac732de1b6ba845d9369582fe2a0884de72ea85d3e1b1f7f8b7259a73342dcf6930932ea0a56363412fefd3f7179623389c6cdcbc1de108b5da5c51b5bdffa88f1f46e37379c1435e4b098fbabc532bf94dc34700fc6376af6ccb4de37319f1da85aec1f857d1a3263189c3206340ecc08a0439344175c431d86f2b4e952af721e6c994fb9c0d1df73e80e88ee94630b3bffc4c668d674ea9b61dd1571f20afaa91935413d3015ef10880e6439392d06279f8f2e04ee20bb6ce4a7b2efc17eb7084ddf482db061a5c053ca9481d84515ca058548c6b81c3d98351f06ea870c2af61e4ca2441d9c36571c9d995e4592ec010ec3b40702538ef97aa0d334da57821e25bb17e24da65f7ff5825cd9705c6f16d2f07b03741a205dbb42f8ee862f34c0281d63c5abbec8f4022ec5b7b9ef907e4d15942742a5592737756dee6c2f18a7217bf0c0c176181a0323e2b932123f249d55443a568b0aee2445c44a8ad9c46639fb110e217fd4d06f2b80f99d8e3925c2246b288cf0684241247c5a5d56bb1dc6b1cb5dd4190eec046a0c9a2db56fa1f88c09f32705a3a40a661f5d4db73b04fcb335591e349a57d99622461d855ef95e30d47e09f88e3a74b2671f420f7df01c1ac997e8cfa326ba9d75c83b00c7e42509518e24c2d26164a6e02767fcac0c95ea3ab204a21e9bd5a86fbdff245ea7fe4bece293a95e36bf639f4f6a35e3541d7e7875d5b163859e0b2255e227400d46ef7fd5dfa08699d8cc0611b9af98bf4a65e17c7a66e28b9cec9f5d6bf242e003679011c369adfe9962ee8ed58b5a0289648e04ffbad4a9839cdb00625ec7b84dc252381be2ec3f92ca33548e63bfb3527e0cfebfb31f7446532864d3d8c0f20f963a2c2da10a4729175ec3d594214257ac2ec25fc003663f8196f6bc91df81ea9172aa6e6076b3b120c6eb94b5a6631030c4a6075de9533c0511e58f0d4b18396cc2fb90892a660cb8cd54e63b2db9e67db551993c5ca6d7a6b99b2d0f171d34af5ee0f42bec2a196f86c877ae1f337e74c3125f0435bb70ec94758b7238acd15c531026ef3e8078ea1a62c7f9cd77dc40891df783b9e744249cd87d715d83e44b836795901d472c51fbe3d39a308dec8e1c30368460da646d4edf57cf799e45932c9999b7ff18aaa2d6276996e9612ca6acaeaefac0c99b32c13420c28d69c63d6b91578eb34e4956d0b557e57ced7465a5a0df7a61e1c2efa3a3b1fd7991a4cd818018df10dbb63f42ae930799e80f725be6ebf6960c76eece18b366126f58ebd37168b8e83adcad6f0225d53800fcdb523421877b79d794d9f8fed4da43b8546b1a32124b0d9900509cbe537485144b7be47a65599a928cb26be21f60f0de52a64242017e9ecb540016f2e92cddcf000d32fa0317f1952509b47de64f18c08767ea1702a84022904ae12cc777355f06b57145c04718169b3138e826f32ca7b1be921686be2d9aab43dfe8fa627a9eade36b3639b7d8e5a21937e49b7f55973e1d41f209e6c5804494b5dc03dc0f897f45303cb752d4c11a60d54bc73de8ad19893f570c30802d3b822c6a0417aae73eb34042ba13515a6bacb3dd98f2c3dcf33a844065143aadc9015d524abdc4f78549fbe7fb6aadc8559cada1d6e79c50a0831f4f98f42f6f657ca4a30d699cd3e7efd32b3c626bd7b8add160ed8d86c34f136d160dc60d440ae8685cbd882cc2c4532ace52869161c16523747f46831b4f78a98585ad82b1f15087000462b79c0d1405034668bd1f614abda8d16a176f42aa7b9371b7c9115b119e69244a6048852e6f480156e5463475daef78dfb1a1220246fa702753d0e3ef177415e0d9aa5d0357ce722d95d4534771eeff189629fc8ed8972364d0486b6a90e503cffdc95a507c4628c557b214b9202814afad6cdc906c207b37cbbfdb7c27cf193f1a28363781c211f475a4c914ff9dc888fbf66aa549d1600240a2554f804d0d26de51f9237109a14078a7fba9582dcce80257231fe2b3e71315509f7c06448a371443fd4e31191062906231999d6630772fda3f784761de8babc2a76d05b6ddda01ec69eff2e878ee89fce8ae9a66d64e2cf943456c09df2d3dd1a370f92a0d6855f57735639f1b922370800903ed1373baa3707e7cbeeb81446b8f646f92e1d267f2c276cb030eeb8e5eea530f73436702b5b3a06082930ff0e696d0342e63fdf4fc1d067dac530abae0824fd236d505be2b50a046594d11f9e9d46a395a1adde897372f88dbaf14f9f6511fe777351b90853145687eee68e7e7fcf6e6e79f490fb4224dd52d67934d66f014654ec245e7cbe7c84d07813e8e21e8a9fcfa004226a9dad6dc828938e7e2bb8d331bcc63be1c6f3a167bf066c0bd3bb1855c0adc71829d545c9a06bcd42fb075c7ce8272e42dcc3ca63e4a918fcbe45d03a27ddb5e6d8d7fba02752fe6166f5a4b9ea8a0b7f527ed3058fdb29c52fe4601e4239a45b1433f2d67748cf6926d5111cf11aab9f5799685fc944b0188ed24ac1156af47a19243a9b9205758fc1960c55d1f6896b606308dd9ca1b2f994753b0ccfb7029c708dd6fb3092570b14cba45b374e7184375c68c0259d5bcab300a50d6998da2cc4055a38cc10a305a3392120bc5324d2a42b3c2f99379255407f0890cc1956416b3a18d6ad4d4af1c5dd6e65ec750eb31b668484555ba63315508897b2f9cef45cf3f97bf351613e1685998fc13976c2337b26dffe75980534d4c7237ebca2d186deb803f414718d5765cd99a0bb8484e130974d7d2d17cb0acd844e10d9c9a1a644dffb733bf3659dfe4fbcb2a78d1c913d6511b05b5d23c65efa859c487f2b01998f7d299755998fc5674cdcd26f168d126f3147b89dc950f74959b0626edb644abb0965f25ad32218a8add8886898619daa58845cb1aff6a1f17a2372154ffa6f91806c753181848e1b9861b27696d0c75e74ee146f6142245e4531cc9dc9079d866a8947c463cb434f8634a5330124abc148f0d0576bfbfa324f4de2c240fa10db6d1e522d710a81763cd73c44b17b614232179c4bb46ec91044a5bbb4d093734149b500f9ae681273f5e80eec740e51598e4d12effe84ca2b4b3d9fb2ea353c08e1d13e050d27335c4a7537b505e5ed6696fa8292f15cc5c4378e41b6c6a9ce836db6a1f376cc511260726f56881e3b25580f6c2e01e03dbdffb0e5121aba0ef59da54ed988ec9990a74bc82a361eb2f14e7395932954981b27eaa3ea98ebc2dc0f9d150b88d0ad742180eeb54baf2ebeafa27eff09290252c08b8e7f41706d4dc1ab82be2895ab5bdbf43ef167bedd75115b864a6165e49c6dd2060d9adad3add5bdbd7d864653314f6fdd5bf5627ffd5fbf39604336161464f1391f4c356f47634e765028f208400445c75e32a3f2fe780ed14bc1e6358e35e3d9d8c53f425c72c46ea7607003144783174ffc2cfc3376e710cbacbf0d1fed8ec23ba089689a159ef0189337a5eae79e52726705616b92196393557c3fc41863db79103ffec403e4457458cebb2bb0ac9d04c23d3e42e8b95ce518d754e8c55a3163a37c17b728a9709a449789bd7f2927a75595e0def4034d440e5db3bd0f63fe99b114c6c6e552f512fa9f1231cbe36f28dbc98300492cb4d0065654fb850b5a906b907f2a21db95e49cf768bf0578189b107ed57efe2cf8a674878020f824635a02f14e4a9ea8b12fda26dd216930412c9aad3a14f58e4b86ce7d8fbcf1b1deb8b0401d7953520a1c826beeb3ecfd59d180e9dfc7cbb0002656cae37273865b07589235836aed4052d04ff1ddeff86a70b99c9db74a8723cfe994ce58560420e05799b366bcbeab8486fffe935482b1d3605c4aa19ae5f65c148d69e528da60936c87e0de79f436d49de6e27c9b54b88ce4818220dba03ff9d311df0fc17c617d98457e8807e9b2fb4d2b4b4ad0d436b56204c595f43b997f1f0ec2d4fb1eec11dc819ec2b022184a7b41a9fe323728f48fae8b6db177f5e67fc06359c01d9a35d29a5ce0c6eb202bac6768c57df451e2bea6b5d7399df997c4dab5587ffa9a23551f7473243cf671931e18377cb04ea968c5f28cbe244bea846241f50c1d2ada086d8939a20a89d4577be1b13de0771a57eefebd1bd241033594bebf4f6b7c9b41ee27a1634e7e28cc0226cf76a277c2b6260756dee137b1c8b4dc6fbff605f54b9d3a6374f804ba164cc61dc823602642c7871315f62efeba9d1463848da20e08dfa3bde011461f5e1cdd6e3af02893476f8658ed4b3ff8cad3652850752d7dcc26de04f53a47a079d6362682e8bc5daa9478e56f28b56fba5a4b28c9a31fe73edaaeeb34f4542ca6c4e9aa634d8153174ded30ec23b57dc6bb05b2620db049347e628f5206ec4ea52afc13f65d125c6300ed35aa13c038f2f1503e1faf58055ec65dde80aa383e3f5e983481a791efc935fe6876618104df46db27ab7b5a0fce3f8ce7efb347467996a41de87b35f6a38b7dc26666ea902aac7776bc8870e2aad7092088b1b6ee0a9e43c42758068d1a276d25ce6bf4f2a05c231ee3e9fc8ac40460a60f901101e8a5e6459ff11290a275a22fe1b07ed33795f9c7df96ec10665030ea651002b15aa950f160de5f22e7e8977f6df037acea419f40f485f771358ce2e1462dae1038cca15520cae5e70a59ee288c190a3135382e8c3ab3c903f76dfb35a41aad3c6fb8ed9fbb8b767033897c39d12b4068ba10aa1274d3e0fdeaf81c672523085354b927a1071a9a94cac6af4e3f81f0bf60842abd8057dabaa1e198e52f5d1f1d644e3c31025664ca1a245c520a1a29573cf22383437db97e615808ae9a9ebc0c4679450d6ec46fd9ae499d4e5fd599b706dce0642b72a11880f07c34bd868287079371e56b1e6b2f8950ae42ce82598bb8cff6c3beb18b5bac8e9a8162c4ed9800c893afdf32936540b6912eca5b7a95742aaaf252badb2b0e2bbf543a7b94d64f194727a856a143ff650d5cccb62338461958906cdd69a1111f99facdec1903af110115f36c48bda74cd3c1d27def76c5152c514b26c0217444bd531090d3207e0b55f6bf9aea0bdb7e71013bc30957d9741c622d5d897f4fd7376c4b174aae85878ed512ad77285d7150f9a2652bc326c9d18816349856cba8cb947877326a9596aabda64cb5754f2ad6f80dd4ccc977af7705d4124da3a4b91f81465e46d01c269c96c0d4d0c0bc5e98e4c2500c72b75c2bb71", 0x1000}, {&(0x7f0000006f40)="da44810d8ef453c244ed1f2f0e6c13ddf14296e2626488dcf858857d19184b323c9e5e73f3efcf6b088da40f4886b40a144919af710f2f3c9bceedbf03f1b29326194cdae70e20191f43c1848836d98a17eb67bfe15bb251bcf82b68003b019394c1b0885960e83943dd689dd8fe8635a73c87e356866b2dec95fd22fe4fffff70cc217f2e351f38fc81cbb5abc526dc762972664af139f640ab667c3358dabbb406c0c68e6213e7464013a657d308c807167d746a55c82c424e024c8736b1a2ebca5306297275075648fd81ef242fc1ba2b0a9c157bd82b867a2c422e5716f50acd33a507b02ab112c72554f22814a9", 0xf0}], 0x2, &(0x7f0000007080)=[@assoc={0x18, 0x117, 0x4, 0xcc5}, @assoc={0x18, 0x117, 0x4, 0x1}, @iv={0xa8, 0x117, 0x2, 0x8d, "8c5be07caa3512bdefd22d1a5b3c86af75f087135fb84c30cb0813e9bf870f5b253558367ab23d3c488d3e7f98d3dfe42393949164dfd7afdc447f614cf12ac9a4991afaef0002623e96ef38af2e0ab320bfe567bb8a8d12c8c64061ea1326f32a0bbac4dac2362f4abfb222b48c2acc95b4418580f4cfdcd5d9c4163cf0702630fa82d445aef91e3820f17935"}, @iv={0x50, 0x117, 0x2, 0x35, "346bd3edc8903f2c7adad672d88c59e567aaf2ab865a3240d9f7b8c2eefaab57969259c4466ba7d69dac24aaa2d9180f1d21491759"}, @op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x158, 0x50}], 0x9, 0x8000) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_ifreq(r2, 0x89f5, &(0x7f0000000080)={'eql\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x005\x00', @ifru_settings={0x70a000}}) [ 257.098930] binder_alloc: binder_alloc_mmap_handler: 15247 20001000-20004000 already mapped failed -16 [ 257.111657] binder_alloc: 15247: binder_alloc_buf, no vma [ 257.117371] binder: 15247:15265 transaction failed 29189/-3, size 24-8 line 2967 [ 257.122085] binder: BINDER_SET_CONTEXT_MGR already set [ 257.136451] binder: 15247:15253 ioctl 40046207 0 returned -16 [ 257.142518] binder: undelivered TRANSACTION_ERROR: 29189 07:13:34 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msios\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:34 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x700000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:34 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f00000000c0)={0x7, 0x0, 0x7f, 0x6}, 0x10) sendto$inet6(r2, &(0x7f0000000100), 0xffffffffffffffd6, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) r4 = socket$inet(0x10, 0x3, 0x800004) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000000000)="4c0000001200ff09fffefd956fa264b724a6007e00000000000000683540150024001d001fc41180b598be593ab6821148a730bb1aa49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xfec4, 0x0, &(0x7f0000001000)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) [ 257.173649] binder: send failed reply for transaction 551, target dead 07:13:34 executing program 5: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}}, 0x0, 0x0, r0, 0x0) r2 = socket$bt_bnep(0x1f, 0x3, 0x4) connect(r2, &(0x7f0000000080)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(generic-gcm-aesni)\x00'}, 0x80) r3 = perf_event_open(&(0x7f0000940000)={0x1, 0x70}, 0x0, 0x0, r0, 0x0) dup2(r3, r1) [ 257.318051] binder: release 15290:15297 transaction 556 out, still active [ 257.325129] binder: unexpected work type, 4, not freed [ 257.330559] binder: undelivered TRANSACTION_COMPLETE [ 257.331884] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 257.338410] binder_alloc: binder_alloc_mmap_handler: 15290 20001000-20004000 already mapped failed -16 07:13:34 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8000, 0x10) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r0, 0x40bc5311, &(0x7f0000000340)={0xfffffffffffffe01, 0x2, 'client0\x00', 0x5, "3ba5cba20fe70b67", "e8ceaa16d4435ee6432dfbf918aee2d3d7bba1e7aa83fdfb70484e8611609b8e", 0xffffffff, 0x4}) r1 = gettid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000480)=0xc) getresgid(&(0x7f00000004c0), &(0x7f0000000600), &(0x7f0000000640)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000680)={0x0}, &(0x7f00000006c0)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000700)={{{@in=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@broadcast}}, &(0x7f0000000800)=0xe8) getgroups(0x3, &(0x7f0000000840)=[0xee01, 0xffffffffffffffff, 0xee01]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000880)={0x0}, &(0x7f00000008c0)=0xc) getresuid(&(0x7f0000000900)=0x0, &(0x7f0000000940), &(0x7f0000000980)) getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0x0, 0xee01, 0xee01, 0x0, 0xffffffffffffffff]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000a40)={{{@in=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000b40)=0xe8) getgroups(0x5, &(0x7f0000000b80)=[0xee01, 0xee01, 0xee00, 0x0, 0xee00]) r13 = getpgrp(0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000bc0)={0x0, 0x0}, &(0x7f0000000c00)=0xc) lstat(&(0x7f0000000c40)='./file0\x00', &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000060c0)={0x25a8, 0x19, 0x308, 0x70bd2b, 0x25dfdbfc, "", [@generic="0e76286be4ace9b69a06ec2975022ca2678c6f7b717884e66be3f5474e9be80ef36241ebdac837d9b3b7b1c1ebe850de9b18be41e83e548565c9f0cde1fb4d1829d03a54a0739181271e6d48f225bb730209ca1509b1abec5e39f4a42a88f37cb3093ad8fbbbfce914772f299be688682193ca21d65039f4f82e228ac722ea9f3d20866fd7358b396aa47457ad2ced517e60c604796d980796cec11f5011ba4b6e7f62745153640f27d562b48072e63eb446bc719d3bf08e90d3e7dcd94f31b448f0272324e033031adeb58c710b05d0d7ff893b96e3293fdbaca0a3acd2efc948b733e583a8b7b12851", @nested={0x2180, 0x5f, [@generic="65f21c42b7d90bb9506ad3e064f955305a64e10575944018106b428aca5cc8f0f4687f6d18e6a616470d86b66634565360ac4427ff2123bc5e161bc00c1ec0e720c78d6546417591334e57e574880f9931d319071e39438ca26e8eb8b258b93a5e5b8bfb3586d5bcff1d5460dc673cfdda44f73298", @typed={0xc, 0x0, @u64=0xdf7}, @generic="92e9eb85a47d7ace9769ec018920757c4d21743f77297a75ccdadc6512e4e6d6906463c953ea366060aaa46d3d8987168521d2525e1ed634b249e535b5238a01d9114ba11a31ca430f500b95dcd8427b9ecf4c4473d06844698c250b5146aa9b790e7047fe19ba89c47a4bba80154eaf8be42fde9c569a85ff0cd04226d60c65a0cad938c984e604cb2b323a3e2303e513d77a01f46e38e324dbd31a98d07f837e957233398e1503d5e43e05112c64c0cd5a837063ce86b0b8cb0723ab9f5557e07c07dba23c60c684ba4614680635d72254f48669d99c82fd45555a98235202cad973649b0f54414a8500fe62283c496f98c6d9", @generic="e1d08b46ce8155bdde14b597479e5f504a5504ad9a1009e14eb2d4d129da2ae344be654ae74ea24a46b6a1c2e8d1f85098e314cc022085e6f0a0a56e15753f48705405d42d60ba3c91515d1c8d4f48324e63dbe5cbbd1e441dcbfbe89bda0f29f9669a172d807b1662020da681cfac3a0db8c13951f9a2c40a617e88dddf06b0894ae3cb5c74cb84cd1200368242ac7e6fe8b38d4328648a5322126815285715b9eba704816cf36cf30d37fc5b35f7881698b14cde2068a87e0cb92c555d7869c1a3799011f4da751cf4b3de2c2815f6d7de13465b3315cfd7e292332b2517a153e3c7711f2022579faa02b9eddb9933016303baea9bb033bd4555a4d02d8c03bcc0b79de7a4786f49cf25fefa30b4ae5425f88a67f23db4d4fad5c2b508858017d7ba4aef10a23d2fa598485a39735bb65dc684832bdb44b9d46f541aa10b56ac23de4a52d7dd8404440182d551721a8d68879e1cf6dd8d074ecfc3a32ae2ed750f169b1012f412d707b6818c1955dec162539ba14ef6f86384774d1daa4a2207e795264c35df79556fc448dbc816671133ef5108e6fce109eee55395a019e031b8cde94266b36664656db38246f39b250af73de15aaf6e0bc2597b6f2b9e3cf2a3bdbd9d25cb03218d7d002a6f17022e3bef341126438a000023927b82c29af6e4af556d31407b70a1bccafcb00c1b6d7e1602b04324076a772504ad5b137d58dc371e53ba1a34b153b789dd5e428fd9a0ffbcaf1309393da4539662c8b764661f2d1c36074794955001b064f1684c05d21dcfb3f645795f849a1eb133d5f659fbb3201ca67dde0f9248d4ef29f54da03123ddac7b1326f49c0adbe323f953ea19ae551f72b4bca2bce51761037a2c4379bdb0ac19f342c5acd9df5bb6fc999c27ac3bea43993cae05465f1f16fbe2051bb49747d11cd01afbddd9bd1a1086bb16081cb2c3228d33660b72a3ddd367430c9e99a761abd0315f4e098d9270ed02bf2124be5c7012711969db4b1b66abf5b3dc0fb640ead665a0155adf301fa14c12074ba8dcaa109d0136a6d527013283aa71f27ed2bc939d8209d1f354c5c5071583976ea3b01814a273803aa5e42a150a29153fbc6299406b7f0de656c80333533110b18a89252ef0827fbe78be8e437966884f4cd61e7728842dd67c93bb2fcc433df0d54de524613d87f94b67d6595db69dbbcdda3b23643718017b2cb10d58cf0a8225ea5df5199b050c97d14e79e2a416485d2788b6777f9b1fe7839204fdc4adc14e5622e85df43319cf12b2f762ab3066c68852111e5960002b6ca806e466076e245620141b7db22b2f349eee43b425138f502adb022aaf9d85ca487759a7aeab9b7383d7e7e0db22e2703150565bc273b554d396e8678786953e6d938ada294596ba3f452ae8f122f69730d43c631031a4beb4ff8254cc47ee0832ea5093b459313820f90a368c18e7f0ebd0fe5364f11e12bbda6e1ee2acd8e1d7cdd3c7c73b0ac08426bd6baa7dfe58f63f22874237f41489265282fe028113b473f2cfd3ba8fc747c034f280dde297003a45cef38014ddb85c4a66ebe30dc8c0b3907c0958d6018c8edbed1476430b05520c147e1e8b5e280149affecdc3fb386da6feda1d8ff2bcd9b828e38c8733886422cd77a307c8b5a7827ba667efc56caeaa83c8d6e4a497e55af24989f6780dda2ac11382824a4abd1ff760d624831fb79d98d497c74bf3e7c1198cb218b20dc1340a54c79edd392fb0c73c921e7c0d58fd9146050cf203d9dd48869d82774389472222fa6266d43a2204a60c337c5347dd5815d35432f11b0bf5f7a91a554b3f88ea3a15040269804713c41f88d4f3abf12311c0613083d5444969fe1283d78aaae37d0725e025253c184bdb9c9fa509466d2f1fe205b28a5df8572503b3965ee4e54ea5772264cac905e6d5a3a89f15bddd3d96302cf25ad0caa190c838decadca6bbc5bb6f41f70ee8d36b3f473e58831dc608a7b08d1884c86e768b523eb2d32f4e27f4ae6ae55de6ff5f1f436355a85fbe4df0edec17e40a75f1cec51ec964473f95b11fc7fc1c72f4c5b6a78565a93543386ddf4064582404f7a872fc025bb4e132bf50026a665c387336abb60b85e1cca21ec1c69623e4e10ba4d17370042df70c8e5f0321323d49b10a2a7e28f04f904651827bf0b7d52fd641d26b96fc026ba5247e0df445bb937d7463cda5e73795d58988da51612236a790b9254906b397c71535c66c3cccd0fe3c80176165d32914c16425500e2e3b4173cd74e16c569fd4de960534df2940462e369ee6f1983e80dd981c6f00561ecdc58f789e6922cf5ba8ec076079b37779729f06b291a4e1c5853f96ff62b865d2c4368660dfc554bb1d31d6df9b82caef8940c53182a7eaddee3b6e9ed7ddc4e2f7207da9249be0d32aa949367ecfed83ba8f79af456e9f15963daea2e931e937d0bbf9927a2854cf9795e0891356f2c8f3e0e0a30136d170247c29bb9349e8c0a7bf0fd8d9fd85d36ad3694812ca4bd0d010801ef3cc04dbb026445d147bc73f291704a9ea03d212919c3f9be717ab54596089092fd09a32f01765cf0ed26dab2f822501b03bfe34b3c2b78a189db554249d1222da4db9a3b9180ea3b4c3695276800a5e8387ce8b7a969e4854b43a6ebec615523a822af306d0b1112ad6d35b9c797527d02cad438347196382c575a6a2b83a6ac27ae2318c2cc14caae2b18afd492ab0960fac06a6ab65d318ae940271693fcdce0fe436c0d0bc34d8f3a8cea31f9faa16d14d6100530638a4bdb3678b96363b86623210ff1c041a011f60b6bb9959565501345b85d835bc8bbd9d287e0e147caf4131fc8024ae645282cc7e1a3193b4d24f5dc61f8e6186a192a908040a14b738984b76c057eb4d5287bc1a95efdae5653362b6fb782261d008407de6af7daede2d3b3ff2d20098c0ec0f53c75663e5bd10035982f382cb2b4746a456e58eabe37cdd1cf67959db6ff9a95926970d1650d1594802bd3941e1fe74737cf4a8faae14ce200ef686561d848a7c40295d1154a6284e7214c4f7ccbd5348be691f5c5e660137cb5d987a86b86d0560c701411e5942f7665299fe187ae0ee0a14ab8f84bf246e6bccfb730253ef07d0e64bac246ee4c2cdc6049b5d1839d6044105914254512afa1cc2068ec28b78f604349f5d55bedbfc077d7dcd7898d355c14bebfa37c6ba9a1cd89875f08f615e056ff44203fc4f2d57034ae71c7156bee062165cbd2c4b028e2d39646574a02981b33953186b751f0a8e691d400b77a90f9e20530549f9f4a91a0b92ba401039e041f8d732fdd3d5d25c14efb2b40234a7f9641c8f8128d5acae15151408ee6366be68a8695048f05fc16ba5bbc9796aa7b501e354ad0a6e471a4ebca93d9e8b819d92fd802760bc4e916d6ec9d8e3ddca338de2efd91866d7e4d3ca3a6983cae36acf975d9bb4fa82e8b0183c0d91a372eadb8ed7fcfb1075f64ec182cd566e15732f17524a9f040a1450273dc2aecee538862e4e61eb927ed72f723073d5507968d6bdf097d471138045cc04682d30316ef61a40874a07be53275f7e03961d8072e1fba63d6d6500f0f0460af301ca9ed33e04273abd1fea8bdb3d8fea15755d8a78e7a91e2c9f08c7d1f617cdff3660bd3a9b85286a9223258f897ef7c6100365f4218860ced22966a6c82fe3bf1f4e5df039082f7df78437ae96bc30cf34c85cccb37955a1b636324fa7be1c0cf8781ef700f3df119fdcad14f362d55f69458c1b35460aa88290a8eb56fd26234e082f7cc039bf1932bde6515a7d1d9f3940b0f09ee5485b0be8a30f1a11dec069598e4e4c757a912e535d57aac1953428b1893aade71fffb849b6d84c35f64a4b170f2144e67259958a6032d4b1b903d72cf68d2c569dd4005776a4edc678323e70d6c73dbf2763310a8d07fe390ac9f532728c505c37ee9da1bc6ca2406d0dabc80ff7a11f14a9396173f2443611c3e8164af7ace8ea07832486e8f47766ef567befcdcd39d31849610f56948290c3036bff1a905a61257210a0f20822524c885bee5f2be842fbebabc1db97589042c48f429ff435585dd4fbcf1fca0812efaf96deb889e0c5572fe47097b41c5e468eacb1720f6b69fe1c2d46ca55fed97f6e0765e0217e3ffe529d9b3ba5960e6004900006afbe0c95ec8fd1d6040e80514733a5cc80200d1e08bafeb82322ff412728c237b79dbd6af1efbf0312743b00dcdeb26d8e5bf18d47d397738189d481cbe9aa0da16b462fa727f8cefbac9596cd0bbad87c056f04ace42a40de56494316a9406d24d87322e51abba5430ccaad3cdf0e00644d57476393ef7def7096db231ef8274aebbe18b34eb19a2f06e4e0a8209c78460ed37d855b53f919684db669bf51acbd650e452cc9a6db5afdafc0f572621a5a17a469e4c637ff710bb86fcdfb3dea066955a8fbdb9b08e58a5a5be098cd46c72ef278475fd70daeb51d874d3a0fc561a80d6460f6b566ae811c95a64be74df838d6fc2141bdcf494cc5e982d4fb8769824d1228b843646b88552eaf61813a0fde3b041a243d689234ddb419a3005946d6c1c4553b09a577402ff8b9461fc22b97ae5c479e04b265e8d4a44668fae8b49904741ef0beee71a8ad238afb656b47618579ec8e78524c194ccfd77efc58bec4617bec4ff34552bc16b39da4f88ce39e6aa17543716567d940f35ec619bce8834c10911a6b3cb3e5bbe2f332403c0dbd4454a31380864ce809bc0c9fadc8cfe4e2d3d4fcff41bf929a8c263f868f6be5c84050b9d1a51564c6a5f367feb2779205410aa033da3fde196338dcf2de0a1a128f0a6fcedf3ff74e42722a907a2fb135759ccd48cb8415a474023c07dcff35c156c66f4d4ae93e451f01a66578a7595e490cc133c6f19b994e457133276fab7e38bdea94dabdfccb1abdf101756f683b1000e9430870a4248d4bf85c89390b2ef1a8c5d2bdc2d586bda56bb82e2e9595cb8a8d695ab13e6743acab491c66f4985611b92c64847f08b1b38b01142954f77208be647d60cd6a94027c4a7c79cbe36935eb08166851fd3edb5fdcb02aa0095b91344783daa2da1cd21133a817da1194e3298eedc5886786cb9d40e1a854ecec7b9be27c33e17fd6c7c6782ace3fe88eb7ff3ddd9709d5b03666adab67df07ae5a0b5f14b1df120284016863ffcfda69d5fa1e224bd6b93c8230043ccac833c5ddbc09fde523d7f7620fa3d688022fbbd0f0c76134d1cb0d3354e8c5410d7bed206d4aa74799ff3a9263c1c08f4cc2420f44c1a4d2aa0b6649835c3990c5547a1459f37a641758abb28b38c8a461e08270d8f6f2be8e2c71c75abebd3246708ee85e2c813fde6b2d088cb9b0670591b60c485cb2a77628ea17a833b29fb306c00e541e97eddaadb81334c511f2655811974626f6b23d81843703d590533a9038a43f907f579749b784fa220747d8fd50f996e7ad6bae472085ccf9e8421c4e3084a218ff9572abf282310987432dced97af4ee2f9580b15655c41f36ee2fbbd5ddab458f99aebc73552ef39049d1817df2cb70c6eef2d270c89ebe50e74cdf6c844136d10706b9ad6fc26d12f90f1cd6d95d4255e6efdfe49610d873bb6ad604b8cf3186f4ce5ef24dbae354aa0a4dcba7f2125f0c0d3ef3a291163852958ecde3421f0183eb0e43433c626654a2545ee9e2383271b359cad54205677ad9d77c50b9a47b0763022eaecf37bdf3f49d36fd35a815c085fe6cd46e04610ac54e9d78400e4e4e41c46d5c4bcf", @typed={0x4, 0x1f}, @generic="14a935792d7559fbdb4f979bd6cbcc7c948d0f9c812c39fd76fd5255dd54ee223c29509cdca388dd62f198ebd3f1f3cccfe95fdcda7260eab0069c7f9e245e7d844532dc3aa0d797de714efc0014b4d39f409802d298f1c0e6c2ade096ec97d231de1d31522c13b1394f4b69c80ea582fc46d62bf8e1c395132efb596e8d844bb0a41566e6fc9872bbda763765c6a7aa0e3aa6b3a3f98e03f5adc990c97f9459fa654b33b1b8a7d60607c33f1e10c3f50af416072cff63c701646ad83d28917448792c2e8767321af3df1e5549aabcda79198e6aa995a86d171bd84dd3713583969479cb6ee1bea348ddf0aec0c090cf952e94adcc085ee23ae5e0f959a80ef0b8845f68b298001c9e1d93f2ec64a7f6e2dd4d9759b0e631f1ce0d25c74892273a51bf560c0f14972af83c31c00b5d7bdced90562e93b0d03a15980e14bd099cff818813e29b81b40848f4772c56379243953898354c371dbed5238c7e844cb7a93094d3920a3d30516519442a4e7092f43926f62ea326a999e6bbf9b0e894727be488f27a296665ae12c36e05610fb65438e84335bf768c60ea6ff6e8bc1b6bca4529d56e79d739498546774c3cd5c24c8bae1db42faa7347cdf5b5128fd861b35bdb62e79884a5fdd26c7091ea9853e25a723c4b5e408f5d49c50d352d40ccb2ecd5f840ad4d789f9e0fa6abc6bef067eb3f83183a89b0b5a8eafdedb36221e6cd812a3b9aeba1013b68cc079dec4a521ed902bd1082e355d08e464cb739eafb4a58276ed6019fd56cd57027f6f6625ef845b3f4430d4a403fb8c22f2cdfcb803df756a4cc0cf0de8963d9d38119546ba2e0a600a64624e3e4dcad6b97004c3c780f660d8e47136c5570f9574a01e044b8cc1500cc08b42da4bbf7991971adbb45d6039ab680899b31d28feba4b5645bdbc06365da13166c4b92629363de93fb871423e30c5754fdafe76f0a9c90baac6347fb6e6039bdfbf665dd64e40f07a16abc014ac7e0e3c39236bec4b711d5a78987d444aa2e97d3f92cdbfd163548f8f7c15938e3d0fc69d3812bd3ddd84f07599f79f2ceb14325682ed8263f1fb955b21ef13cc0108fb879e7080db0a86d16fcd5ae2a9f61ec056b14a5f4981234c37f4d6069ef2b75c37425d8f00891b30389b502bd174318baadb9a9e15d798cf6d8c3b395b2e7562730ee7882bffc74fa15eac45f03ae46d5be82bc82e172d2d8cb0b923e00c2e44177d7c811138de3298a0f6816f3c039e17a7a3841ea723b31030ed925146432ac6ad57b02f6944d9a4c9b04964a87bb9e3340e64cf440b4e6e3efa3fee68f1b5f60c2beb8caf62229341f496f1b2a152a213b65f4565439eb4037da06ac908b23143b902bd5760340c861eba470717aca7e8ce7a759298dba307c01fdaa0fdcaa9768313c0ccc8a80e13af618af6f31e7d9c969e7ef49a294312f0ef2c908fac86be07b15fb026c4403cfd320e634575dad2efa98e6115cc9f15fbd47ae445fbf72dca68f8cecf48f36bc99bfaa7f88be89825b0531d5449fd882f5b00a90e3b7c954646fa04de077355cdbed1e639dfe112edc2ce5e1e3427b3f255e4aa4af823d8b895a6e2cc4f0b2cdc9a3c0e418b4d0be237f4bfd892d82b17e3f179395a5b7eaa12e384cd13376b7021c335ea572642c04a8e1c2148a91a33fd0a33b6545010d14686648ac57c68aef49450a73ff3b0e2e56b816329b389a2dd8b72e966a9a1a93b0f53698f1b75637a70f60be2fde0bd4a99c82314816cbfba225f90cab9d0d778b5cbd84687a94e1dc10c07c273cf9fb941ba0c81195041e036f036de0ce49d30678aaf506dc2d9d6e2c8603f12e49455f2502a4d601051a9b00caf7ea946cf3b1a9bcb9e650c5a36775451859eb4dd9bcc5d5e5eb508ff57c90a6e95c3fb45638de80dc9d3e5174c4614db54be6a27aa48e59a2939626989cfeae1b16e61a3c8cd453f7df18296ac4bf37a91b97e37f226ca2ef443e1237b9cf36a78cdaa8ae2b11fe0113e3846f9682304d435f60ccffa8c443a9f72a4db5038986d561dcafc4a555bc29745502437ee91124c7be8ff5da3921776359c8f00c294cead7041f41e39b40bcaba0b12198f01010e4d25c7e2231689c00907b4b0b420c29045a0ecb3de91c7ee41b624629e19740ec845a6ccb11a368571e92c86b2b20ddeafab1c68b3dc9fd30de74392d842e8e1b333d295ab195363db73449feb7aa182cbe741ad628436c38eca98a0d7b9576767b134cdb3676ea6251c24d7752efafc11d89e6894f56c62647a8a4ecc18dc325a99c458180150ecc4d443ecc5c15212c61b876a6fb9ea66369467fd0560bc945e0b3229e311ce83ed57018091ff61cf73d720c0e60312600d7d2e13858f4300e36aee001559dda95d834792666e81697c4d06c4c883c7806d2186b18a08898043d0895a5889837699ab34de72e6c4eaf5118fe219f2ad3452dfc89d425de1ca8fa836a3e6dc9c26e2adfc8b42d96c7fb860194caf365df5403adaeaab0b570560903ef8d5274ae2124eb05828e26994e00ecc1b5776969f24668d8d3de2b5beb18506adcbdd801975db62b68c4efc8a9afe43360f3a34c8c745e43aabde689240068119c07715937348fcf8419273284ee067009609ff17e442dd30ef47a2ca9bdb2a5865261ebca444a17a85aa15c0cf9b014ef7787f13b6abb70c4d04d446a71c1dd794ad29fab7d054749c840a03538925dde58176caee13de65e2178e269d0fa38e1f44b82b5f554628822b434e5646f8c60def2dc2c0a9d96c7dcb1ceb912685fc5ef1cd39e9e6f161a34b66eb240cadde89d68b060d45f7384904a03322f7384a011e368e67ce6ccbf7cb2b9c5572695694080ac47ddc062f90170f628c785a9590d9d5c09a1b8b0383086164d05cda945497ce80323676aef93b3ed58def6c7fad6efcdc2bb3774011fc9025f0a5a34061d7984a2487f4e1c79d4d49b062d0664c88fa3dd07c06985b6e6ebe432cca6fbb9855574997ab8b01c5a13b6df5ad281acc8f70f110c99ff2ed165265b833de3504f92ca3e7e779cd6e8bd904a230bc584adc4a86fb4ba286fe97902df8b9706bcb60a8c550812c2df3eb61b49846e9354437abd712fb5394ed139fff3b7838738ba71c95d99412316e5dade81aaf00d76ecbe2970486af2ddfdde2f71890f5a64957f3de51d406c26fefb4f6562690f0486a686d1ec68927bad4140a43c82e5d237e440b95d1f24b4adc0ef733727ea061a15857b57e7c8e11808baf934d2329686a32f220cd150c0c88a54569b7232dd81e683b7714e995be2633f70dc186624aa34fabf450b9ae03c71fde37599a1d0e0e8ae8211337cb340d05a9d9bf7fac9a8e3a68ab66a193a263cf4e82259f86f67a77a609efd47d6b6a814a3a00f4aeb16bb3e77eadf782b8abc7d77c660fabb52e7f0806ae73b8b9f926c747d83fe68d13a3907b35e770ef80e7a6af0289e7715ee3e1b258c2ce911c2a522b98dce3345c1beeb443da9b47a7af6b1983ed6e92384b61475419bc472f1d38f96996894672729e5e10d3a4021684ff04e025a2c0341fc422c6708acc63333e2c241c126703488c4b74b8a0a5d16123add1e763054edd9941be641d9e992255eff9805dde3462023111ec37aafd11b2358fac14e6a24429e382705072f7bca1e3483109a8ee1bae22af6dfe35f1492b3f57c29498d91b0e18c04884c9901c92378ded9217c27c56ee50b35eda96998e046f5059825b2845f3bef9b9f517442c19167a275586bcbe1ca8d90fac40e860a6a9be63ab8d97775ecebff412de9c6d7accc7d743ff4306fcf8760105f3a98997be24c8e0caf41f97039145efadc404610ece224cd8a87b9d4d5a986fdc8a1fff53b3a972a55d3cb85436c7a19a1d67aee7b8e267bedc3348c11178482023cf69a5c1d16581097dd9f097c24b92447db8854be113690970554ef464663e17db850569604a12ea6b879f0995b445d0ac9be655631a21e4b73d53ffc27b3c814d04f0c0ff19c0db6698d04fcc158df43a433b25e57cda70a5fdea54d03037fe12d884388964115b3a74bbc718c249fb9ce36da4f612dcd4a0e00b0b9350d8874014b63e5f33702a31d56aeed4df56462ccb2788b8b3b54d491308caf642aa5cbdd34c345235bdb223c2f63e9725d047e6222d0bf916eb299bc8186cc3bb32bcd3b704e9c5e5cee7742a24b3aa1e1bad8349175abf471b339f8638a743b9aeec463a0095b4acb47ea26b61bac5f2f126b420f3f26515368cdbdaafd6ff63696199cdae937e00d6b6e2e1cc89db616ee77b97998c5ef5091184b3b17187532348e380427ccd4ff75acbc9281d95809090436451e8adcc6601aebf522a414d63a0ea307954e79b65832c0b471036f188657ab69b7a07719c5f29776c8441d29a8d091a68ddf6299cae937c7e65213373761a46f496af9cbcad96af3d6c7cfa337da96edad0ba34f076165f54289a2c833e6749a5040c9395825b53b1a289d1f1087bac674c7f5b07ef30cb93693dfe0f4c4ff61455ed40516be4d320f474887f0b774df4c1a4d221f9425c009d3653c7c4e461a4a6f1985225d5c4dd739e30a799b1e29970dd1a6f61275e7ff2ac5afdcb056cb437eb4b59629b5b44616716db51cd6ddf67ade2acadebaa9a93e9cdffd6ec569585d77d53eda3db57cd9fdf1af88f29cc527d19e928b88844f751252737b9f24e64b9a5e872e80923b08d720ab08f97180b5b5319a2b9f2f619dbdb5adb5fd1e96bbc9677a8dbfd2ccf58671557cf10787cdf987b1a292a0f3ecfe41708458e6659e16f230d03e270d2db5f5b5efb2fb054e0c287182525b8c310b2cad0099fb43deaec19a7a37a5f1693c6adc033580a942ddd6f0c1b2b938db817c63b5ba6d24cc949dbaddd1b1063a975ec1224c43e9db9fe9b9be0a0aa39b6ce840bfed4f2eae481a6d2e94d67a3ee0edb17e9aa9ff3da71b283fb30a3a252e476c464e97b52249257a8842019763546b7abae51a1067da8fd8d358199eb97475ec183fa69d87e891c4865f4175e4f1c8ad39df1305b6ba654c807d89ef1dbab8cae3196847ba9884d88aef13f88a0f0117d61ba97f3117e149aee49c3e9b37e98cee183998d1081dff58d59d9e57d354ce498fe65676c834d5a8a98770830c74e90ff68acc771e8b9ffcdda9b9681f33d0a98880b2399e8b9fed62c0006637befaeb35d085e2156c425c787500a108463b50082e49bd9407f45a2fa9a96082c2c2876ced21205ca2c988387afe55052a4df45c484d87655f87f2a5b8041a71cec0669196aee2a66ac324b1e0d1723ea3c3d7ac9a5bd2fd507cd323d75f1c0713d42518eaeac8770040de7bcd33d8453fcf270dc25eabd2c71987417894764349307a1b2a78e56cf14e26056860e641642c61f88cc1eaaa0825e9476814da216e16f35329831f3cddc3a8cd54c3d3273453e80db07518608f974d72ee3dbe3aecb26da15f2833e7ae0bff622bb3af08ed0662cc0eb376fcd3fcb9027fdb3a37d1c394b3e744ce4c070f135e26606e75bcfcdbabbbb19e15b01628802d1ecbbb92ae70cd6fcc4c9825ba207f9ec8d886e3c7f45db5863b14af97e28bda13be56b5fb386f9ee913240e95b32cfc9f2fd2d83fb48ff4bb1ba80d455b292b67fd9776afa6dbc1e7637a962fc619b3e6ba0f26be726197e4ba0b17ed157f3e12dc9feba45cd2ef79099497cab47815419c87e3160aa6c22dc79f68c1f397b3a9b554a8f58a94328ef3488da5eb3948b22bd5056b7cbe050618cf26"]}, @nested={0x280, 0xd, [@typed={0x14, 0x66, @ipv6}, @typed={0x8, 0x11, @fd=r0}, @generic="76b3087af11a947aa180c2d3bf3eda18d94e0a529229b5a69787b2c603", @typed={0xfc, 0x52, @binary="0546096a969c08c05a5bfa7764cd03e40aa3a7b99eff3498878c9d4e441a263fa01643f3754a23ee3b053b79b72eccd268ca194ca1e42ee1d39fbdbe39ffc112d1e02df5878f5813086d7f2932e71325ff8b1fc515b248f9b63f3a9c80aba3bbe7353f5b6bd9a7480a2205e2948630671f38268dfa85ef198392861a191d780a12f342e779f9264e74658b80df1b23da3bac8b1cac0d1088f1fa5d2175c45f496b83f7c8e2896a68f0f96e9609aedfa29d51d2e2b9f453cf804ba33d6224fa956cfc136ce8ac82924a6039021b41709358cfb50bf8375a81eb5a9220deaf079cf8049b871bdf2b7b439944e6e0c031eabb8764df6d"}, @generic="625952e38196db5a30c2c2009733f412e687cc79e7268b5156fdd2ca5540a52eaaa1c40e52853b1ad75ecd2ad8dadcf74155e160216c4e7928adc7b90bd6daba3caef47937f21a7f3f0a294180889239e136cb706d42ecc8", @generic="e16c836255cd0aec5b6469b8d6b9b273639461b9570d15659a0af568a09792f1f1f98189be708a4f23ae4f19dfd7eca7f2da93aaa93903304ef2a00040fe70a8c9228da9be30ff3f9e3f36d01e12ab4b752fd11ba53c1ef7fc50489c9efefa77b2e38b97afc41924d593a0248e497812b945338a839699fe89f7724bb807cd94f826f3c46fa8c99e4cdebb2d14f02bbf2e158cce2435636fd3bc66921ea69fc7c94ebb47ec6fdb4ced9b3569267450baf2d2b5332c439ba2040f569c46d7eec7c8186759a36b1630cf47b7a8af6c07240cd45a58dbe86a636c031b5827cb74b13455133ff96ef45e5c523c00c91b"]}, @generic="794ab1f2948ab8460b61a7c116c7bcf0444448159dfa36b0979238f20e7d07857e7544bcb0c7825028674ec27a616b1163c8fa41e3aa63a9b5313508b7db85673b1d6fc4c3ac0407527a2181aaf13949d608747d49f6c1694eb4b2d2202b662f587ba1b12bb0287286525bd0a93270612777cbd2e477bb77a8f40483d43d56e38c8ad3a1d2c9fcb95cc30843c66f060d3f354c0e151cb318a770", @typed={0x14, 0x86, @ipv6=@ipv4={[], [0xff, 0xff]}}]}, 0x25a8}, {&(0x7f0000000180)={0x1c, 0x1f, 0x0, 0x70bd2c, 0x25dfdbfb, "", [@typed={0xc, 0x87, @u64=0x7d0}]}, 0x1c}], 0x2, &(0x7f0000000d00)=[@cred={0x20, 0x1, 0x2, r1, r2, r3}, @rights={0x18, 0x1, 0x1, [r0, r0]}, @cred={0x20, 0x1, 0x2, r4, r5, r6}, @rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @cred={0x20, 0x1, 0x2, r10, r11, r12}, @cred={0x20, 0x1, 0x2, r13, r14, r15}], 0xf0, 0x4800}, 0x8011) r16 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r16, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB]) read$FUSE(r16, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r16, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b}}, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0/file0\x00', 0x0) read$FUSE(r16, &(0x7f00000030c0), 0x1000) write$FUSE_ENTRY(r16, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) read$FUSE(r16, &(0x7f0000001000), 0x1000) stat(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000280)) write$FUSE_ENTRY(r16, &(0x7f0000000540)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}}, 0x90) read$FUSE(r16, &(0x7f00000050c0), 0x1000) read$FUSE(r16, &(0x7f00000040c0), 0xc1e) write$cgroup_int(r0, &(0x7f00000000c0)=0x1f, 0x12) 07:13:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x100000000003e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) dup3(r1, r0, 0x0) [ 257.373627] binder: BINDER_SET_CONTEXT_MGR already set [ 257.379927] binder: 15290:15297 ioctl 40046207 0 returned -16 [ 257.386534] binder_alloc: 15290: binder_alloc_buf, no vma [ 257.392335] binder: 15290:15301 transaction failed 29189/-3, size 24-8 line 2967 [ 257.406639] binder: send failed reply for transaction 556, target dead [ 257.418458] binder: undelivered TRANSACTION_ERROR: 29189 07:13:34 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mscos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 257.858511] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 257.865639] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 257.873787] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 257.880913] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 257.888567] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 257.895620] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 257.903183] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 257.910223] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock 07:13:35 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000005c0)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000580)={&(0x7f0000000300)=@bridge_getneigh={0x28, 0x1e, 0x701, 0x0, 0x0, {0x7}, [@IFLA_MASTER={0x8, 0xa, 0xfff}]}, 0x28}, 0x1}, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x8, 0x18b142) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000040)={{0x9, 0xfffffffffffffff9}, 0x1, 0x0, 0x4, {0x9, 0x5}, 0x1, 0x3}) 07:13:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x500, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:35 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000100)="025cc83d6d345f8f762070") r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x88) setsockopt$inet_int(r1, 0x0, 0x20, &(0x7f0000000200), 0x4) 07:13:35 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='mspos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:35 executing program 1: r0 = socket(0xa, 0x1, 0x0) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000000)=0x2, 0x4) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f00000002c0)=""/249, &(0x7f0000000080)=0xf9) mlockall(0x3) [ 257.969069] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 257.976213] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 258.037539] binder: release 15351:15354 transaction 561 out, still active [ 258.044559] binder: unexpected work type, 4, not freed [ 258.049845] binder: undelivered TRANSACTION_COMPLETE [ 258.057055] binder_alloc: binder_alloc_mmap_handler: 15351 20001000-20004000 already mapped failed -16 [ 258.068741] binder: BINDER_SET_CONTEXT_MGR already set [ 258.074178] binder: 15351:15354 ioctl 40046207 0 returned -16 [ 258.074538] binder_alloc: 15351: binder_alloc_buf, no vma 07:13:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x48, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 258.085846] binder: 15351:15355 transaction failed 29189/-3, size 24-8 line 2967 [ 258.095850] binder: send failed reply for transaction 561, target dead [ 258.102905] binder: undelivered TRANSACTION_ERROR: 29189 07:13:35 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0505350, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:35 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes128\x00'}, 0xffffffffffffff9a) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x0) mount$9p_rdma(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x40000, &(0x7f00000000c0)=ANY=[@ANYBLOB="7472618f733d72646d612c706f72743d3078303030303030303030303030346532302c74696d656f75743d30783030303030303030303030303031697b708d696d656f75743d3078303030303030303030303030303030312c00"]) 07:13:35 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msoos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ppoll(&(0x7f00000000c0)=[{r0, 0x2043}, {r0, 0x20}, {r0}, {r0, 0x4}, {r0, 0x200}, {r0, 0x100}], 0x6, &(0x7f0000000240)={0x77359400}, &(0x7f00000002c0)={0x2}, 0x8) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x10000, 0x0) r1 = socket$kcm(0x29, 0x7, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x20000, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000000)='pids.current\x00', 0x0, 0x0) read(r1, &(0x7f0000000140)=""/219, 0xdb) sendfile(r3, r1, &(0x7f0000000280), 0x80001f) socket$inet(0x2, 0xa, 0x1f) [ 258.250551] binder: release 15377:15382 transaction 566 out, still active [ 258.257604] binder: unexpected work type, 4, not freed [ 258.262896] binder: undelivered TRANSACTION_COMPLETE [ 258.271204] binder_alloc: binder_alloc_mmap_handler: 15377 20001000-20004000 already mapped failed -16 [ 258.285872] binder_alloc: 15377: binder_alloc_buf, no vma [ 258.291539] binder: 15377:15383 transaction failed 29189/-3, size 24-8 line 2967 07:13:35 executing program 6: r0 = socket(0x3fffffffffe, 0x3, 0x13f40000) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2, 0x4a80) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0xf000, 0x4000}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)="6272696402000000000000000600", 0xfffffd59) ioctl$TCGETA(r1, 0x5405, &(0x7f00000000c0)) sendmmsg$unix(r0, &(0x7f0000000240)=[{&(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001500), 0x0, &(0x7f0000001540)}], 0x1, 0x0) 07:13:35 executing program 5: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='bpf\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="6d6f64653d6d5c4688bd7e075b4b65c1d20714c9b699e364e388e2babd728843a7ccac2700425060c07e9008d2c21c9af19d9c0dc2c257140d30675ed9e8f609fb109c898982da239f"]) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='tmpfs\x00', 0x0, &(0x7f0000000180)) 07:13:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x7400000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 258.299937] binder: BINDER_SET_CONTEXT_MGR already set [ 258.306736] binder: 15377:15382 ioctl 40046207 0 returned -16 [ 258.315998] binder: send failed reply for transaction 566, target dead [ 258.324941] binder: undelivered TRANSACTION_ERROR: 29189 [ 258.500316] binder: release 15412:15420 transaction 571 out, still active [ 258.507305] binder: unexpected work type, 4, not freed [ 258.512607] binder: undelivered TRANSACTION_COMPLETE [ 258.521745] binder_alloc: binder_alloc_mmap_handler: 15412 20001000-20004000 already mapped failed -16 [ 258.532460] binder: BINDER_SET_CONTEXT_MGR already set [ 258.537794] binder_alloc: 15412: binder_alloc_buf, no vma [ 258.537966] binder: 15412:15420 ioctl 40046207 0 returned -16 07:13:35 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x41, &(0x7f00000002c0)=@nat={'nat\x00', 0x1b, 0x5, 0x510, 0x3a0, 0x290, 0xffffffff, 0x0, 0x3a0, 0x4b0, 0x4b0, 0xffffffff, 0x4b0, 0x4b0, 0x5, &(0x7f00000001c0), {[{{@ipv6={@local={0xfe, 0x80, [], 0xaa}, @mcast1={0xff, 0x1, [], 0x1}, [], [], 'lo\x00', 'bcsh0\x00'}, 0x0, 0xc8, 0x110}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x0, @ipv4=@rand_addr, @ipv6=@mcast1={0xff, 0x1, [], 0x1}}}}, {{@ipv6={@mcast1={0xff, 0x1, [], 0x1}, @empty, [], [], 'tunl0\x00', 'vcan0\x00'}, 0x0, 0xc8, 0x110}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv6=@dev={0xfe, 0x80}, @ipv4, @icmp_id, @icmp_id}}}, {{@uncond, 0x0, 0xc8, 0x110}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@dev={0xfe, 0x80}, @ipv6=@local={0xfe, 0x80, [], 0xaa}, @gre_key, @icmp_id}}}, {{@ipv6={@mcast2={0xff, 0x2, [], 0x1}, @loopback={0x0, 0x1}, [], [], 'veth0_to_bond\x00', 'ip_vti0\x00'}, 0x0, 0xc8, 0x110}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x570) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000000)={0x4, 0x401, 0x1, 0x3}, 0x8) close(r2) close(r1) 07:13:35 executing program 1: r0 = socket$inet6(0xa, 0x6, 0x7b) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendmsg(r0, &(0x7f0000000240)={&(0x7f00000002c0)=@llc={0x1a, 0x33b, 0x20, 0x7, 0x400, 0x7fffffff, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x80, &(0x7f0000002640)=[{&(0x7f0000000340)="b3921dd546b7ae27184f715e78cd89ce019c78afbbbb7ffc81f9adbc7f0a9addca741d6ae3b374b88db8dd99468b00dcf0f8bffc774f1c086f983492a1e034bd4efe3c2af3a15d9e43ffe222ad2619de480af2391cf424fbaede4aa20177a49ee06180940f9f4168d99d476218cac839291aa432b2f024fe8f4a81946e62bce54c226e118456156d4ead101492d862beb7bb9e22a932377cfe9dab7738ee74d300a0b90fd55f7bc755777d2388912c02ef13f140091ea12ae0973f19d18f472fe9be348c7a69b9270b6d869f9b835bb28474fdd8a2a25f76b2e386f552bde676d6a6a24b0843d0478caaefea31a47a1b1274777be4de4a687a39672266b0c135a4df752fbc173afb930011cc862c589d9c3162dba9a25d47c0308c2f3b2e6706550fc6be15b1423fa0fcc600c4a4742f84e65ec8ac3c6de187c5c26fa12411ac65095354887e55b59bd470ee181194edf05b6c3979f3ec4f5b6f074c91650069166dbcd134c4a564edeeb68d27ae51d85e9359357855b040ebd2ad62f1c40818f7db3bf863c82f98678fae17d7e6205937f8c0b0640297d81ba9267ddfa5257a6c10e57122289c0cc552cd0097336bd4cdb490a074c2aab85e98737210b488a73b0bad21ad583a0bfbb53e4dcdf281a7a25118c0b28f1c1397d70fb2ddd404945c3fde5b2338a3af51c80c517455f918f7b4e68b9cea55b5b86852d04125cccf8e2d5365fc46f1fd38bcc0193d91111bf8aad92a5d81a2f7788bda2422970912b81d9d1fa8b335cd58c388f48d7ddaaa7da2d316640b80552fe52fb0a66e7ab741bb8be7dc2950176ef423044cb3d7f746016f9d98ac240222e175b8169cd6477f0d31b2f0271a059eccce80191a3302058f1c788db3c1275d9aaa3598c18c1b4c7cfe3de9ec0e3ef8c86bf4edf2a0f811b6d7b24780d09e319c2250f80ca46e577422b351c2a1dbd7fdccd3a4f8836e845f49026547234aea10f5cf783cd24b354e48a03fb52a8355a5fa8c3dd8edb1c1df3e5f12d156ca557d49adb089d8cec910639c17c7fd6ac1a7eba18b4092bb4ffa61888e5ab5a14dfc3f443fe928f9b9b0c4bbeb17b1ab2d358bdb626d28bce3806d5c849e70d19478d591a885c1fbda2d37539416a9ae65ff2a75a77e498e86b6f53fc20729e8b0dfb9dab173f4b1511feddc5a35530d001fcf6155218a8c2cb83770c52792ca50d6168ab40ee87cd7bc312cb4d2a8b80333aefbe56f3a7279e1e9da554e6fda352afb0aae81208911cc4d312acff36123249a6fd90cf11002ab44ab7957cd9503bb380d18ff9e0601650b60319c366b73a18a3a618cf994cac3ae9ca63e11fc4adf4a5d39a56299db41307dc60bab1039a09d1c7dc91431df8f84c0f5f0f515560208ec5045f1e58cfdd8a2284169be5904942193d0e210c789c1c89eae9f1814e725ca47b0baffcb346b84b02a677af41afdd778aabef6ae4951387d95d00f43a1a89c8fea1463c891a11bb5bfa96b86d3c5a2842a2c634cf2ede9e3b029418674b10749ac12a5cd6412187765b67ab0bd302d30ab8beb6538ab8ac6b0ea0c7552f0108721f119ba7f1e33b6b724ca8611ef541bc629e026b0e68ead57c92043dd58d093ee81f2901601918d8b1bc89ebd1f8887892c9e2be5e2b23dab25234653d540de54c433cc8e9320d4c96e3c8926bf85c0f0f7e4087103a30c559f584de859a0d738d479a2fb769fc3c043b0c8195f64776ca76828f8babe31873209aae4d635de09e561addecc6dad032feeddc2f6f6dff03d039c64af2022f9e09a5a7b548d2d373f3a85e93c128a40897716e0bbcac3cb1e3f5e1537d1ccd475518ae9e975134af6f444f6e991eea71825b53e2de6747d9cd64306f1b3ec0b89ffe8d080752b5cf8f574b08f05b1e01bebe871163c47dc6862a02feca0732c070477f002701758a4449c29f396a2785b1842012d527eafddd49928dba2d22689b9425ca398daddc1040e5e047aa457062f1f6d52004fdc7c07a98556c499b774cca85798d1fb7c3a7ebe19c13de791b8254215b52a6168e1f0eb03fe59486694be12a0b07493a96ccea0399db775b40ea28bfce43e0f11ab4d5b8bd5ccee339b78dac3230ee598f6b934762ae48d25e9562e4553b042d019e70cf18945c57b9932a916cf0ef57df73f68a7c5e0bd5865533be4b6b61927cc09fe3386e3519c3cd456603df46f2665fa808f93fddc77e5aef22806673f287bd584c8b7de82e4bc6f28bd2b7d2c666228d31ca819f556c9e3047df114460e6cc07f35782eb351f82fd30d3c5eed01db33970cb49dcadaa7fc1e74c87a1ad64e538eee62702b72879fb9ea9dbd3d9313a5663a4390617b92108c07fe27c206410ef7fc47e72bce988ca4d0759cac61824a6cbb9ecd2a50322589d885c87c8767a0b669a387edd29d2e7832263c4c52819b6f0937b4106c301ad002f5cc3abd89937e87c84b0f3fd4517fe4cd772d91043b635c1c63580afb3a36f94cab971236229e1729678fb3482fa9038531040603e676a0125d0f33b72259699b90ffed61ffb06b4bd1365cb1b23c95858eefeda06e0475d349a3944c05eeb5c4b461168e8ef23b4dc4850f818f92c85ee570248929b3503665e2b1d29a311fb30a6e6969fe8d833ccb12d5f0245f590a1f4c8548f1aabc48026e3dc80f108ed7ff290c403a49cedd8071402c32e607e9dbc511ca934a777f501844973ddde6d1113ad96a57ac57ee2f9ceb7b7ae00d7d2a83bbfcb5be8601f9c846b981fdbb0dbc7914c3237a595b11fa3254a9158b489d2121cc04caa90045ff48eadf2fa685a5eb2a271ac34bac09db99267377739acfaafcc198f183016ca3156ff4bed2e41c53aa98adc1b921b61bccd6a392cecb4827d290f43b605411f948d88b455f2ee699e5f7eee974f95ac4a3f2cac30add2e396bbb02394d23c18644fe3dae20d4959f9a3bfbfada42c17d3f0d27c811c4aa4c57cfc2041c1fdae96e65afd4e679a0b58a0c961a3d96fbe07be47bb0012ea98765a9d1a65264fa2477292c08160f2446188e4725309f999faa111e6f4d8347258e06c1c9dccbbaf856ee1e5bec6f290441e74e5c01560235d5b3c0fa0964fd789d023d735471e38566cf7ff7d221c338f07b7bea36b4b44ac1768c8f3919fbbe54485a2f2ef626eca22e721dde0663746f745bf22c1a2cb787e8a4cacc63c238ffd08d5506db0d856daab27b759a5dd6eb0ab894396a2d3b3ba213c5346e917dd6f504685f874b064df1607c189747d08f72465edee841e3967651be6c9b7b391b8167f8202909c7f5bec2cdb8d718ebc3fe3a89019933005b957e217b970226a4d69e58173e9acc787a432115bd5cbc83796eda2e84af8e329e0eb35a177da7b87083362d9ba62f989e3de54b912d96e9655a3df1249a56d52a65c28ea4ff11e78793bcf97a432debb0ffd43402e45db41cf9fc17a151ca79e681e7b9d1df4e8d6a9b9f926738b3076fe4dfae13d267e19b8fc1b01f83b9768a2ed802f26e4881e22538323923f112d0861b67394207ff8f92280dae686618d4147a07b9cc753f03bed2727d32704fc4c58b9bde9e9ca3567ce5433678f900e88ac0f89f1e18d2a0c83f95323373f4bda0ced2f1e7a641f96f5ec471827d5af707ecc5b6b8689c933df05e23e88ace76a5f7441287a5603544b2a42a04a3ed68353567888114ad5befbd8b6e3c496f4f54500698ebacbe51975879cd5966a31c0c12ec5de42e4d78b5ce2e3f7df866bee46ee241b1639fa75af72f875f4921626247c27aca9852eb9ea761b2abdf5512d9869623449a4de3816dfebbf7833b13781199df4f3c2d7721151cf18bc02f29bb67605a87695a2485d8368e47b497831fe60d579b3810b242e225aa43fbe2a29245e8263986d7c80755d7ccd8ce033140d39eae5fd10ec1586ef4c8a7bf55372f01e930be0e5c8d5fc02874b2082410bfcfef99563b9ee0c9d05627bcdec880e05de2bcd80f934e8bfff4497df4e9814cd9e7cdaf3cef9c289d54eb5e24accd15e5f3292a28ddf786690b8adb6f727340725b074a8676ee8b4b8eb2af724da0e3aad0c45e6c1f65ef2828b8a978eb831489be9816c1a1c3b9f7dfc5d3a758039924a9332d73a194d693b67023146eb77d51095d7acce4069f7a20394f5407e3301b1fdb668d978d75a04194b30675d333551e9849e870eb3b98ac988770fd7e348ecef59bd2b69b514f9acc80bd5e3edd157edd013fdadd5ab273dcbddf53d5686b773bee859d6af03306c0011826486420eae738200e6a8500cf1bf9c37e020674d6820c13ed07bd6f0f469220a5d61ee9d3c97f4b79f72df1276128ba7709ef6de3c10037d72ea27af0d9e03268f758e24f50045af1b986bd38173b8fc56f9cb4132ad5afcb81c5364cbd5277f9c1481d9fc09e692b9bcaf8e73efb2a3438fedc51faa3eeddf2d3cf8106abb05bd860dc4aeedd300de8a4845b5c2c9d358b51e77aa63e57bb11227e6962422e9e5ff05edb619cca07de8534b79efbf28a14afc1639103db0229b844a425dd3cbd3c1998a3a0f013e9874a000e7dde2356ca243aed0945083a0844b56606ff2a8d0a9121ebb224e94a6b6a7f8e18c4e67c43acbf572f41a1e734d58a3ad226de42b51d2be542d340713c1251e5b29f572affcffb442f81850390d883bbc79f35d7f7149f5325bf398a0f1dda619a06c24a613e7e435a33da70fed064806e16c03e97effdc57ef911ea1910c72433d5c3d5fb3c410988d7db23f90f5e8910e53ec105433b6272fbe37024f0bafef37ca7ae29c2324e5dcefaf78a5bf36c9a461f3af408ed75a83542cea7c329f63ee474303b35429823fd717e98e798ced850151f826539b52ae22df3e4ae7669c786effcb445e387058979c28d4890bf920e6d65cb870ac8ae1879ca8d7446f754982adda0e7e95d020d0f78d8b073b9b7f5caa66b53e2d203cbe7ccf300247a39ad582e262f3a541926c57e21fe21f0b22c339ef994b61cd1fc26a787aff6c389272ec273d13c074bcf6bcde6dc54e698b9152b5e54ed948e18f2713f29841c43379cb30b85e294eff875d5dc5eb7a7e15865002776bd5c459a0db7cab143413d4e6a95a7026638b304977bdb4d1788264cfb0c3a1c262941a8e545a8f9df7983d46341c77919be6f86e9ea2e94ff009114217ecc1296fbcda947f2257b83559455bd292a61ebaf75e00d707121b403d7714c6b891e84929c7def2a05561fb009681585bc3679638ad9aeaeb81afb34bb3f7fb044d1e4a4266eb4148c8530cfbabd43a663a7d9056c9cf56c9d5cf64da304f3033d7c32d83a331af71d5d0bcfe5552b55f853cd89105b86f8ee716a86bd684cb71e850a9cf1e32ea40356b5c0eba4b7484ebaf7471fadfe4f60cb541ba1c6e46bdc0b75dcf75eb9f218e7ead1c5bb0fdf4f9842f6d99652fab5f58f8a1c6dc4a6452c7195b8d842e0405bedd06bc8d4a8ade7ceed9ee682418d55ec16671c9120b3d2e8a80cf375d38e2d32c9287d77fbdb356056abc6ac761d2cb5a618b8ab5b5567cd3e7da911f80709f69a06535f82bc4b55f12ea71946c289fbf26b5493541827276aa987cb27803946e7d99b4648a8ca270c6978a1e83963df2f9548291bc9f799ec5f6d4ad39e7218efb062eda872771f417221663e7080f2cb15daf837af511c813bae6b9d2fc753353117342f38801555d6abb2b2deb62be420fb75aebb3108f76c3e4e6aa765da320cac6500fc020c0f256aa6bced941648ce590a82cf5983a56099788cc4a7", 0x1000}, {&(0x7f0000001340)="b4cba38552c56877ea07d791a38ba0a2c78f627b33326a46c1c16346fbd970c938749cebd57f818abc7e5664de614b9ffd9f67ce3c63039fe9c48d09f18319763d95de05f1efd9337877c15bafe214cb823da8d550c8caee6e9d38eb9fa249f9deb56cb7e038fbbc36f27eed56bfb0d8f36b5387f979a89a8c3b5fe4f806cb3941d6ea3a577f60da6e4003a67498c16c34d5a78064cff469b54fbe4ae218dd6304f989f194e2b509", 0xa8}, {&(0x7f0000001400)="5879689e73aa04d2e0baba0972eceaba138bbaf3d58720d30422999a009262481edcbee4cb2ba67e83bd4ebd13b1d3c5d6b708fe66354c368031e5349593d11aec0784a29996718c", 0x48}, {&(0x7f0000001480)="d2e1a6337eda7f32421e63d10511ff6d29a95eef41560516e9baf465aca7cfe101859ea2aa04fff5eeae5b86f8f3e55ace01bb7ba148b952b765602d32852bbb70df1b736eeb235aba94213644b4e7b58933ab234de714edd4459fba3c2200ba1066ccd192316ad9439ab4d987921df76d93bfa485c098ede12e2d6566a35cb1e452cdb49579d3bf49448f1ca1c813016ec76646800e7dec39e41c3355d3f69d0d3f286ccee31391d4a7", 0xaa}, {&(0x7f0000001540)="e9abd083b6c5259f3061c5dc7697bff61caf54df58612132b2844160825e3979fd63559d0610faa0930401d515b6e641dcb4281c4ac005aa192d709f1505cba4c7edc62c8876ca7d2a75ae0f1ae82efc7d765149287f20f4011bee8b7a9d9249f85e34cf21f1221954e419f0b334e978abfe49afbf462a999eacf335dd3cef257de0d7086216db744e5cb7deab1a927b816da1a08bd7f827b9f0b260b792976cda978628bd7def41dd14a711eed0ddf0904e36b70e0cd80bbcc573d89497ed5386e0a7538078deb6d86ac30d65e43c7c68e90d5029d8d98165e80693c751f866d9038e313165dc8a33", 0xe9}, {&(0x7f0000001640)="b12195e48cbb08964f6472674f0b0d176e6f535a5ac934d8e78de772a1e4903fc374e872e4269280214b80b3943d684d657ebf909dab89673518541e58253071981f33372de551ea4e16aeaa86dcf2e8f9dce0f02717c7ef7f9cab9b73ea1dd4e537d67100796e6e2bfb7cdf7fcce8bf9028f74c32f50767e52cdd88933d5994562aed47961cd918efd893dd0dd46770d4e488bc094caf21e249c0d98de2bc88b119a86896a4009e25c575c8ae3a2414c0dc114fdfb2029e86d5206bca42a6f73603512808f83741580a64b06e1c5d47e92f51a1e2028fbc60606dfc1961c2dc5c9288fc99fa55c2a9d91f1b88bbd75fb1bcc16a346f4d44dc51e5537ac91e3bbef9277f2aeb05befe114dd84a755746994643cc2841a3be1f831095b5371ffbebb40f0d977ccaefe84e59b805d24f69835d29c1fa764489eeb40b243954d5552e93ac25f740073b4b87e609b3d2f8f0bbdcaf4fd9f5f95259167df52b945adf22ddf81445fa0e64fdbec4176a57fdaea88c99bf5bab4af124f0211b0fe192c43628e8ed68e24ae7c0474d103a177eba17b5646745f971771effd3347111d53d858acaca98be74cc6ba34e6af3ba525c9db7e54d2f836b2d269b8ff3f323e8332ea90a0dcc55034bc605f5156ce5303272d4959b21672d0762492c7e0453364dfa1e18ca4de14b3f7ba78b069ac554f7b99982ae7a7ad25d24c0b49369e572b60acc4f3deba111eed0b44a0d0d6a7b7ef35190945ac1712e7b7b018fb65e1c68346923335c76785bcd2c5b1c527babf79083a1629478241e6f612c10916f965ccf679aa52ae38495b3c78d8c8a225b691d808c12feface396cb164703c9fb0aa1150c03c0be28c49b7cb7ecd0039acc94f753853dd79d2f5f1e43165fcfa97c12390ff7de6ed2b6b3da5a4b558772ff743f6b88599f24980ff1465a6366b8916d94aec914d96e4c08ecdaa5a1164face19667af1e25fadf369163ec254108e37937429e5c69ef19728a27b0ec0dbe3785c26f53d03d4bde978a48d8953c67a875c5f1c2bb7fb7f1ce0f5273a526bc30a3283da2216fd022e883b8118e8574e0610620219537b18f823998862ce8df933921c1b2eefed4097c3f11f144fb362b281447a998d9102c938e02b6fab14a60698860b0636ec32d9bc3a29747d1557078a19803b5dea3acdf78e7cb5cb69ce481990d1cf14782861e7991a0856a85d1a6345ffb6fd03b9cd4bba89afe694e649f0541de87dafa0abccc76134042034987d5e83d0d0a769bb444b9d37384b631a1e4c52f9f32b771a2049cade0a2ecd5e8bef1bb0c6a02d9507e51d19782e5b44f3899ac68646e93ed60bc3d5ef6c431cac127bc0ebf0c4aab22d2ea81952bf37c32c3484901190168749be8af052a019a044135e204ebb7d30c5b5c7a0d180923cc0c7612528739e1cb32a984c27a94995fc4d73e08aca6ed1d7a674d33ab3ecbef6af329cbfa83f93b28d7b86b7c028dc9d2ae884f239069db8068cfa80e5d48717e09b00ba996513655e30c3e162a024b05059e7812bae804841c33ad20c11a10dc8fab52f485e8dab22e59b3e1fd91468cdbd712566f81532a62773d127506bf4d959786e3234484c49400d02fd1bb31488795ff60a6ed827e3b4afaf17c41b1fc01849f4c5d91c705b2fa6cea73381b9f17cdd78c02be1aed554006598ebde170119ab95da9a466c555ab829d86c95b3c6a5a81290a00955d8c40e9b359291e565583abee6b68fe4932aa3b113e3c7c2a91b72bc7dcdbc2cff17021f49e41059caad506aceba92966ceb332ae85add295115f70ae9016cc60e3cfc46f6c3b010ee30d28e7e33851099fa8562724660e7db76d08e56d0e20ec14d576a2f1d4ed1db2dbc41dcb1ab2b42595275074134a343989780d7795b3aa0b19b86ec9423fed36657eab0b4ea0260291b88d91d74a3261b75ce276bf8160df1729471b2f52f97bdabb1bd29e93547f6dbd684a995e58d66eb7b386a1574bcf554b40995a1bf1bbe6692cfc7a9019c61c907b7a2dd9b5a1d0283c1bc68982626987516c0c3538806f405d9a7c4fcb72cfd5d7ffb30deceff1d64622554d01b3cee9f73c9c1b39c435548be5c686b89dde44233b3f015b63600a3792a012c1bcc7507cb322f1abc9d46ead69d16860a0945cf7dd5d32b0a904d7dffd6a0afafe5198e6fdbe377efd85ce148bf0d2f9bfda83f63a2d52bd0d92097393161b3b9b34d45993673956b6b8860a4de1aa099b19ff884d061622ffb7c77bf0d7760f3e22bd2084302fc0468c10b1ff32d85d2ecd945d081907171b4f12158818b90773464ce75971323d6c3da1d0dbb1e859294a833bd4d4f1f171bafe5b85be2efc14276c0ab0bc076818e2184e04bd074a47fd7b6542d46f21903409140500feac5d734d61958afa6960f4d4ae24f678a7dc164b84e2a289110fa2c5bfdefda6b242afd24aeebef0a37476d5099ab729e10293eecba27de492cfb3960b797844b20398cfc074ed2b12dff2ac67c959b5c5cc19a1d3a4deb219699150716b84cecdb0b6fdebb5bedd545b62528174542f60a680ef2fb058fa91d97ebec815215e5f4a998ded2f4883b840b98064dc815f5de5c64602861f81cb0de28052e600b1ab89bd0e9dc942a2c0f80654a3251a3e44c260d132ce56d5411fc73aa0c8bb93bc1cf33cf0881927fa144427055dd91258bfc96d615d67eef9aa65131eeefcadfd3e9ffd8510b1f2a4cd45d8c976486244913b77e02e0ae030e190ef8fd3c8670254006c34b782c195970edf0452b527014e0600df48dfcd6c10cde75b6db65757cf056d56a435ac04ebcabe984e6242161ff0082cd43d07d7123c2a6baaf1f2e9365dd48815ce6f908938d0927609821ade940439fe5ea2dcf2f83ec83e42dc282f437b1ddfea074288b9eefafdbb40318d868efd9eb39bbd4631b884d6c155d32f90881bcbcb82bed72e0a949e9be9ec2d8eccb92c30a3e7184af11304ef530c153633093587bb4baf7c9fea245e71523fe6b4ebeb0bf35bc5dfd6421d20153c965b57cef105c5c2c6dddbb6a19bb55386a0f9672deac6359c1db7ca1b6914bd8d942300d886bea5b2207f60f0990639172e283a9b26d4f25c84b1c990fc47a0774e5c0c205dcb36cd0242dec2bc1595cfe85d745dce99ecd4b914571d1bbc9a478aed5a508b0d2999c2aeb30d461f70a24231323ba6272dbfea1644467d6e663d8c0ab8d8eba510b92a7a3f28a23c4ae6b1b3175c74f00fc4824ce59364a5df8e1c0599c4f8b803d1c7a663beb6fab83e7ac85dc068fb16e54e79bde8946d82d16fd17dac9f6710342b3b433bf0a268771e5c3a89a06e52727d29740cd35ded84fd5f41a6574373e9c4b2ba6ccaa51f15c719e7d7e7a124dcffedfb6ef32c32193dc26a9ac8505ebe28515aa63c90bbbd758b0817eb97af3185a5f0e7fffaffed048e28bfa1a316ef1c82944b6ab6fa73c396a9105a51bc8832735561a2348ff625cbe17d3df7dcf8b137e6e3cf310a1148812a52f59eeafdf7a30b9a56683288fcd8e58d85b8be310bbe72303f647c63b4fc4ab23f74b78ebcd18dbfab434e109fc741f43e4af46398a38c8cb8b1ffa1b56c28b3c92c86a198ba5df78fa4804b52f67aaa2e0a970e9386af9aba65f3e58eeb4e698254d8c1b913042a161eb9bdabc17c837c6de6d1a3e6b8103aaa8d72e98cb5bab466794c6e86e6453ee9e8b64b966208f940e78b530f9f8d9eee2c7189274d904924367c289ce10d48e2d46290e4e9c1df3a39eecbeadba6bf24b9b8a83b612e3675a68066ad281bfc1fb05c359146d39aaa7edd4c2a348cc1ec188eb9cdaa595398cb61d02f9773ae66dc30b6ccdc30dba5f129282ca7b3e3047476ab01a6fd7089bdacdef34516f8fbc7656917722028b865c8d9be44a75fa9eee3825406d053bb44dbe8c5c9db44ece20096b5c4c160d536d80e1dd226c5e45a7c38da6278d920a78925623478d459393dfdb18c768effe988e4777d0a1d157478a8c74439340aef4022faa3bb5754ad7ec2e93bc976abfe9b607c205a4996b10bfeee0d12ba9a2dc0f7e83d358e90d8097da265915fc51fa3c69dbf987179c09a7962f2d6f8f90569d8389304237e7c488722ec36585cf60e228c4b97f801214f3aeea552ccf61f785879d3601431f6199a15d7f09546b9c1cbb9d928ce5486ceb8602ae731ed1cebf6b02717eaaf6115edfb64019cd78280149a9c5228cd8c934a9ea4b3d20082f117139b9ad0151db23915ac7f4dcf47d60e299981a7b4b94ce0613f6dc7d7f9eb6ecaa644925f96f371ab13b8736a9a515e7d1134924f60b5a73fd62f232d6d695b638f846b55da70382a479060a62958b10c4603a9de6a81cf2804721569ede13bf011d3725fae71519e44c9e1f23bfafe953ae32fd3c8527b1d9b7b4e3e3abb7cfe3bdb9d87a750d340d23b6dbefdb6748464e5e77e328d75a6562ecde676b85e14953f4d01b51380e40d10e18007a8f077d35d6a2753fb33c59c7e9b311ebf2136b661a6b1becd10a77211c0a3d7b36f109a0e1a91b4efa64fc09c570e931858a1ff0812b70ac2651a69243819786ffb963dc6061720fa3d2b9bad25d343ab1cf597e544fd201d78345083fe0bef4eebe2ba4acf89ddc5ed9a43d2f4f45fbe73364595915810fede3734da0836a53605a3476820baee40b12bf467413ecc7a80e5f0cf9b7e7017827370b1d51456959603177298dfcc8571ef17c82a2e52f85c06134f0f7143d39931483d3a8b32b7af80a7617d514320d5586e988526ce24b0c8707fc001e45f184fdf0c50751648c95f2501bfe803e02b35c9bb6c05381318b8fd394f20bc303f022ce52eb76f6b2fcb2eb244b17a6dead51d312bc0c02aa394332ab2179626d47f9f132a89cc8f2b4180fff867cdbdbb2dba2cbbfe74cfab9c4618aee2ab32821be1205176a259b6083a7071d351742557f1622d3d8340a89eaa6134725fa81d2961f3fa2be17637689d9fe6664c5afc2d972d7a0d8447c8bf52de8cb5a367dbc59ad929aeb61b685c5f13ea2826c96f092e66c71522abf63cbb321781c0cc4c152d913ed3cee1152d48198d2801cab6273752b268156da921ade787b692059b1e5e658762046121f587bb03b8be3434d89f00053476a17245c539c11454b4dbe900d2032f882ca1d1fd12cf30c78b9efe7f0239cdee61ac58d380578a683c0a72d63a61856df92f6ebca717b9a27b584384425f0c98ab6b41ae9111e332dbfc2faeff3357bbcecfde77530e8a7a11347feadd415545498d571d2e87afb8910e8d5917dbb9b4e94400823d96e17020e8e84aaf06d82f007e4b47778236f6e2683268e2f224e673b87bfc0488986d837db997fd2518db02acedda3451a5336d027e4f57c141c0e35862cd6d60419549b7ac51e1d7bcb71ebd675471caf4fa8be3d82d56803f852e423402b149487c0de7e7c24374827eebd6ad029d16ad3589ff16ab256ea1b6f140637c6d61657c7fafdef14359d7108797679b291314b79c6b79a29746aa7a8c44c9bde5f4af6505d0c0405210df9a090292a198814f584a0f0fa0442680537474b3cb6c60240fda2b223af068c47dc9ff42adbc286b8d4baca080becd81c4482c02a32bf2551408246ac82415f18c7c97305e4764e2d98261138c4b5257ae0e98a258dd068b9fe3d6d848b52d13dccd924149c15e4311bf2305cd696676435edb9cfd8c38fca4d1b7757394a3b25f9a07fba6ae1c2ebf42030cdcb286f1a7f6543dedd29c1f62ee8accab0b5", 0x1000}], 0x6, &(0x7f00000026c0)=[{0x58, 0x0, 0x1, "765a8ccb3688a166d26f7e7d6451c792fd3d53a4a9403703dbceca54723a8e0992749dbbc7f65f8b654644cf8f3630831b786342532e2e97fb0a332092314cd48453"}, {0x28, 0x0, 0x3ec, "9de169599e069bc694660c8fffbd577c56bb12"}, {0xd8, 0x103, 0x3f, "eb0930a0e61366262ac3bee0ca6129b5322f239aaf87987b2626d25afcf86fda174d69fc2144ba085e34423468de14c74304709efe1354cdb539e1e2e5e84431d782c6e7880d015b60930c94a676c22b0577ec79a56ad02aa4a9b1cfc3c4ef8618b00be7a02a7582c75ff11ae907a2e1f7f6bd891016664a6ec6f811f687f4ea538864fe3c1fdda2e17cc3b255d715c657254b0617be3e476b50b2f657d01dc125dd03c6d0fa047c38b878a84b86e7f6a1d4bfed1524cb82c7f8a7738b9a8e13ddf9"}, {0x100, 0x13f, 0x0, "e26d00aa006ee057703d641e27e10a24ab85e84f4972c9fd7a92ebff03868467a4bb5b1eec2e060a9418788a4cbb1451de3c34398ed41e611a4cb975c38e7c2dbe62d09151c6bc104533d3e6022700cb89f71d989e9ccd19972e4bd075aa010c62c730b3bc6e2e7305dc078104bd73113a55ceab031875daaeda720b0f01cc46cc0667d8831143c466ca53dfe22d882e46748e2cc919d6b6ec8550c3eda0b10cd185c6b1a836615be3a374da1439620649373fcfbc99a8a9868ec184fc6c6a3981218a0f75e392c85b5dac3c7b64e62e102488739b4a9019a81d8b1b6c6d33a556f8f5f72dd09be49cee"}, {0xf0, 0x0, 0x6, "656c5d16beecf148f2450570d6c8ee33f5b2f81cde27d40ccd381f144be01156ac74b02443b886055e06dea60bdceefc42db14a8519ee0645a7d80ebd52f36b9997291d8474197f44755a12e4ee0e7cfa9d64a9b14c1a5b2ffba931eb25d427d49f59319ea3fdd2ede1a22b931185e7b7043204bef19c0bc8b382eff14aa43318a51c30af5076ce99781c114ef67f5677e921b0bd3d5b9cdd8b7d2ecd5766ded7a3ea93c07824695b5099760b851e02416c4453ffd8846824933c8b7ff76cda70b6cb095969e180c53eedb7c6677e83553238a4ee28b6974aac92d"}, {0xe8, 0x0, 0x1, "ef0323ffa76a5d1a8ac9f244c6ef3aca78e0500af285e4b13e981f6caf98fad5b7d76c05fc56a143f432f1cbb6ccddb7fde7d0e73059f83ac62b52d354d998a2d92ae3e2fe773997e72814ebbc1b74f6afded57cc703830ea2bef647584d61ca472beb417321bf951c4bde65f559d0eeb5228fd5687e2761a5ccfc9d4657f0bb4b00f5e9447d01205eec7eb8d5ea8928a3fb56bf244665b700adc4e20c1dc58104bfbf11bc95a3d006621eb958cd9f0e80f736529512f32c9c2ef553b17d26208e2f916633ffab3746fe3e40faba823a562d97dd"}, {0x1010, 0x11f, 0x4, "2cd417f7f434d41ac7a78163799b239a73a59a101062ecb7bc4593396c9964fdbdfd7583ac967410f366412ca95494aaf128cfe65187d5b0d2a9b6920c1b7cdbbf1b3bcef0bbfe576a78f04156ce0a7c9e4991eca66702a0d883c4ef8b7460536c7982e33c5169da1ac5d6a035661d35f54e16a647c82d885d205bc45f7bd6c49281ca4a42b06c5a7c0399ebc7e23cea4f30a9464aecfa8ce17081b83c7cb445c136a76894453e4716949b7ff4b9257ec4c7183815fd905e12760b612edc19a3102d020134662f2353b34389d98b5ebca6e65e3c40fc92c5d98a9fd5af919f0f3702c74cd781e4f2dbfc45053feec53ecbd28ee92584e65dedb590f4d25ae5f95f683547ba973b7b482adfbce3fd817897e85f4f25f4487e5ef831d22784912b075c3c1bd2255254ac23c42655776d3ab78ad62c55996bea7de0e17fd6e55b17f186ddd87eb13f2791f6bf7ad84c18052141646f96a8bb752411835df1eb64a894ab9c80c723ce7a880ed6e879d957ebbce0234b117f3e6942c35ce771798cf225f971154db22547122712a08a4eb5a03c72d2d43dc8951e991523059a5fdd12a1269cae42a08d3d8114624d6e09596b43a8068e99ed3e790e41e76fd4ce51c758efabfb368c3727463b8af61e4a510f52ef037fc938e93dc512aa8ae127ec2804d1d1a0b062bc27e2256905ca08618dc45a919db555a94598a8f8e24c97df8089cbc8782ea38606bcda3348c9bde30d9d5bbef46b00fcf37cf6efc2c901c3037c57a8700bbb971984c116ea2af4239facff928fb1e5187ff0db1917d7d29d8ec9e61c3c5f5544a3317c1f227a9067956e1e1ebbe2e19bef960ab9720d372344d9383959a36bc2821ca575fdf91585d74e2fbcade3b4da8abf1c474282ded714e93164d0e1858f31d083f0053b05247d1af4dfc39c2363f8f1c8ba1fbb072a75bc7841c3903c1fff96895679d4a5db7b5c33124316454166c14604edc2cf5cc5e4c58c43e002c8583ee4e21cd5f10447166e95f3c363149547a1ffea72f40fe3911c3a4630369266415ffd726d1e113b58ae181c8caaef9e9763dda5817f4e22c46cc226e3f49dbfda3427ed9c7115a448a204dd76be01987cc73c6224e360f43aa05df35a9b2450a7bf7fc84d27bd69eadb93e86d9d8071a32496c67bc9035aa1744b691095d8f47b36e159069c10696157d041c146b23259c170f27c5f8ac7fea366d8521e5ce31975c79d708eafbb2d39885f4decea217a4d789c818a418d348b4a8ed3360986ae84429cbaef188e9fc05db9694d700d12b203c6eb971d1504f8cd5d74dc4bf4eeb143926bd40d4cb721e8d86b4bb1441019e64864384e7026f9b4da66e4bfc974972e7dc719bb18a608119ec21e6c0a1c9bcc539662e329408883e2a5e9ab27bd5a428a3928954c5663f1770ec5542b7b646598d24a30b362f55d5bbc1ae870b2fab14caedbea91cbcbfa5c14226dab01c1a3fcbbee396d93f39d3a69aee548d407be5aad75f2b3e33e1f262b44d9ea63524961ef3a50c23bbc7c444a2ac562970c2961cfdc57c7b5321200bfb9db719c74192df0e51d993529d0fee4474d6e0d8d093aaf606c2722bc98d2d94f11d9d90838909e34922b12d5aa941be5066fe29137a390a529ee8cc61afc73ecb5fa62c89b196e587de175bbfcbd0faef1a18931d47d56522d8c3322b3b03e0fcce1ffa82451c98f19e785f17a8b432ecdcdea8616df5eea109c9fe2a6978f406e7fe5bcdab05b9f2ea54a0ad9f22452503c8e0ca10859bae0fe1e204b200608e19df0787afd92639e51c4972681b32ec4eab5d2de393eaec68ce6753873a1fd81a9b7b7e8741c0ba1cf57580edb5edc7aac8fe3de79edc0354fdb28e6619e7e432de9d4f2304fbc5983d01d844f5cbeab1a4961c4b67f0175a97054d809ef39c85cc674b2abe01dff1c337858f5f55c79b6a5c361b59f0689663b390646bce6e0ca3649f02e1d1055a7c77faff26dfda0b99859d186b85c9d7c07a6bd17319c56a9937857b36d9400cb62d8302b924ce031304321a1b67fc1de3945fdbe04c2e14b63f92351dce1192b2f99fa05ce9bf3e557c74595df794b46200d51c7782d4f481a6222986a9f784427ea717acd98c71d03275995a0742dcd65a8c44240946062ee91d38c9f76d0e4f7eb7dbffd51fdd04e330be6d29faf5572ac6f92cc6472d5039b1a42728c1eed859a509f5761c7f641e634b08ed72447d868f6d1facbe697475b3675dcd1e976d75f0a8c4a49a501882b5e2b58e408b0e7c1959315b0e9277faff99701b0b4d89fcdb09524d7aa7b5778c16186cbaecbe72ed46c1762087a7749c01da4d9741c5ad8746ff4a22eb4d1f4a39da410c338e5e7a6db3746e7030be2bac0c0091ed93883ea0842f6ffedb6bdda2690c55cb5fd74d9f0e56dbd7ca54a711286d418f7070944e1055131eed86d33d3b249083ce7c86bd354e074cdee8f58e4c971a55d1ccaa16cac7e9c32d95206b33e938d040a42e6e566839229e59f41c8ed1e56a3896265d3f13136e994c30f2adfcc020306aa9bbccfc932fc797285d575eb863446ec38b3c09a325d5b1a7b792d8228becf2c32dfdfc5e1acb31c97904fbc7c6e51b15a1b244b0775a3e8638f2fbcd00896237f11942ce695790229f18ef635cd470d4248c1da9a9ff95de93845c73d9a4dd7405193a58162323fecdd6d279b0523f60a3248920f975e56c3adddd9295044403a12ee38d01888c425f25afd93935669360399e2603164d0993ac136b28f2d108cda420a53c6626969bb4390e18f2d566ace4d5e236240070011190f3b54310e5001c7e61b6737c89b51e307f0d0bc97bad9d1f4990d26bf15104067eeac03dae2d309032830aa310673473f5ef0dd3b6d793146b4c36d0640f847affc8fe986206995d27c99e2b815eb0bf9f8329d00b06a58c2af8ac4bf08644ec132a74197b4b1e110e24cc07eb3e518a5c74fa941a6ff78a6e2e5d40cb137047d8ae21615f49baf84adf60777750306ffa0c7f414e27c6291fd35c984e8fb903e4ca87ab79f0fad34af9e3b14a05bc464b4c2359d7697b25a9bc34867ef7ab5916e746d1ac704fe2f2957f394cb9f7fc75000af4fcd855b933a5843e7ef7ed763ad7b54ecfc4bb38209e0e05e679aeb750e515ddda6b0b2ed86ab3e24caef86f25bc9be01c3813155d99bac0024a4ea8d2c952da57e45a4f59aed5cdb663f61a640d5b76372f21fb8f8a4efe180d6195f402630eee324ca08f1dfee85579639a4f45c64b62b53e6eec3590ddf19c7cd5fa604992d6826bbc7c15507168bc7351335dffa09d4054acc8f9d191ca4d1d6f31e4f71e304612f7d42bb9fc632f179a6aad1918f260d820bd0c88416d49e555a2013447ce8e6cce66d42ba16a154d00903a6728fd0b246958e77a84e5a5ee717729394b36b60a9df910bb9b68dcddeec2284ef677d565d94074edfdff73e373100bf25c836ec4f05a4cd405724fb5b50cfe6242f6061b14228b35a6dd87e750c31f5889735be254e22033dc996ac6128105b299d2f3956334fb8ea2b02371722f87fbfc8340c1440ed37f26fae027e13dd70d667b76c7e740e22b181cdc03df43a973fee660bd580ea5d75881c420cccef6d37bdc8252f1ecf534857409b261a3322b3ce8479b20a5103600df032d708b4d712ea2f2f0cd62ff81ea2676fcf25e3f277b5e3a5fae3d9b65d2f2ce438c4a0222954b60d6457aeedeca53a7a30d896870dff09585436ce3ecfc40f1b4d52ea099a64e67eb8498050facf02ac4dc83ca1a722fa2874f5205237b0b3a81f1abeb42b49644c718b2c518a6c9ca673a53ccbc59667f5fd4079dc5b9016fcbcc11417d51a63e570fdfcac44b55b2bfbfc17c3fa07abc3f3af77f238436969bcc1b4abad28a6e2f3d5ed5d18dd255a1116eb45f9a035e293f2f69720daa6b7c98596669987cd323b3d98e1ccbd0e2dc9ce148cc0a3ec13ffb8cd5109a1ffa424ea708e833c391a8ede60cbbbdc2207b81a1d4c4bdd6e7b13b5c90e781347c78e82e4f2247650b5ce8ba6fd0385b1dbbf039de17d9130d325a6c38bd384e2c81510fb9b55eaa8035ef288c998de05464478ebd0110c79801656369d72443c731e2535fb3d3953ef471790dc1de88cdc7bf4578437028ba146799e8767869737c082a837ab7c2844f504933a6fdb818a9b3e6930972fab94cab346cc18bc5e164c1e77cd5beca3e901cd08fdf22f2e6c57dcd55893be0030ccde3fb6c2e5092b34fea38953cbb9f25982271f4092a151802f54495f18894fc284e1a613a5ab0347339adaad77f693769b41d5771818dee9c945bc2ecf731d38e00ad839f1b86a7e99b538bb20059e55286c28bfe21f74b155e0f826b8fa5f69b0e29e955289842fc87646ea7a17c4ae626eb3397a4b5ee98601a4bb598264f6bcc3986db2872fef9d74734834fdae4833c9750da1451fbd50a73a89bbf57d83484ffe51b420121333e6238dda32a89ee5a97ff4b3e0638d5148e8c9c2b205fa981af1ea0e1b63e52fcc696e673297777572bd29cef5665da4751fed8e222228cfbbf1699cbfba4f3c6093844e3d10ec79a1337252368fefe3a584cd6444f720d00cd7c2024b7cbe42e670bd7a3db97a4c2e3a86c59157f471a04bac4df32ee779d55ed0f43bc06b3ee47f93c465fadaefd66b12b04c1fa883ff6071146df3d4f0779c668d14d59ffde01bd692b5e41b358c4f8d941cb366955cb03f67e4f84dcd1aa46b284bdc3666018d21cc9bed35560dfa7cbaad9a9a1b0e70e6205dabb6a5fa8e8de03114e480ec9b2b898cbea28e9d8f557ce050fe032934163448fd671585d3160d46690a2dde2b77c3d5845ce4140bda74bbd92d30803200fc55455e67f322923b7a6ee572446d5f1a778191a0961e769ceada66821049fb9e3a583e3b0145410b970b77583fca0995928015b19853cf6fe204323a0c719ffdce536622161378aec554b424dee3bd20548b0fb1ac29c04fdfc67115c61e73481b833319d495c01dfc52da9ca84cc7d492e9327bb34439517ed7fed56e7caf3e582fad21bbee2771c7993d1f515b4c15fd6ec1dded6acc95fa6cb1755574d9d6c382c25bec4f3497c051b20a1fb07bf9593d7b74ed5b370c79cb0c8bb060a6aa1c5e7216fc21a028bdf4ce35f5bbe7ddb4d346f87b71a7a6be1ade2a3c1b6b9fa7c59ead66d6800ee65ee9b33ce5551bd39e26d33d45b53681f7beea2605e371233e353e83a95d64f8eba2a3776bad18c003a8cc1b2d9cdd9a64f5e71600c6e27f6e3d543904d0fdccd977daf6597df84d838c08b10ee7862b555b1e93c885ff1316c965afe907f082f638195e9a4bd2a56d3810a20ac7581253a6fd0da8a670254f242aa29738dbb2c4f63d7f3485a5e093f8a5d6fe64b58459f64fbc96dbe9f7bbb8ee6c1de0f90ccd135f68f3caec4e44a84f552d415e00b67ce3a41ebf910c1e3ecdb5b06c1711b9ae98e613ee16903dcff1957214c6efb4c25355cbfd6f2741b751d3bd4f72cde50af00b43240ba4f64d49820fd2ed476678cd9567cf54d088c3bd94e1ffbb7b5e18be4512ae2084c2fb2bfcf46a9dc24df346647c4d3914206b4177a96d0112b85ebf7848d17f5f58944239ff630bff9306b0145e8b0ac377a9a25ba90dcef27fe4e182418953a022fcdae48f80b04ecadca10e0d8ec5f5b49812dbc71b2def35833a4a0a8c5a846ffadd708a5dc3c9af26b94b5f96a01704d52c32344641c7f8c5ea6a6dc21ef1b7f0bb48193322b6184706867a"}, {0xd0, 0x84, 0xfff, "fbb23519c62c6d6a0c6c50413b8dc3fd3e0820d108f09940b467be63cddc06b2b5db5bc6613f141d1bd0ebf775004bde83cf74b6595b099ac357a38755901118c9516b9f1ca090585abc6b960c0fce4accba796cba817d3a52180938aa8199868486c929e27ccdc39266b1286076f9272dd46e321fe971a3461ee77a318c2bee745812f6df75a7779095599cafb5e7cc1f430e201ff2edddd26f9164d92721ffcdc8fc6cfb3b3fdd096f24140250cce8d0a920fdede130183ecf63b1659d670e"}], 0x1510, 0x48840}, 0x4008090) r1 = socket$alg(0x26, 0x5, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x10000, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8200028}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x78, r3, 0x402, 0x70bd2d, 0x25dfdbfe, {0x1}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x15f}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x79}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff896b}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x23, 0x39}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x13}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x979a}]}, 0x78}, 0x1, 0x0, 0x0, 0x40}, 0x40) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(authencesn(sha256-ssse3,cts(cbc-cast6-avx)))\x00'}, 0x58) close(r1) 07:13:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0xffff, 0x101000) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x81) writev(r0, &(0x7f0000002780)=[{&(0x7f00000001c0)="290000002000191900003fffffffda060a00000000e80001040000040d001000ea54bb22915edec9d8", 0x29}], 0x1) 07:13:35 executing program 3: r0 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x1ff, 0x22a00) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_DIRENTPLUS(r0, &(0x7f00000003c0)={0xb0, 0xfffffffffffffff5, 0x7, [{{0x0, 0x0, 0xff, 0x5, 0x6, 0x7f, {0x3, 0x3, 0x1, 0x10001, 0x2000000000, 0x6, 0x40, 0x189f, 0x7f, 0x0, 0x17e5e6a8, r1, r2, 0x0, 0x51f}}, {0x6, 0x4, 0x1, 0x7, '['}}]}, 0xb0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000180)) syz_emit_ethernet(0x13e, &(0x7f00000001c0)=ANY=[@ANYBLOB="baaaaaaaaaaa00000000000086dd600ad5ea0108000000000000000000000000000000000000fe80000000000000322cd3b804a2754c1200000000000000aa0420880b00000000000008000e1a5842000086ddcd4a8a4f4e03523768d9fd77d89fd56e9d5a75e883c95a8ec04aea3465cda80290a4179f6f4d57566ec6745fead32ab217bb30debdb30ccf950e522b393ec5fc6d8a105421ed4c672d88595ce7d33cfbeeeef5399d9b8b9c08015f13b35a0690a77eb6f51afaa6152e02080088be00000000100000000100000000000000080022eb00000000200000000200000000000000000000000800655800000000227187a4d046136259dffa6ee05e2ed17b493f0014d361739db6b790a32acfd080e8a61ed1662728f2305b1368caa927341e4efe0f025a6157a1184c8f6057b25edc1831c5fbd3c791eb834c304ddf55b09afbebed04"], &(0x7f0000001440)={0x0, 0x3, [0x0, 0xffff]}) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000000)=0x5, 0x4) 07:13:35 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='ms#os\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:35 executing program 6: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a600800000000000000068354015002c001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0) recvfrom$inet(r0, &(0x7f0000000840)=""/193, 0xc1, 0x0, &(0x7f0000000000)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) recvmsg(r0, &(0x7f0000000600)={&(0x7f0000001580)=@nl, 0x80, &(0x7f0000000080), 0x0, &(0x7f0000001400)=""/27, 0xfe9d}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000080)={0x5, [0x9, 0x7, 0x0, 0x4, 0x8000]}) 07:13:35 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0xa00000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 258.543536] binder: 15412:15424 transaction failed 29189/-3, size 24-8 line 2967 [ 258.561144] binder: send failed reply for transaction 571, target dead [ 258.569547] binder: undelivered TRANSACTION_ERROR: 29189 [ 258.629590] netlink: 'syz-executor6': attribute type 29 has an invalid length. [ 258.638990] netlink: 'syz-executor6': attribute type 29 has an invalid length. [ 258.647078] netlink: 'syz-executor6': attribute type 29 has an invalid length. [ 258.656336] netlink: 'syz-executor6': attribute type 29 has an invalid length. [ 258.664511] netlink: 'syz-executor6': attribute type 29 has an invalid length. [ 258.672166] netlink: 'syz-executor6': attribute type 29 has an invalid length. 07:13:35 executing program 6: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x20000, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000000080)=""/174) r1 = socket(0x10, 0x3, 0x0) r2 = semget(0x2, 0x0, 0x18) semctl$SEM_INFO(r2, 0x4, 0x13, &(0x7f0000000140)=""/238) write(r1, &(0x7f0000000280)="26000000110047f181ff050143000000fffffffdc200000000000000092201e6050019000000", 0xffffffffffffffb0) 07:13:35 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000080)=0x4, 0x4) syz_emit_ethernet(0x4a, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaa96aaffffffffffff86dd60d8652b00140600fe0000000000000000000000000000aafe8000000000000000000000000000aa0000000059cf12e1a5bcdf9beb314f428cbf1917fffb2ef23d5f047321438a268008d29e35511b1a45fe9ec63f8334711c3a482b0fb9365867ba1cda960678c509c92a25ef5958b2e9036cd26563424572832f51b210d4c04f0dbcff3c9d93692da1ec0b146a0f180e027b06974b1148288876051b9c5d2c236d37a6d0c1", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], &(0x7f0000000000)) [ 258.679921] netlink: 'syz-executor6': attribute type 29 has an invalid length. [ 258.689412] netlink: 'syz-executor6': attribute type 29 has an invalid length. [ 258.793189] netlink: 'syz-executor5': attribute type 16 has an invalid length. [ 258.806471] netlink: 'syz-executor5': attribute type 16 has an invalid length. [ 258.814342] binder: release 15465:15473 transaction 576 out, still active [ 258.821496] binder: unexpected work type, 4, not freed [ 258.826832] binder: undelivered TRANSACTION_COMPLETE [ 258.852903] binder_alloc: binder_alloc_mmap_handler: 15465 20001000-20004000 already mapped failed -16 [ 258.865316] binder: BINDER_SET_CONTEXT_MGR already set [ 258.870768] binder_alloc: 15465: binder_alloc_buf, no vma [ 258.871844] binder: 15465:15473 ioctl 40046207 0 returned -16 [ 258.876392] binder: 15465:15476 transaction failed 29189/-3, size 24-8 line 2967 [ 258.898358] binder: send failed reply for transaction 576, target dead [ 258.909513] binder: undelivered TRANSACTION_ERROR: 29189 07:13:36 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0045878, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:36 executing program 3: socket$inet(0x2, 0x7, 0x0) r0 = socket$inet(0x2, 0x80001, 0x0) mmap(&(0x7f000001c000/0x1000)=nil, 0xfffffffffffff000, 0x0, 0x10, r0, 0x0) pwrite64(r0, &(0x7f0000000000)="66611001ab3d8705f1e61ffe033ea8404b018e924ba657a70e7a4f02f580980e1831f5fb5db9e126b0c986e9f2fe983783f9825e34814248ecabd5ce1a1ecf58d0f4f5b0c2854646fd80c04ac46b2b205f38a246cfe92c8401189f193b47ebf5541d9d2f7bf03109efdde09040604f35049acaaf3e0ece4b020a9dffd48cabb1ad02ddf8ffd8cfb6f75f5555268c54a604915033d68f33ae98e465f3b72dfb12ebb6f185eba488a4077114a550c3b1f7261f9038ce7243ab269755047f16de7bed83b0f3759084b7bd3b5e3d6c4cfeccbe209353012aa25b088689963d130da6506892ad4d1807b69615e8d29994fa", 0xef, 0x14) 07:13:36 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msd%s\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x888, 0x101000) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f0000000080)=""/13, &(0x7f00000000c0)=0xd) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$bt_sco_SCO_CONNINFO(r1, 0x11, 0x2, &(0x7f0000000100)=""/84, &(0x7f0000000180)=0x54) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}], 0x1c) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r4, 0x0) close(r3) close(r2) 07:13:36 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x74000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:36 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={&(0x7f00003c7ff4)={0x10}, 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@multicast1=0xe0000001, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}, 0x1}, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x33, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x88) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000100)=0x1000, 0x4) 07:13:36 executing program 6: r0 = socket$inet6(0xa, 0x100000002, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000280)={0x6, &(0x7f0000000000)=[{0x10000, 0x80, 0x2, 0x1}, {0x8, 0xffffffff, 0x85, 0x800}, {0x100000000, 0xfffffffffffffff7, 0x80000000, 0x5d}, {0x1, 0x4, 0x200, 0x800}, {0x4, 0x800, 0x81, 0x1}, {0x3, 0x9, 0x3f800000, 0x4}]}, 0x10) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}}, 0x1c) r1 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0x6, 0x6004) ioctl$KDSKBLED(r1, 0x4b65, 0x3) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f00000002c0)={r0, r0, 0x9, 0x8, &(0x7f0000000040)="f027c458eb2133c3ae2d356d31691dbf2fa3d47b1a4f4137ff73e647", 0x6bb, 0x3e2a, 0x1031, 0xb363, 0x2, 0x3, 0x598, "d26883d7857579c4848682dee9230efc4f85102828ea80ed52d69bad40e3bdd72595ca3eedd694829db85eed86bcd787bd8f534ac3d039eabc603691a4ebc1332ddad26aa082d6153b0aebf8b52732526baaeff8648af971cdb64f1217f9cb460fedc32a4c830e3d2cc117f1699f09384b27d6568ae5504a7e7cc3c96fd6eeac64991d1c84f98f5cf6d744b828368599c237a23f1d70131664d37dc3f21ab6a97755afec8a24288e2646afc51f22549f9cf5c8509acf2d185c81123ba9ccb05475267fe4e066b5d5b41d69ba9530d1ea3d7d3fe8d582097981b20715ece89876cb830ddd06446e701e28cb6ef27e6e120b3cf876fea18c04e6fe58655eb7c71c1b47cc20ef9c862e483f3d3c4cf6de50ac2b8f8dbc94bb9fd3c366bf4bb866fc661ba17f28edf1265c25df6f690ea29674adda47cab95117281064d2a96d014cfd23562dbbc39833e6c0b4e39076d5aafabeba859d0e099f"}) [ 259.452487] binder: release 15504:15510 transaction 581 out, still active [ 259.459515] binder: unexpected work type, 4, not freed [ 259.464822] binder: undelivered TRANSACTION_COMPLETE [ 259.485379] binder_alloc: binder_alloc_mmap_handler: 15504 20001000-20004000 already mapped failed -16 [ 259.515250] binder: BINDER_SET_CONTEXT_MGR already set [ 259.521209] binder: 15504:15510 ioctl 40046207 0 returned -16 [ 259.524632] binder_alloc: 15504: binder_alloc_buf, no vma [ 259.532727] binder: 15504:15519 transaction failed 29189/-3, size 24-8 line 2967 [ 259.552703] binder: undelivered TRANSACTION_ERROR: 29189 [ 259.558778] binder: send failed reply for transaction 581, target dead 07:13:36 executing program 0: r0 = socket$inet(0x2, 0x3, 0xff) close(r0) recvfrom(r0, &(0x7f0000000000)=""/1, 0x1, 0x160, &(0x7f0000000080)=@pptp={0x18, 0x2, {0x1, @dev={0xac, 0x14, 0x14, 0x17}}}, 0x80) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @broadcast=0xffffffff}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008011, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0x7f000001, [0x2]}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739c9d, 0x0, 0x0, 0x35) 07:13:36 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000380)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f801", 0x17}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000032ff8)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000056ff8)='./file0\x00', 0x0) mkdirat(r1, &(0x7f0000000040)='./file0/file0\x00', 0x0) mount(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='hpfs\x00', 0x23, &(0x7f0000000140)) openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x200000, 0x0) r2 = openat(r1, &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0) getdents64(r2, &(0x7f0000000140)=""/50, 0x32) 07:13:36 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) 07:13:36 executing program 3: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101000, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'\x00', {0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}) bpf$MAP_CREATE(0x0, &(0x7f0000001140)={0x7, 0x4, 0x10, 0x40008, 0x0, 0xffffffffffffffff, 0x41d}, 0x2c) 07:13:36 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msd\ns\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:36 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x7a00, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:36 executing program 1: r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$assume_authority(0x10, r0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cb53d6d344f8f762070") r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r3, 0x0, 0x0) ioprio_get$uid(0x3, r3) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='vboxnet0@eth0\x00'}, 0x10) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x100000, &(0x7f0000000100)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}, 0x2c}]}}) 07:13:36 executing program 3: r0 = getpgrp(0x0) r1 = gettid() r2 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) write$FUSE_POLL(r2, &(0x7f0000000000)={0x18, 0x0, 0x2, {0x6}}, 0x18) rt_tgsigqueueinfo(r0, r1, 0x0, &(0x7f0000a75000)={0xb, 0x0, 0xfffffffffffffffa}) [ 259.726859] binder: release 15541:15545 transaction 586 out, still active [ 259.733873] binder: unexpected work type, 4, not freed [ 259.739209] binder: undelivered TRANSACTION_COMPLETE [ 259.749337] binder_alloc: binder_alloc_mmap_handler: 15541 20001000-20004000 already mapped failed -16 [ 259.762214] binder: BINDER_SET_CONTEXT_MGR already set [ 259.768532] binder: 15541:15545 ioctl 40046207 0 returned -16 07:13:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 259.776709] binder_alloc: 15541: binder_alloc_buf, no vma [ 259.782341] binder: 15541:15551 transaction failed 29189/-3, size 24-8 line 2967 [ 259.794092] binder: send failed reply for transaction 586, target dead [ 259.805809] binder: undelivered TRANSACTION_ERROR: 29189 [ 259.941654] binder: release 15576:15577 transaction 591 out, still active [ 259.948665] binder: unexpected work type, 4, not freed [ 259.953956] binder: undelivered TRANSACTION_COMPLETE [ 259.959906] binder: 15576:15577 unknown command 1 [ 259.965241] binder: 15576:15577 ioctl c0306201 200007c0 returned -22 [ 259.974123] binder_alloc: binder_alloc_mmap_handler: 15576 20001000-20004000 already mapped failed -16 [ 259.985099] binder: BINDER_SET_CONTEXT_MGR already set [ 259.990677] binder_alloc: 15576: binder_alloc_buf, no vma [ 259.990725] binder: 15576:15577 ioctl 40046207 0 returned -16 [ 259.996287] binder: 15576:15580 transaction failed 29189/-3, size 24-8 line 2967 [ 260.002457] binder: undelivered TRANSACTION_ERROR: 29189 [ 260.015477] binder: 15576:15581 unknown command 1 [ 260.023450] binder: 15576:15581 ioctl c0306201 200007c0 returned -22 [ 260.030821] binder: send failed reply for transaction 591, target dead [ 260.296771] binder_alloc: binder_alloc_mmap_handler: 15503 20000000-20002000 already mapped failed -16 07:13:37 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x40bc5311, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:37 executing program 6: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) setsockopt$inet6_tcp_int(r1, 0x6, 0x37, &(0x7f0000000000)=0x20, 0x4) 07:13:37 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdoc\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:37 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc84988b3b18f762070") r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0xc0, 0x0) accept4$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0xffffffff, @my=0x0}, 0x10, 0x800) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000240)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000040)=0x800, 0x4) bind$can_raw(r2, &(0x7f0000000000)={0x1d, r3}, 0x10) write(r2, &(0x7f00000000c0)="c4e1f64e08c456a36447bc9e5c17326a", 0x10) 07:13:37 executing program 3: perf_event_open(&(0x7f00000007c0)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x1) openat$vnet(0xffffffffffffff9c, &(0x7f00002ac000)='/dev/vhost-net\x00', 0x2, 0x0) getpid() ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000340)={0x206, &(0x7f0000000300)=[{0x40, 0x81, 0xe864, 0x5}, {0xfffffffffffff804, 0x0, 0xdb, 0x8000}, {0x8, 0x10001, 0x100000001, 0xfffffffffffeffff}]}, 0xfffffeca) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@dev, @in6=@dev}}, {{@in6=@dev}, 0x0, @in6}}, &(0x7f0000000380)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000005c0)={0x0}, &(0x7f0000000600)=0xc) ptrace$poke(0x4, r2, &(0x7f00000003c0), 0xc9) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={"6272696467653000800000000040f400"}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/mcfilter\x00') alarm(0x7fffffff) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x1, 0x81}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000280)={r4, 0x7}, &(0x7f0000000840)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x89a1, &(0x7f0000000100)={'bridge0\x00', 0xfffffffffffffffd}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00003b9fdc)={0x800, 0x0, 0x0, 0x0, 0x0, 0xf687, 0x1}) r6 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000340)="ff0204000000020500000000000000000000000000000000", 0x18) connect(r6, &(0x7f00000000c0)=@in={0x2}, 0x80) sendto$inet6(r6, &(0x7f0000000200), 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e21, 0x0, @loopback={0x0, 0x1}}, 0x1c) accept(r1, &(0x7f0000000880)=@in={0x0, 0x0, @multicast2}, &(0x7f0000000900)=0x80) syz_open_pts(r3, 0x20000a4083) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000000740)={@multicast1, @dev, 0x0}, &(0x7f00000000c0)=0xc) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000400)={@local={0xfe, 0x80, [], 0xaa}, r7}, 0x14) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000000040)) accept4(r1, &(0x7f0000000940)=@hci, &(0x7f0000000700)=0x2c4, 0x20080000) 07:13:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x5, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:37 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000080)={{0x0, @multicast2=0xe0000002, 0x4e24, 0x3, 'lblcr\x00', 0x10, 0x8, 0x26}, {@broadcast=0xffffffff, 0x4e24, 0x4, 0x45, 0x101, 0xffffffff}}, 0x44) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000180)=0x10001, 0x4) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000100)=0x1100000, 0x4) [ 260.590696] binder: release 15592:15599 transaction 596 out, still active [ 260.597739] binder: unexpected work type, 4, not freed [ 260.603043] binder: undelivered TRANSACTION_COMPLETE [ 260.609144] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20004 [ 260.609594] binder: 15592:15599 unknown command 0 [ 260.621483] binder: 15592:15599 ioctl c0306201 200007c0 returned -22 [ 260.624379] IPVS: set_ctl: invalid protocol: 0 224.0.0.2:20004 [ 260.634878] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.641540] bridge0: port 1(bridge_slave_0) entered disabled state [ 260.646923] binder_alloc: binder_alloc_mmap_handler: 15592 20001000-20004000 already mapped failed -16 [ 260.661372] binder: BINDER_SET_CONTEXT_MGR already set [ 260.667842] binder: 15592:15610 ioctl 40046207 0 returned -16 [ 260.673187] binder_alloc: 15592: binder_alloc_buf, no vma [ 260.679330] binder: 15592:15611 transaction failed 29189/-3, size 24-8 line 2967 [ 260.692249] binder: 15592:15611 unknown command 0 [ 260.702526] binder: 15592:15611 ioctl c0306201 200007c0 returned -22 07:13:37 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000400)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000000)=0x600210) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000000600)=""/145, 0x91}], 0x1) pwritev(r0, &(0x7f0000161000)=[{&(0x7f0000000040)="f5", 0x1}], 0x1, 0x0) write$P9_RSTATFS(r0, &(0x7f0000000080)={0x43, 0x9, 0x2, {0x10000, 0x180d, 0x3ff, 0x1000, 0xfff, 0x7f, 0x3, 0x9, 0x20}}, 0x43) 07:13:37 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) r2 = socket(0x1a, 0x116d40dd3810d118, 0x3) ioctl(r1, 0x200000000, &(0x7f0000000100)="3e6834f42a01a376ee2ef9cebd22b2834bf4c7f7a2184b779b2d696dd4da0cf030293f252af74dd169b739e81567287dd3afb95b6a7a") setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x0, 0xfffffffffffffff7}, 0x10) sendmsg$netlink(r2, &(0x7f00003aefc8)={0x0, 0xffffffffffffff73, &(0x7f0000847000), 0x1f2, &(0x7f000048a000)}, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x80000001, 0x200) ioctl$IOC_PR_PREEMPT(r3, 0x401870cb, &(0x7f0000000080)={0x133, 0x7fffffff, 0x2, 0x5}) ioctl$BLKROSET(r3, 0x125d, &(0x7f00000000c0)=0x2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000140)={0x6, {{0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}}, 0x88) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r2, 0x800442d3, &(0x7f0000000000)={0xbb, 0xacf, 0x800, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x19}, 'veth1_to_bond\x00'}) close(r1) 07:13:37 executing program 5: r0 = socket(0x15, 0x80005, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40040, 0x0) r3 = inotify_add_watch(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb00) r4 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000400)={'rose0\x00', {0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}}) inotify_rm_watch(r2, r3) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000080)=@sack_info={0x0, 0x3, 0x6}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000200)={r5, 0xd1, "2e42b262466da1d5e8e5c0030d387313abc48cd8895d91f260d422f7eed56617b0f3ec00806875bbaf936bbd8f7e1212fbfd836af16ca746f383aed5cec16b6a14ac0de280c4627c72b0b61b31135fad1f1e54765152c91f752e1b3610ea3c76d6af13462bcd144e30a637bf74722b327668a79f77cefa343538948a98f1757763c145d529aa55f121563f4e641364cb1fba0caeb716446a4e51f63465d796ffc21e3dc46da00a0921b52605ac41def554e29cd01fa6e9e5c2b62fc64ad47c30b03f5b13d686be176c50d06beb7f845afe"}, &(0x7f0000000140)=0xd9) ioctl(r1, 0x8912, &(0x7f0000000300)="025cc83d6d345f8f762070") r6 = syz_genetlink_get_family_id$team(&(0x7f0000000380)='team\x00') ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'irlan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000980)={'team0\x00', 0x0}) accept4$packet(r2, &(0x7f0000001b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000001bc0)=0x14, 0x80000) getsockname$packet(r0, &(0x7f0000001c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001c40)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000001e80)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x12080800}, 0xc, &(0x7f0000001e40)={&(0x7f0000001c80)={0x184, r6, 0x600, 0x70bd25, 0x25dfdbfd, {0x1}, [{{0x8, 0x1, r7}, {0x168, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0xffffffffffff7fff}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1ebdf776}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x100000000}}}]}}]}, 0x184}, 0x1, 0x0, 0x0, 0x4}, 0x10) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) r11 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r11, 0x84, 0x8, &(0x7f00000001c0), 0x4) getsockopt(r0, 0x200000000114, 0x2716, &(0x7f00000000c0)=""/1, &(0x7f0000000180)=0x1) [ 260.817953] binder: undelivered TRANSACTION_ERROR: 29189 [ 260.824634] binder: send failed reply for transaction 596, target dead 07:13:38 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdoo\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:38 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x20000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000140)={0x603, 0x80, 0xd50, 0x2, 0x8001, 0x6}) recvmsg(0xffffffffffffffff, &(0x7f000000e5b4)={&(0x7f000001aff0)=@can, 0x327, &(0x7f0000002000)=[{&(0x7f0000000000)=""/237, 0xed}, {&(0x7f0000000fdb)=""/37, 0xfffffffffffffe05}], 0x2}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000050000000000000000000000000000009500000000000000a57dfd2b5ed0e68528a104ab8fa2e826d759698c27fd91a4bced15bf09eba01144301d67ca87517c08d4c165e9fc33549c22d14df30ec1c441e00a139e2e52ef657c0de6faff6fc20e1c1db1ac12fbe5fde447f1d40d1575c20c7c14ce1829faae35ac5f2f98928db8e4fe8bae77c060c1a40cd9bcb3b2"], &(0x7f000001bff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f0000011000)=""/195}, 0x48) 07:13:38 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x48000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:38 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x3, 0x7) r2 = dup2(r0, r1) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x98, "40aef37fbe38018e1840f2d26e3c8be5d4cde472e1d6b72159f99ca88db574ab8d4fbfd472a52c8be66358adccfd579d8203ac9353dbcf353cf34d8b21e2407f59811828a4cc87f214877b81717c20fb177cb51fe1675d1a4a7220815272aa32324b93623507e404fee5a97fb8b3969f8f63e5aecbe20c333de0e8d2204590015a0e7f025551a465dc185879b2eaf19de7b154471b4ac409"}, &(0x7f0000000100)=0xa0) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r3, 0x7}, &(0x7f0000000180)=0x8) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000001c0)={0xffff}, 0x4) 07:13:38 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x4, &(0x7f00000001c0), &(0x7f0000000200)=0x4) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000000)={0x0, 0xb8, "7c90b84a389731f82fa02b7f055c141f571ad8b5f175c4ceab4d9882ec4a64e0fd7bf23c13f7c382200dcaf46ed0a3b903f8ca324fe1a7664b03cd57458f4fa59fb84d546915adba4d98e8fffa6d07203f9301225a7d846bc8c8c9917b8f3146f510782547bed165344797217af00a1b5f1af92efd72cba4224ba6a93281186c2ed807686879ee43c657a0259c0704ce64be4c64b42bf40845c6f666539b23c84db4271352bb709fa1c1a622bb296b4ad460187dff82b14c"}, &(0x7f00000000c0)=0xc0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x10000, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000240)={0x1000, 0x200, 0x3, 0x7, r1}, 0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000100)={r1, 0x8000}, &(0x7f0000000140)=0xc) [ 260.974959] device bridge_slave_1 left promiscuous mode [ 260.980749] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.995909] device bridge_slave_0 left promiscuous mode [ 261.001595] bridge0: port 1(bridge_slave_0) entered disabled state 07:13:38 executing program 1: r0 = socket$inet6(0xa, 0x1000000000006, 0x6) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000012000/0x4000)=nil, 0x4000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local={0xac, 0x14, 0x14, 0xaa}, @rand_addr}, 0xc) getsockopt$inet_mtu(r3, 0x0, 0x29, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$sock_inet_SIOCGARP(r3, 0x8982, &(0x7f0000000140)={{0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, {}, 0x0, {0x2, 0x0, @multicast2=0xe0000002}, 'ip6tnl0\x00'}) close(r3) dup3(r1, r2, 0x0) [ 261.114359] binder: release 15640:15649 transaction 601 out, still active [ 261.121388] binder: unexpected work type, 4, not freed [ 261.126688] binder: undelivered TRANSACTION_COMPLETE [ 261.141083] binder_alloc: binder_alloc_mmap_handler: 15640 20001000-20004000 already mapped failed -16 [ 261.164421] binder: BINDER_SET_CONTEXT_MGR already set [ 261.175876] binder: 15640:15649 ioctl 40046207 0 returned -16 [ 261.183135] binder_alloc: 15640: binder_alloc_buf, no vma [ 261.188762] binder: 15640:15657 transaction failed 29189/-3, size 24-8 line 2967 [ 261.206505] binder: send failed reply for transaction 601, target dead [ 261.215755] binder: undelivered TRANSACTION_ERROR: 29189 07:13:39 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc05c5340, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:39 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)="2f70726f632f76657273696f6e005aa2ac0000b8b5a28a29aecbf843385a51250398ce12d984f52a149eaf9866f3c33828fe73d4f319528bbd89fcefb625adac46df7522ebb23c98ad69bdc82509df6f43791702000000ca02988905b672c3a20d10f890b9f57724340b384eca6136eae4fd4a015e073076b8f1cde45eea0f0f0c3ca64ebdd0cefc0d9e8ea91d0bbba500000000000000000000000000000000", 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x80000000, 0x5235a5eb0857e497) sendfile(r0, r0, &(0x7f0000000000)=0x8d, 0x8) 07:13:39 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000013000)) r2 = gettid() r3 = dup(r1) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) socketpair$unix(0x1, 0x80000000000001, 0x0, &(0x7f0000e18ff8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r4, 0x5452, &(0x7f000005b000)=0x3) fcntl$setown(r4, 0x8, r2) readv(r5, &(0x7f0000000040)=[{&(0x7f0000fb6f9c)=""/25, 0x19}], 0x1) fdatasync(r5) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x40}) syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x0, 0x0) fcntl$setsig(r4, 0xa, 0x12) dup2(r4, r5) tkill(r2, 0x16) 07:13:39 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0xa, 0x3, 0x5, 0x24}, 0x2c) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r0, &(0x7f0000000000), &(0x7f0000000000)="101eae75d43ed9e25514f01dcb559f410e4dd6b0fb55035682039de28ef058869ada005e9cde390e966c213b0fa2000000000000000000bc925f8ce362ae02a567c96eb1e905c1c8876a7ccf482a56f10b8fe5d513f03b67ee92de9b0a98b31c324b50d3f777d96fd94bf0f460"}, 0x20) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000240)={{{@in=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@dev}}, &(0x7f00000000c0)=0xe8) r4 = getegid() fstat(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(r1, &(0x7f0000000340)={0x6f, 0x7d, 0x2, {{0x0, 0x55, 0x8, 0x10001, {0x5, 0x1, 0x6}, 0x4000000, 0x101, 0x100000000, 0x1, 0x9, '$security', 0x2, ',]', 0x4, 'ppp0', 0x13, 'system\'ppp1[trusted'}, 0x5, '}em0@', r3, r4, r5}}, 0x6f) 07:13:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo\n\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:39 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:39 executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x2c) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f00000002c0)={@remote, 0x0}, &(0x7f0000000300)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xf, 0x13, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3ff}, [@generic={0x7, 0x6, 0x9, 0x1}, @call={0x85, 0x0, 0x0, 0x39}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x8001}, @call={0x85, 0x0, 0x0, 0x30}, @map={0x18, 0x5, 0x1, 0x0, r0}, @map={0x18, 0xa, 0x1, 0x0, r0}, @exit={0x95}, @map={0x18, 0x9, 0x1, 0x0, r0}], {0x95}}, &(0x7f00000001c0)='GPL\x00', 0x1f, 0x0, 0x0, 0x41000, 0x1, [], r1}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x1b, 0x4, 0x100000001, 0x0, r0}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r2, 0x28, &(0x7f00000000c0)}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r2, &(0x7f00000001c0), &(0x7f0000000080)}, 0x20) 07:13:39 executing program 3: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$KVM_GET_CLOCK(r0, 0x8030ae7c, &(0x7f00000001c0)) truncate(&(0x7f0000000300)='./bus\x00', 0xa00) sendto(0xffffffffffffffff, &(0x7f00000002c0)="310000001200e7ef107b0000e6", 0xd, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008740)=[{{&(0x7f00000083c0)=@hci, 0x80, &(0x7f0000008680), 0x0, &(0x7f00000086c0)=""/109, 0x6d}}], 0x1, 0x0, &(0x7f0000003880)={0x77359400}) r1 = open(&(0x7f0000000000)='./bus\x00', 0x4000, 0x0) lseek(r0, 0x0, 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000040), 0x8000fffffffe) truncate(&(0x7f0000000140)='./bus\x00', 0x0) 07:13:39 executing program 5: r0 = dup(0xffffffffffffffff) r1 = fcntl$getown(0xffffffffffffff9c, 0x9) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000040)={0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000100)=0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000016c0)={{{@in=@multicast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@rand_addr}}, &(0x7f00000017c0)=0xe8) stat(&(0x7f0000001800)='./file0\x00', &(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f00000018c0)={0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000001980)='./file0\x00', &(0x7f00000019c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000001a40)={0x0, 0x0}) stat(&(0x7f0000001a80)='./file0\x00', &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001b40)={0x0, 0x0, 0x0}, &(0x7f0000001b80)=0xc) pipe(&(0x7f0000001bc0)={0xffffffffffffffff}) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000001c00)={0xffffffffffffffff, 0xffffffffffffffff}) r14 = getpid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001c40)={0x0, 0x0}, &(0x7f0000001c80)=0xc) getresgid(&(0x7f0000001cc0), &(0x7f0000001d00), &(0x7f0000001d40)=0x0) r17 = fcntl$getown(0xffffffffffffff9c, 0x9) getresuid(&(0x7f0000001d80)=0x0, &(0x7f0000001dc0), &(0x7f0000001e00)) getgroups(0x5, &(0x7f0000001e40)=[0xee01, 0x0, 0x0, 0xffffffffffffffff, 0x0]) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000001e80)={0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000001ec0)={{{@in6=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000001fc0)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000002000)={0x0, 0x0, 0x0}, &(0x7f0000002040)=0xc) sendmsg$netlink(r0, &(0x7f0000002180)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x48}, 0xc, &(0x7f00000000c0)=[{&(0x7f0000000180)={0x1538, 0x40, 0x1, 0x70bd25, 0x25dfdbff, "", [@nested={0xc4, 0x82, [@typed={0x4, 0x100}, @typed={0xc, 0x28, @u64=0x81}, @generic="d81c11e01bac762e0355efbce3845837796d42c9c04aa2ad625a626cc2bc2de05376f007d352c658a9fdaba47a4179a2d1345db251dcacc08fe0bf2e3b8e9d93243abc682607fbdb9a2dfeb572d3d5ab7afe6749753c0f3a8ed4852e6c213235a884677d3bb4bb04ad5dce0298a26ca1a91d5878c49089970bd1280f966c533d1b631c502635a706713f8061678adefc5da33491625f6715700ce66c8f536935e47d", @typed={0xc, 0x71, @u64=0x1}]}, @generic="58ebe50b60c926674c1db1dfc723120e3cd9c9324b5e1093012314362bff96b02f6a83c23dbaa582c28e0acb96b1619d85c1fd4371830fb780821466b1af641c910f695e866f7720d01545ec403d6418e26b451a8a8a44491ebbd5a4aaeb4a0894af706dfe0f2530a9bcb92a5acb67e96272039148b41f7cab85b95ecd4b12b667672b6fc2e5a4f3b4965ec0ad8cc975c8ac36222a279db4f05601dafd693fb2c842711bd2ea440062a2b26af14949221170cf44bc5367cea350b20ca7d5f0d75cefa497d81020c752dda2731a340efd3914b7", @generic="a28da892287be39b7e815d42657a9c9a8c6d0537632cf7a5c36a781cfed6f8cbf0f5f546868658cd1695f9503aa0acc547397160796082484a74e768507a9a27d4570f8fefe15395d1074b105300991adcead3ad8487e9", @nested={0x100, 0x71, [@generic="156c380eb66ef17c9c05aa29ac9f946e4aab3be9532518aaa38771db37b0cddc5a13f0c7ea3174d1457fc67c8cecee21736c6d8ebc5107a46da87856d3a7ef5d2784359f37590f1b9ad0328b4bfcde1f8d7355d9d291568844c58ffd08a9a723ba3e346ef1fe2e342176168556d21eda41d3b88ee99f415bc4a85e1e9100ee9af01e8637c229c2b765da311ae669b6c1300f136e39882967c763c3f65d31b91e73f658e3edbd05425aeb65944ed9e7834dd7ceb71877bfb83dc6686c767734ba6bbbaa3701a320c1d1c1913be53259c57a23b3a7b88e759afc778bee5bb173a407", @generic="cd24f168cd602ce1043232a6801f265b3591b035239b3688a79f8b"]}, @nested={0x104, 0x73, [@typed={0x8, 0x18, @pid=r1}, @typed={0x4, 0x13}, @typed={0x8, 0x2f, @pid=r2}, @generic="fd40b1aa0fb211db9c7ff04488a3988e5301360ff06ab610792ab1ec324fcb5198f795dc9714a40e5ab45ea1a2d9078836aee897ae24166c80ca7838ff2b74ab5617109f6690a0109b1b3c961678637933a8d50b34155d2db6319756a949e0022a132429686c79cf06e66147e96ee0ba4c3e91cef3d386db02246eb4d2b6056fb633ceef910d90bbeb8ed7da4eb1cb20582988fbaee13a57bb77965c1e259c804bc63231a1054e8f4d01fc162d2f5b7da965d18aa00e64ff7c79c582a9e7134fdb222b7c85014539a6c0db38a89a0af7b3120e778916d223340d9153cd610cb529508902e62bec729096"]}, @generic="0754588e814bbfb7109d4fb1f2a65ac6a4dd851f31e0d8e7032ef979b627a9e9ed464ebc048bc1fd0f4b2cb886529ec9108c4cd106c5c85729f6dc0c5a3f1d2440063a4215939a87c1c143a3c8ff0adc8c2d2da1e1526f09895bc63a5c258b29c716a620285d9066e21d8dffbc8fa903a534b481d8157e838ae9051c14581b8c4980391245adf55cf3b776ad2574d49cc3407211d483565df0dc308326deace840a8049deb544405176462d9c6cfab92dd9a6b62b4ed3059cd733a465568b5e255e8c543022b0d62bbecb7450e320c299c68e3a7102d354d976c95b99aecbbda8dd5d1541e7d16e2194f1e20290db2065fb381b76c4fd5e0f68d4958ee784cfd0563afd6eb214b9422111fcb5611af02f6c0e2ce287ec24ba66b4fc256fa1a53e171027788ff4005c808602c1f3646cf4422d7fef12827f886b6ebb7d3f187b3d876725eb8ed1bbcfec998741522c019b0b8f18cb292048b102b7a789c1543651961e9261177db03db2eb9dd5456307ee1b113e6d1d36c4277beba0cf001174d9b3388b5b8e806e9399b622fce008a6b579a1831a72245090001122b0cc617ada44c7621f96c317a745d5cfafc5fded75decff1bae8abad5a628ff7e155ce623f657ce1438bf2246b6fa296bddac12fec35813d8682b9379dc8bf29ea6561c7a0a56b52138df2008d3736eba274ebe72dffc8b04220d0f2472d53aadf8035c63d2800bab3f67feb61a4d48c1ef4a96729986ae75081cc350e2b15e20c86c3edf5d7469489fb31ed1afa5e7c887d8a40267314d25a20584414a01ae200758dfe1da3cd6e90d69b13ecaa9eaf84927bfe9c08ea0c2e8bbd447a9705a2e006471c86d084773d87249142960dd6c1ef6dbe7439f811a06ea5edf31d5a76f05fd3f1ec4306e177293d17b8da376415f8eca27d9e8058e7b813f2fdf16a8bd6eec25ca7191dd2ec442aa06ca44a4db2b16a2a3dad1ed58736975bad63a98b81f8788a5ed030c27783ef19df33328bc0dbf5f8c58aad8a729b643ad30bb173ec4f9385b7ffd6b59865d888631533817127bf3dfbb7d6789a58f3d11e503f69598d437ff1ae49a765867132688d5ae007ca39639fe3ee2bf9870c0cb2a55939d2aa42dec5a5fc9b0a0157f7f3d9af76d53d496da48411c7a76d500b63d445e82b443b231d738856ba2b9e79e906921d82db95e3e945bf34239e249a8cb1402d8709524c44c70648be4334ff659c83cb040b06768894fd76ff19abdf080782233673949bd594516091a46ef26e79101c7a64bcd84409c2f5f3f9a8b5731785b4a32e742a39e4c46bd7c963d3df8778abddf2f05d583631e90c0c9cdba3245bc41f16e7bbc04c4f7ffcf4f6c51e99018ec0f50066a5701eadefae581685bad4018bd250cfbc0e05f908f309f7d4993eae53f4e6590f6982e127ccb678988447f45dd2928972c329e61f5d609b16f41fef2f477ac95eb1aff4901133db94f8853c45d63c78c91cd521a7fbbb777c654c171493ca3f0456e3831dc348f5c0a2f389ec46f4fa131fd62545997ded429abfe86d173b5922e633da879b1dd5a73cb161adc891d31bea00632a9379964f514d6f1230707be4afae66da8a78432a8b8e9041d7e8fc4dcf2987723106b6c956840aa0c0b3bb0eea66ab90e9e88392896b1081f852da7c016853cc9f1d855011c71a471f1d103313e0e2e7850dee7ae53a68b2250f872decad6f60209def71b0fb2db37cd55bf5b85dffdea2e2e9d2690001de94e6ecb9ac5185d71cb600f0cd1ee9fa7874de6e3c56edb11cf5f7e93f15059d16419d622d4c6f25526d132cd2c1faa5b80cd03691a8a12ca6b91e0eb07fa1e7a7c1d9a99f8417888f2b130ed77446183bcef1f376a747cd0c268e732dd92856b829822edb0c8be8f65bac1b043474b19b74f0a1e998607e496a8c3d82041975a0972d076c8d9950f8cd8653022cc93bd73c31b70a1609fa26a02c4b989b1009550f4621d14ab87832726c1cc9f263cd9b359d705f86d0e4c23c6a9b1f4ebf5eebf3d13e974110d72f63d18a3496edfc17ec4c102b358be1f1399a46a03f4e23a95b51d7396c9f362c84637afea03e63c89b881c2b53ac891bffa5e6f3e431914818aae04728ff944da54162f2757a669b7d2af67c92558f7fd239288671c2187ea2beb322982ea714f0d58f61eaf3088d7399d3a406486bc22e104778a6e1118d73cd1c7601a596137bc7a7004f3096e81e7749b83d63c5d095b0cde2d8f018790b7af0097fb03ac703fb27b1dc3d1d3d0128eba1bc34489f7ee42052f882475424f7b3cbcfa7cdeed471805d713350e069e5eea7611dba94d4627ed84e629f6850055e8c2bbdf5a59e1c9187afafb3d394039d1554688bb138431f1053eeaab28548ad4684dc6a52af8f054af7abc68a3516b76261c8bbe4f51b1e4b9634b69deaf836209e602f6b9788fb940f417e9425400185904719ae6faeef099ee2065cb4e95745b2c5dd8fd2c8fc7afe84f25503279556f2b9e98cc137cace02f762c965e93c5ec06ef49d05324aef90c8d1258ed5c2a4157fb3b5037bbab9caad280804a1767103766909a19fc142965a5de6d969757a65e048790d5e20b7021dd58dc4c8139b3e04808be1867decdcd3689d4769b746f720cd30cefd3a4cb769535eda63562800e186a5b29bb6f25d9e4a54245b895c7cfc5e770cd331ffff58eb12ba137562cef99cd5a7d339e32e56ae6e5a537bf5d3f8ca1c34114a7aa00657ed55b2dea9914d5ed75d43574385057a2fa3373235b70315d4eeed0119646d5c5db74c83450bc2c1796b581d3b04c21be2dfa2024c2a8886cf97d31186b408a67dea47215c4e08799c1a8c78e16d5c8d4bea3548ee16978819fa6dd84b2a5d60f62641bee667c9d95d5e5b7c61ac0f0f4f05861461eab2502e375bd27a3db4623c87661f3f434b9c38188e6a5af83e65b39020ccca2d8c8268af8893a58437a27691c9b0ae69fa3dedca6040962178b942b8cb34b5f0cd8452b50a0cffaee5521b4c0a9c4f759e45ce065e5f153fbff6c6f8ae076c707ca3b4b5fa146dd36f2bce1140c19b02031fca4ea3e371309630f98a03cbb2d694ca329675c612e336dfa9e94a5ceba61ecfde175bc316a7cd33690641549addd9eccdcb8da64fc5dc599f2766f301ed74f1fa466f3a725cb55dc64395f3e462b65795ebda305bada42a7be82e3e2e0a103e24dc295ac13667ec3a81776c85b4c9c9b1ef299cccc0181f0294978bcdca70ea37a8ffb8dff6f0d7a60ceda410af23bece686c9702a6529cfa474ba6a2c20a1df7a722efe1cbbc58977c98ebbf765cfa0bd70788094d0e8b2a9cf7667f900b1c6531ac03823a768cb5ae2710b3585376ff25952e439d94421f2be51a0514e55a8994fff9adc8701ad0f11ebea1cf29534949b10829c267c80b686f1f1ad2d9864554774cbac83156053796cb278b4a8c1d286f6af59f061405c1adaf09b76710bbb9145292f64bc427139081441c734f8ecb41988a8ffb2c1dcc5c69658c548f9f69728003ee10208deab0c36ffe3bfbfedd885f29db37d817d9b908b2de0f9c0f7915cd5eb24c0284cf64140226d43c624616940ac79e4531ed6010fdc313a126f5366d21d24a47c239c6dd42d0e055d914ba191d4d434e9ee29032afe3709d1a2685a7abd4c2457c9c4987c13b58d9a5cac8b993ea623a32de9de539c7fff904985ff8f555ca4a756fd5d57d17181506c309f73ddf9b7cb2f75d0d887d21a0d54a9206da52ace34795305704b7750391d5677a27523abca247004df1fd6b516bc7a41bf068381b682c35394ca7654235dde82cc0e27ab7e7cee8353521b938568d69059c6e4848dcc0f6539fc74bc9c5b5c604018848671021afd006e2524145dd2a66d83a86b214bbd3b8e9e2301935997de0637309de41cebc4bc5730e063aa2b1098fc00c31521b956bef47a83222754f38a09581f5ebcf2c4fca10e6a243ce093d3bc80af75b73420afec7afe16ca4ab8632fe2be96f293cc8bac7c2daac384f3c65c29b198234d674a5563b1678f456e145500f4e2d9aca7791e1698db5df2589e00bc6acbbba4b13a9f381a1e83e251cc91d64dcef0cfba39ffe015fce067be9ee2eb74179a0ab7dbcac3bf00931e1a4ad3cff972a834be3191ed56cbab4c54945d3bac2294b32bfc44ef76738735fad68fee352b85f82b4c947c3ca73e1e17a57477f20561eef9b8d8898a85dfbabbca320a05774b1eafb787521c55ec5af63dc819329582ed0519f2035ab8af6e554293002822a83dafe9bb368756dbcd638a894c90f05d889e3d7100f2b2eaa0da69895d412030fba9f23565853fb36d7d22efc59b9098c50706c3d50757d956683cd36f418c3b7ecb78753474f4aef34af74431eb9d41ffcacc6e6b3b1b824977907ad9ab2e34b4d9952a4f24a9f9ec1a5a39152841d81bedc9e662ddbc3cc6320517e51089a2bdb38e6bda4a8a72e9b56ef03552716a5da3e847043da64782f9927316d562409e34b513d4956169ee99d797f726c33741b1d1e71e88b37836e5933b81dfda0c7306c87c4480bff886c4503334968c29e250fcbe16cca9d8dd91f59f2b43227b32c7818bf296df2fff2860f4013f7fcb508efb2fd88b3aac63fd6c6073e4560587cd25f0a81a1633f12e5bc515b6aae5fbd17a5f0f5ae5345d9971b134cb0ddfe1dbf05804865a887bf9a14d0dea0d2f9635a567f102e19c14ae96a675379eab95c5762be7ea65297fc3ece43f908c4a770c699b76c8cd8c8cf98128e215078806bb22fd4fcfe64692e273903eefcde88b72ce10ae714cfded7623b35974e5339d178ed85087199cd09aef86c65ac7bdc26ca00869f015d42b4de451afcb450437e84f6475ae002b3a4855bc24aff8b0a8e88a19c43c25a6d802eed78bd9ff70dfbacfe87ff9e5a5d1d5e650a54c9a7ebeada501976303a24a5256268002865be41c50dcd312ad11967b73e11342dd2c320e91454af32afe494afb2fee74e8b3898220e986a4378600f85ba80d96780931831214661ba14c2ec7be4afb413ba3104866f69cb798034b030de8a43a2dfbd89ab37ae389651544452cac5384362cdf4ebcf78347ee3c935176b0d90ab98bb0afb87a859f99d37fc257ed0d6139caf960c8a023cca49bef1783ceb8d2739027432c23ef01b98621fc6bd1d15e20c9927ea83496ed25ba7a0f65e94eea0daa3ba3da64dfa8606f050c6d5ec8539646893ae1d57d5e9f091e2292163c4c0d44cf0357bba090314aa2cac32f6753e3ad8a3e12d93e6d3511c1323c04ffccb21b5da9a132c53b36abd8d6edcb602eef57324c19804b21d5ed57b9428b79f16de4fecc6355197a592f0a28ef89b676837b61e82166daab5c189720e2f355b2ab2a645b693e71391c6e6c9433dc87e7a2eb0ffa005694261427117efaf2e0876a1ef40c067dc3468f759440a2382bc6b560c35a25a611c2b9643da4392decd34f86badb7d9483bef3523900b2ea942f104059d59f60949cd28a01da876da3b846359b74c0d8fb0801013461c8b799c6b1556c179b31a94a8a357fc34978bbdf8eb6fe37e59a377889396810b6db20ec95a370b1cfc24e44d1df33f2f1adee549d0d52f3d6589e4aeb2c02a04a742c44d51400f200a68a86d7c42c155b011e343b6e20594fc04b8a6a2287e5e59579e4005032ec81f1b9ded80645c75cb32628ecb1c4d255837061f6003a3c0af257bef6a4cd4e30d9031aa594785fe41339af272c63eb02e6a2ff52351b85f86dcd55228ae434", @typed={0x14, 0x36, @ipv6=@loopback={0x0, 0x1}}, @nested={0x120, 0x42, [@typed={0x8, 0x84, @ipv4=@multicast1=0xe0000001}, @typed={0x8, 0x5e, @ipv4}, @typed={0x8, 0x3c, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}, @typed={0x8, 0x85, @ipv4}, @generic="86d909dac40339ba45f44a94a8bf800d3942c46be9067c36e80052bf2483aedf5b577d026b5d8f930c4c05424a6cf2c7c28aef1f927fbb0e5fcf7aac6f9dfdf20b6d04ba2f68e125b41d8bdfc08fe6da784553282c5461e81850a28adffe0e281f976e1a94f92442e5db43856e0346a0d4fc572d15f0a8440df8c097e62d5f3efdcdecc88de5ae7144e532edcf347f868f3cf30d50619a194ede13b3252407bc6e75eba6a8d3e1106a1523cc53473e6503c6a82509d1693564485e3b8f4b671c5cb16b76c54154d8101367578af73a7f707f3385", @generic="6f02b8c4301e4506187a98aeb23547b98f852118bcf21e6d624be11b9e990355eaa0614de0"]}]}, 0x1538}, {&(0x7f0000000080)={0x3c, 0x31, 0x904, 0x70bd2b, 0x25dfdbfe, "", [@generic="f8493cc5c17e2d915efa7f4db2050a19fd5064847f2fa31e09a08da77b7633a72785", @typed={0x8, 0x7, @u32=0x4682}]}, 0x3c}], 0x2, &(0x7f0000002080)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x18, 0x1, 0x1, [r12]}, @rights={0x18, 0x1, 0x1, [r13]}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @cred={0x20, 0x1, 0x2, r17, r18, r19}, @cred={0x20, 0x1, 0x2, r20, r21, r22}], 0xf0, 0x8000}, 0x4000) r23 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r23, 0x8914, &(0x7f0000000140)={'teql0\x00'}) 07:13:39 executing program 6: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) ftruncate(r0, 0x8200) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) fallocate(r0, 0x0, 0xfffffffffffffffc, 0xffff) [ 261.836929] binder: release 15685:15696 transaction 606 out, still active [ 261.843932] binder: unexpected work type, 4, not freed [ 261.849263] binder: undelivered TRANSACTION_COMPLETE [ 261.868600] binder_alloc: binder_alloc_mmap_handler: 15685 20001000-20004000 already mapped failed -16 07:13:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo.\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:39 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x700, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 261.885926] binder: BINDER_SET_CONTEXT_MGR already set [ 261.891956] binder_alloc: 15685: binder_alloc_buf, no vma [ 261.897729] binder: 15685:15702 transaction failed 29189/-3, size 24-8 line 2967 [ 261.898115] binder: 15685:15696 ioctl 40046207 0 returned -16 [ 261.913007] binder: undelivered TRANSACTION_ERROR: 29189 [ 261.921255] binder: send failed reply for transaction 606, target dead 07:13:39 executing program 5: syz_mount_image$ntfs(&(0x7f0000000000)='ntfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="cbbfc2bc5d8ef980fcd8e320775c528c1d427c767301a94ac8a0c2c5770c18c131f4ca87522ce840d364d96c733d"]) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x81, 0x20a00) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000100)=0x8791, 0x4) 07:13:39 executing program 1: r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@ax25, &(0x7f0000000200)=0x80, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'eql\x00'}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40416, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7e}, 0x20, 0x2, 0x0, 0x7, 0x3, 0xad8, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_TSS_ADDR(r2, 0xae47, 0xd000) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)) ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f00000000c0)={0x9, 0xfffffffffffff84d}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 07:13:39 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdol\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 262.209075] binder: release 15727:15736 transaction 611 out, still active [ 262.216095] binder: unexpected work type, 4, not freed [ 262.221405] binder: undelivered TRANSACTION_COMPLETE 07:13:39 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6800, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 262.288883] binder_alloc: binder_alloc_mmap_handler: 15727 20001000-20004000 already mapped failed -16 [ 262.299648] binder: BINDER_SET_CONTEXT_MGR already set [ 262.305064] binder: 15727:15736 ioctl 40046207 0 returned -16 [ 262.311105] binder_alloc: 15727: binder_alloc_buf, no vma [ 262.316688] binder: 15727:15746 transaction failed 29189/-3, size 24-8 line 2967 [ 262.326840] binder: undelivered TRANSACTION_ERROR: 29189 [ 262.332495] binder: send failed reply for transaction 611, target dead [ 262.490902] ntfs: (device loop5): parse_options(): Unrecognized mount option ˿¼]Žù€üØã w\RŒB|vs©JÈ ÂÅw Á1ôʇR. [ 262.501546] ntfs: (device loop5): parse_options(): Unrecognized mount option è@ÓdÙls. [ 262.532725] binder: release 15753:15760 transaction 616 out, still active [ 262.539714] binder: unexpected work type, 4, not freed [ 262.545112] binder: undelivered TRANSACTION_COMPLETE [ 262.549006] ntfs: (device loop5): parse_options(): Unrecognized mount option ˿¼]Žù€üØã w\RŒB|vs©JÈ ÂÅw Á1ôʇR. [ 262.560895] ntfs: (device loop5): parse_options(): Unrecognized mount option è@ÓdÙls. [ 262.566053] binder_alloc: binder_alloc_mmap_handler: 15753 20001000-20004000 already mapped failed -16 [ 262.589433] binder: BINDER_SET_CONTEXT_MGR already set [ 262.597242] binder: 15753:15760 ioctl 40046207 0 returned -16 [ 262.603564] binder_alloc: 15753: binder_alloc_buf, no vma [ 262.609224] binder: 15753:15765 transaction failed 29189/-3, size 24-8 line 2967 [ 262.633968] binder: send failed reply for transaction 616, target dead [ 262.643662] binder: undelivered TRANSACTION_ERROR: 29189 07:13:40 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0605345, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:40 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x4001, 0x89) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f00000001c0)={0x0, 'sit0\x00', 0x4}, 0x18) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/igmp6\x00') flistxattr(r2, &(0x7f0000000080)=""/73, 0x49) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5\x00'}, 0x58) r3 = accept4$alg(r0, 0x0, 0x0, 0x0) io_setup(0x6, &(0x7f0000000200)=0x0) io_destroy(r4) sendfile(r3, r2, &(0x7f0000000000), 0xf) 07:13:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x300000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:42 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00'}) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x715000) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f00000000c0)={{}, {0x80}, 0x0, 0x1}) 07:13:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x10001, 0x1, &(0x7f00000014c0)=[{&(0x7f0000000380)="582b3d0010000064c86d6b6613d547bcb9bebd0f790a7d021de59ae51f4209bedaf211ccda4e176dccead1aef2f5e32b77dbf7a74633239f9c2c01ceff8f442367194ae96d77a955985c5bb8abe32f336f83c4692d44a6b34ebf32cb10223d51229c1a114b37663d9006598262c64965e5d47e24c0dbe1bf76f54fac6520ab116dadf8e031393651a971d7b76760f9a44e0f83707de903ce", 0x98}], 0x0, &(0x7f0000000440)=ANY=[@ANYRES16, @ANYRES16, @ANYBLOB="dc748294f6476ff43da035e1d7cc79f3baaf98f43e29895cdd015adea161613f8d1aa56acd2d75eb3d55810f9d066ab341d12536d0ee3c15789fef5cf4fb57dfbb949dac30a2e8e7d5e8f32ef96ffb9f2f755196ed0351b51af05454a98c3d8200dab5c081cf79b9acf2dc670f52da4325a4c7dd7ee4de6ac75da8f8e19a230925cd8fcd3ab798d324c8b5af13b62bb89e040b95451e9627af04e72cf025080b350ef2f47c4df593dced101fef1589c9fc7bfb48b0a348da6e5fd7857c446904ef66b70e26373dadcd9a803a1f57af0d00c255681cd1516863834faf0ebd74635a5848dad1dc98e16ffb6e919fdaf4e02f01c60298f6d76610f5d73e2558315a4bd92e8742d4f4c4e5bfd7524b84ddb65b885763bce2185301e923b8899a57fcd3e66784890e65ee0e213e7cd4f7a84c7f8ba777c331bb8b7726d801eeb9fb61bd742c30c1499db5561179d660601f19cbb0fb81367714a6108281dfc0190a65a821596b9f478b016b93b59d5d6e676d37cdc031e124f18475b2f3c02c50753f7b871a062ead85864c0f130cda6f33cca49fe3f92629d3083883b85808b117d6fd07868fa27bebc265978ac74ae7a2c1bcd2061f43cadeaa8b41a16e21a1514ddcd2c2b8016f61575479ddd9a261df4f23316f75e918480a881cb2ee060a285efff6a681e0f7c9f9af97a7ef4c3abe4362e99c6c42ea27824ee6a5c32afb35ac8b1330fa711cba4094549c8a8de48afd6b6e177fa9deee050f1d2614e251deb9bd21d2bd4890603c13dccae32f7fe90462f49279f13607461f48578f2645cf5fb4e0854cc6d3b42b096129a7f4ee5743cc71daba86e02481367caf51a40e4cfb8e4e45f2c8a66c5147456458ac3a0dc4144116979528a46902c57257ffbfadf588dc378d5e560f2ed9f7c191c69603b610a1beeaf56bc3fd253b6b0708314eef61414c149b0f11a9f02bb1b2c70451464b4e9d7392f33106b3baeb3353886aa39c729287eebc848a9d68a9b1c1fce476f1a3b0409de0d928b4fd71be73c66b041cb2ffaa2d81ec6cd33dcbc6a432c2c7620b8bec9f761f78fd96c398155446f35155de19b9377e046f5f0595d9b4c53227865be19db9f7299f6cd918cff6e87964227d3eb6e78bbca08f57456b925edf7c128aee8e9af9c4c0638cd8a0a3e2435cabce63558a1876428edaf76a1a25ff607ae21e439d39c520e09f4fff2648a21dfaf81c8e7aa40a410dcefad681c5a784e6b101d4e0fa6d3b6afeedf30337e0ab7cc59fa6fb17b28a4142464fa70c2d803054fbbe1ae28754b2f8b04bc2f8c12b3dd1803392201a0f9f11cc68274a1a9f5cc3838cafb6222b720a72ccd169f968a4ba3dba1ef49d99685749a2bbf5a1705ca373ace040fa3d9129d501363c60fe0baadfee22662537c8094b2da7920fa400ab25d4018a24ef8b96d377bc08c0cee89a2d688b39840f875d0e7fb71603c5587421e397e20a4511ce27362a01a205ea3f5c50ff114ca27d457c79ae450babd3986657fff213d8537d5e4f94f05dd523936ae55793a85c6852d8135ee6452df917114e7d0c675de75204f39fc7b1129174543afedece19bd6b2d338a23b4103479a2fa7d80b4276721b14cb43b82c956a3fa92351d0e49054d2d6ddc0899d53ef5b7d6ae4136fbe2d1698c1e07c00d057d1bce7345ece87e59ec9ea206c43305f7576057145696bef0b5dbb423d868e44e8b2af801fd6790cab6acd9967e3a7f3c50665e87f7630bc0560950b07e7da8e902c9bc0e1af1ff23ef6c05ec4c02bdf69f4ab2208c60a3d0127d7c96f451f1154635e5aa7a4fa13d5dd7c902530e6c5c2c219a91ec3efbbbb196e95bb27558e063de68227f72eec28f241ba1f345b52bdc3c2927c649143bb942e5b362beaa7ec6e8436bc551a4192290125b5369611033e105d0913f2000682d5952389b0c12d148cc817cc7627c2cb9b8d2ef376d72120e32277d3af3d53a231c0487d78e733089863a20437ead8d44aa93b895534432958bf9de71d5deedd150206444a4a14b42ee2483c5d5d93b84b11e683bef24c0b9083866cc88cd5913e74523be2c2286d20562556465b9c637a05ca8be1ae6226c24653c67667ebdbae3b942fa001ee24b7d111239a5520ffe157d31afd2a3a81cac4363cde9af6eb264c6188ad33d29326bcc2f2b726f3839c89636501475a1f6eb07d6ec5a140a2f41c36bf8c9aa174a15372b5596455d6d8c8bcc0f19cb8c431e6260119cc4c3c5607ba0fff09419ffa34f5f8f53606960d5f458626ad052c772675b51e77791de99d22a3b038f79bf1a89df199d2e801f435c1791102ef6692ad6c78e958ab256ba5ad7d977cac2111f7ecafb80704fe96828af5b70f4ca2f7b9a1373c1dcfd21340869db29be2a8929345646c4aef14cb8964e5d5cb5efc84e55816a17daccdb4b6230f9b0435ebe97d6522338b501e3369c555838ce1c0452b98abd8517057b722325fe621478578933af41b594eb9ac27d8f80f0b7f4908cb40cf40a0fde2e05d58a372cee711c61982be127d64e11b829fa1d822b9d8146c263ee1c284bed5da0fe1b9ea09f9af7e86f66b711c0e3c6bffdea34191076d20d9a3715ed4fad1e0b0874f81b95485239545f348b30c8b2ad7d5df590dfcc2030b0035f65dde6f7c9464a78b0053872edb7fc8f454f5ae1ede1979830b0135107c8dbd44fc56a7bf6d16f71730c5e8baa49b65024afcef8aea08d045307ec39e6c7de363ab2349ccbe65ada36dd0d9b41ecb78de46d0f7d8771caec5ca03059ba7376472cdb4a9ef1315a702dfdbc4acb1de4e7439385ad3a9a9e6bc25291e6151145f972d81de7be73e4cb6957a33f72fd086b125bb00f2bb9794394aa045167a58520a3653bbb27c233223bf9e3b50f79e2ce46938f4c6d107a5beda77955c865b4af80e93656dbe8263f08fea2e49c26c9a8e35fec49055f1901c10cc4ff3450d5e475cca49d09bafe0917658e87e546408924eb642b4fbadb17a137418bb5063d0fa23d958fca37519a1fc24a994f5b2272979fa57c2d1a5bbf19a7f14048da12119975901d4ce5ab41af7ac64a7c5c5f2132bc51f54705ea3bfeb72bc1ebbbe57a14ea0f4998ad91221e52aa3c99751b3fa09b8829f52d502b2dfd5075f693d32e1ec206e2a8c37559651bbbba39d311a5c74c1fa6b6824289669628921159b26f9a9a4ee0841411682ed4710fb01092b5485b4145971ae3d89598d33d52e6bfe5683490b87807e2386e1dd338a7ae693311f01ed109851ee811044839377a90bc9b21dff27d66c0bebaac3e50a7ec9d69b06420d2ac3420f45c0d505c6e5aabe0ae5fd20f6f04c12d7a1996f7af75056acf108e212c8aabb6fda8f14294da504f6753f03ab586e7c988be99dab7972e145db4f6be89e8b97d38a0090cfc3e784bbe85fd467b48b9fb5fb39ed9afaf9223d17c3c501b3719c452254dd3e4b3714c70e0db5cfebcfe06d0470965154bef71aadd9cbcc7f6a22101ea72daec9cd4811d869252703fa50131656f3d2df322197e79a3f3c33f5ba50a786cc28215a8606a32c8157826f3b596c422d2dcc7aad71e6892fc801218656f1b0e58d78f47cc687df80c2bf2f41ab6a33315290974a35278b2182a43f33ed89e778eab1ef5960f5b8e0f0364f54ce5cd4e14561c61d45020ce198d1bd283104b925461ede51042ce4cdf469000894cff4cc35976c5be3b5e6efdc8e94756d87e6afd9c3496a9d00bcbb6e35face7b0e15e01bc76a896e2f7a05d4b2fe2d4710213623f6b47aefe940ad1a7af28c27bdb84a632c5e75baaaacf02a6944a7a0723b3d229859307f0761a450b1a403129e0ad3319253c9638d40b2a17d9d3a03d12d2bf6b535a92af3f6c67f41990c2e34b83c2360e0f6c20c203c06ccbfebfa822a6b8183f04bc8f0e97f0d86e810b20d0c3e91ee236da1dbc270f1b6361f26dc1850d8dc242bec12eb22baa113436b81a57a7cdf2cee767f1a7ed3a7c1e211706182aa8fd389265595a5adb9f9c585a9458b161bdc3bde32e02449245ed5be30d60606e088bfc6e9e00532e9f840058815a4364f4a32e6c8413e3f92a699522203d9eaa185c2ef3cb17e705aa22b574abb612ac0668a799eedcd43b0247beebf81a957b4d3344b8c2e91dc40ced9d81b052bb4eddd5f7121f66b606c8a484cfcb37f201dea595ba7db93f0768c2c5939d1a62482ff063177e9846cfb6d03eda1b23410d6a74a4ea280fc1b1fea35c5ed7ec8a579967b846a5fef550ad96c862ed588001af59cdf11d097f0925c65d7347fb5567aa63d638cb5fb327f233d3306da3a89d902ea6baf81926cc1a6a313977269a597d33ed9b5eea7a214c3335212bf44343a173eb6efa43172ce07d4f868744461eca17b60b094c1e9a3744a7d1c756dbc6091e2defac447b6a86fb842005df3d2818dfaa64009b81654604f41b67da31d2acc00cac64913fd6ed441f39563567a81ebbafa6a5e3422af8e9fa54eb396230a19d780328fedf39304f2d8c3a0d71b1dd21836487db77399690fee81304b4a833ed17c55ffead460652f1841c8f9169c79ce1f4297b82284ebe9a43fe9bb697dfd9c06ee3357ca67c9d801f381ce0b7b601579b8a865af194d3155f71392bf69e48664c5177a5a5786f12a3e7948a45e80b0477c020af1353a0cd80261a25dbfbb2544c53106acd68245db4dda0bccdda26677bc62330009fbaa8440c3692edb310e22c08c5df93b20e1781a4ed2b52520e94ae71bab0e22ba026712c405d862387a6c4a3f9258d1b42647794b175bdfde43bea17bc60dfcc786845a6136dff6ad7a1d8162c4593997dbc0e730ea724a19428fd5352cbbcf40e5c265281de64e0b0210800ffbfe1c751448fac9d9b20f45f81a6066d9025278c323bec9a7b7a3dd98f2265db0916be97e980435769a84c62599bd943f7d7b09c7411c1bb39a9c6f590ac0b10802d4a043246fa1047bc008672ae4bb7707eed3a89793acd982debfab91984a84b67df3154c5b12c8809cb955b86b2087d6d4afd3fdedbda9569eb7dc58231002718d618346b9b896355cc5ecad3e499e0219da6fe78d71eae26417e10908a87d52fa3fc187f30968d2c556b57882bfe158c2a7b7104d924efdaac1f00b1b7f0c3d6a989136e6d82a708eaf9bf7224562017c0ee72d21a3d4e05eca39e34033d887a49feb1e06c416ceb325772ffc3904e92c6cf9ee803b65249978c0222416b7fac394495e46a989fa97c96bc2a541f99f7266e230ce58764a53e214e2deb81d81720abac371b2ac39359e73e90bde740501bb2b3505a75291569580ebe2d1919e41ccfd5cb4728635765759b35904e3b791745591e805d41e95a78899bad2bf1a1cd1bc7c486ab7f764e6e5e40f5fce1e1f7dd1a68ca66d5bcf6e25bba84604f84bf3b815b6d6c445c06cc71effdb32876d6715c33075220422e8ccdad08603f5cbe1dc63695b7d6642799199b16e5786902b85b89b95c8c2b75bcb7a8ffd1a38efc3c1f5998646ad7e5b196c1d267041777770a3988935ea3ba3e4613828e23883c1ea25073d60a282c531e6457333d2834f142bd16ff2e1ffb15847ac4a22400a1dd5042d62f09a4572c3b73ddf14daa4c60b5c224c81ec330225b5f2379acb4398be5b8be5a4561897a0b66e94b61a48f89f0524a88292d6afbbf55bd037bdacdd8c1265e0199cba991556211f8d50ef379f5274c258d4308877d9c34503003cb5cd405bb1b7d3548db1f90083e50182dff56b45f0125bc50de90c41bff12a078", @ANYRES16, @ANYRESOCT, @ANYRESDEC, @ANYPTR=&(0x7f0000000240)=ANY=[@ANYRES16, @ANYRES16, @ANYRESDEC], @ANYRESDEC, @ANYRESHEX, @ANYRES32]) r0 = open(&(0x7f00000001c0)='./file0/file0\x00', 0x3bffa, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) sendmsg$unix(r0, &(0x7f0000000200)={&(0x7f0000000080)=@file={0x1, './file0/file0\x00'}, 0x6e, &(0x7f0000000180)=[{&(0x7f0000000000)="2825ab094e2eed639705248be7708a31f9bde113fbdb61fb485ecdcd55199f61f21e4cb75ca0f8cc856bdf333ff36538298d7a9104a3a7", 0x37}, {&(0x7f00000002c0)="f16da1c250648170d857aaf6a941d5911a44bc9aa6ebe9e51b11b3893502b81a1f07a6e64ea2d26c6c94e55f8fd42cfdfd6e0aace3b925cb2b34761b3d5869884a6e57495fa19f5188578c85595422893e5bae91c3d3dc469ea50adb562cadac10086face2e127ebd0e40cab8283a8c38a83e02cb8eb94cf3b65b1433c22f55646ea40fe8cd259648e168ce98380df1cf5f709335b0a8b78ae784099dae7046c23c1ecf466e4894671be29ad99ec91209a6908f2e41a095988b0b579c44809c5", 0xc0}], 0x2, 0x0, 0x0, 0x4000}, 0x20040800) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socket$inet6(0xa, 0x80007, 0x7516) ftruncate(r0, 0x11) 07:13:42 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo%\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:42 executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x8, 0xa8002) syz_mount_image$reiserfs(&(0x7f0000000080)='reiserfs\x00', &(0x7f0000000100)='./file0\x00', 0x8bfc, 0x4, &(0x7f0000000400)=[{&(0x7f0000000140)="619787139451581116c5b344b8810b42788beeb75e8765f9dd475d6499b1990043d859b55cdb1d2a882c02b1d1fee25c32b9255616a9aa236fa540a742c1ff4579838a84d9707c787bc39f7777b0159868666356519a472818a3d4956d9ffc1935fc7309802706bfe0", 0x69, 0xfd4}, {&(0x7f00000001c0)="28724b0e3c8fb1cecae51deab7f87b34de83e4d52957d28ad7f78fb40542707b9a4eeaf957076b282622a9b4d179bb27d8e9df4705129b71b4107434f1fc796294e01027658e134dcb42bb881bca3238297d9dfd4779d51c84962aacea90a67e4d5fdb4daf8ac451aa470eb30254da1764341043073ccdce0d16d3d339a3cf411407a458c1038572efbaa20add27f667a23d090088bcf0b8944865dfea1e058469d507a2921d52f6cfc6e3e6d4faa8f499d5b15df62707f964", 0xb9, 0x3c9}, {&(0x7f00000002c0)="8969f192ed94a8177fe927dd0b68668586af3b38db54a3cc55ba815f061e8f63408c2304dbb3b380bbb6228cc8549ae92b5a44e277164972c4a18bb86f8ba34ca8c8195e245377432cd0ce", 0x4b, 0x7}, {&(0x7f0000000340)="d58cd1227d095de87ae750a811239ae3f6543df410333aaafb820409c16cabf7b1f4865711323d15d1318e225fdd261f9ddd405dd80ff398f62087245d42cec83b89a95faebb37e8d15db79dc15e1eb7500a8093db115cf674de56bf07812772c563112523dd0b1bf9e273dbbc2c555fdc14fcf5dfe8d57a7b07f04fe4411f280197e0e65789bf74e3d9ff1570a9fa0785ab46719f5d1791f04a54ecaa298b2562dbbcca085fc6dbe130897e85f95a", 0xaf}], 0x88020, &(0x7f0000000480)=ANY=[@ANYBLOB='noquota,nolargemo,\x00']) fcntl$setflags(r1, 0x2, 0x1) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x6, 0xfffffffffffffe00, 0x80000001}) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e23}, 0x1c) connect$inet6(r0, &(0x7f0000966fe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x11}}, 0x54}, 0xffffffffffffff4e) 07:13:42 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@nat={'nat\x00', 0x19, 0x3, 0x298, [0x200002c0, 0x0, 0x0, 0x200002f0, 0x20000448], 0x0, &(0x7f00000000c0), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x9, 0x0, 0x0, 'veth1\x00', 'ifb0\x00', 'team0\x00', 'ifb0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @random="aaf793133e48", [], 0xf0, 0xf0, 0x128, [@connlabel={'connlabel\x00', 0x8}, @ipvs={'ipvs\x00', 0x28, {{@ipv6=@dev={0xfe, 0x80}, [], 0x0, 0x0, 0x0, 0x0, 0x1}}}]}}, @arpreply={'arpreply\x00', 0x10, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x15, 0x0, 0x0, 'tunl0\x00', 'bond_slave_0\x00', 'ip_vti0\x00', 'team0\x00', @empty, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x70, 0xa8, 0xe0}, [@arpreply={'arpreply\x00', 0x10, {{@random="9d58805c0da7"}}}]}, @arpreply={'arpreply\x00', 0x10, {{@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}}]}]}, 0x310) r2 = socket(0x8, 0x4, 0xd3) open_by_handle_at(r2, &(0x7f0000000000)={0x12, 0x5, "f42a53fdf874d3cfd3ec"}, 0x200040) 07:13:42 executing program 6: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@rand_addr, @in=@dev={0xac, 0x14, 0x14, 0x18}}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x2}, 0x0, 0x6e6bb8}, {{@in=@remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, @in=@loopback=0x7f000001, 0x0, 0x0, 0x0, 0x3}}, 0xe8) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x10402, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0xcc, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x3}, @in6={0xa, 0x4e24, 0x3, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x1ff}, @in={0x2, 0x4e20, @loopback=0x7f000001}, @in6={0xa, 0x4e22, 0x6, @mcast2={0xff, 0x2, [], 0x1}, 0xffffffffffffffc1}, @in6={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, [], 0xe}, 0x5}, @in6={0xa, 0x4e22, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr=0x1}, 0xfff}, @in={0x2, 0x4e20, @multicast1=0xe0000001}, @in={0x2, 0x4e22, @loopback=0x7f000001}, @in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}]}, &(0x7f0000000180)=0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000003c0)=0x0) ptrace$pokeuser(0x6, r3, 0x3, 0x7fff) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000002c0)={r2, @in={{0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x6, 0x71, 0xfffffffffffffff8, 0x9, 0x10}, &(0x7f0000000380)=0x98) 07:13:42 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc08c5336, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0x3e5) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000000)) [ 264.863976] binder: release 15810:15820 transaction 621 out, still active [ 264.871154] binder: unexpected work type, 4, not freed [ 264.876487] binder: undelivered TRANSACTION_COMPLETE [ 264.888643] binder_alloc: binder_alloc_mmap_handler: 15810 20001000-20004000 already mapped failed -16 [ 264.899084] kernel msg: ebtables bug: please report to author: Total nentries is wrong 07:13:42 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f00000002c0)={0x0, 0xaf, "1737b724164682e7f2bee32ed4c68b7c077be0e262854e8b3aa7fd360e25df9a9fc2b19e4773579f6523982dffb2c11d25bb551fbb1d9e2f9fcbde40bee549934053143955bb09b226694254371a73ff4bdbd0de33d45a0d07c1b78ad4eab4e1641cebf426090cf696a6755ad6f21d82c6197a3199f08c457ff3a1d7ddd8bebdc26f0a7a3fc19db37b50e123686508b244dc373fa836620e5a8102c27bfcca6f7b94fd938e84fd4ea102abcef5193f"}, &(0x7f0000000240)=0xb7) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000380)={r2, 0x1c2}, 0x8) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000080)="06f9063a2878cd705f830b7676725684ddcee0cbf7ea40512e72feaa25a4288982db2ae87ea5d2a77a973f9833932f93238fe2a93ee3dc7c3e4444a56f15d34f3583a37d3ac0067c743ed6de70eb2743cfd92cafc68d0795d39eb6036fd334d3fbe1e6f8c863f57d07f4a7a98c7d73ca943d8c789bdc19d5bc30c13182dfecbd87b7acb1e712fa37fb76a5902fb4a959a1d3d747ea4283540628a30e54d67a7b25a3402d964f2434adcbdd6c2ef252635f024e6918c7c4fa720095d6") ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000180)={0x8, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}, {}]}) clock_gettime(0x3, &(0x7f0000000040)) 07:13:42 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = msgget(0x3, 0x2) msgsnd(r1, &(0x7f00000003c0)={0x400000001, "0c2a2ba79fdd11ea678a95695d4d265cbd69727f830fbd7a55414ccf8ddc04cb3b782994d922a0c9d8ec7c4542f3e0a7dd0a6bd3a010fbb74fd159566c21cacdce3a4c4586c0ec729e9ab3a60b9c64eeaf6daaef5c096c778153e3c552478e90ab2eb199444890ae0b383fee47f74fff8063f63687c37c81f0d33a0904d8d4eda00d754f6d79de360aa1e3ba099d9aafe4b5176363046d97414507fc2b9fb028aa57ebb9e018385660cf661a2ae1448387d89f0634656c3f2a67616339c648b6f12f9a55db52d6c1a08fb28dbe5667b75b1b8ee38b8fd1dba0"}, 0xac, 0x800) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x4}, 0x1c) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000)=0x401, 0x4) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x2002, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r4, 0x0, 0x483, &(0x7f0000000080)={0x2c, @multicast1=0xe0000001, 0x4e24, 0x3, 'lblcr\x00', 0x10, 0x9, 0x7a}, 0x2c) sendmsg$nl_xfrm(r3, &(0x7f000014f000)={&(0x7f00003c7ff4)={0x10}, 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=ANY=[@ANYBLOB="b8000000190001000000000000000000ff010000000000000000000000000001e000000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d0000000000000000"], 0xb8}, 0x1}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x5}, 0x1c) [ 264.925120] binder: BINDER_SET_CONTEXT_MGR already set [ 264.932994] kernel msg: ebtables bug: please report to author: Total nentries is wrong [ 264.935254] binder: 15810:15820 ioctl 40046207 0 returned -16 [ 264.947769] binder_alloc: 15810: binder_alloc_buf, no vma [ 264.953380] binder: 15810:15826 transaction failed 29189/-3, size 24-8 line 2967 07:13:42 executing program 3: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000300)='/dev/midi#\x00', 0x8, 0x0) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000340)=0x8b, 0x4) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) close(r0) openat$audio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio\x00', 0x1, 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000080)=[0x5, 0x8]) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f00000000c0)={0x0, 0x7f}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e20, 0xffffffff80000000, @local={0xfe, 0x80, [], 0xaa}}}, 0x8, 0x80}, &(0x7f0000000180)=0x90) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000780)='9p\x00', 0x0, &(0x7f0000000700)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) 07:13:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x500000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 264.972141] binder: undelivered TRANSACTION_ERROR: 29189 07:13:42 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo+\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 265.003687] binder: send failed reply for transaction 621, target dead 07:13:42 executing program 5: r0 = open(&(0x7f0000000040)='./file0\x00', 0x2000, 0x10) getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000100)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'eql\x00', r1}) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) dup3(r2, r3, 0x0) [ 265.048343] FAT-fs (loop0): Unrecognized mount option "ÿÿÿÿÜt‚”öGoô= 5á×Ìy󺯘ô>)‰\ÝZÞ¡aa?¥jÍ-uë=Uj³AÑ%6Ðî<xŸï\ôûWß»”¬0¢èçÕèó.ùoûŸ/uQ–íQµðTT©Œ=‚" or missing value [ 265.080316] FAT-fs (loop0): Unrecognized mount option "ÿÿÿÿÜt‚”öGoô= 5á×Ìy󺯘ô>)‰\ÝZÞ¡aa?¥jÍ-uë=Uj³AÑ%6Ðî<xŸï\ôûWß»”¬0¢èçÕèó.ùoûŸ/uQ–íQµðTT©Œ=‚" or missing value 07:13:42 executing program 6: r0 = memfd_create(&(0x7f0000000000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x400600) write$sndseq(r1, &(0x7f00000001c0)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {0x0, 0x20800}, {0x4}, @connect}], 0x30) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000080)={0x0, 0xa7e, 0x26}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000200)={0x0, 0xa6, "5a5e4af7b0b730156c3c2aeaae82d22d50f2fe2818c4dff6cd9fa6502a2ebbb63fcafca1f42460af8a9bdbd16ca5513a898bbfa57d046e37ef37d30c30e6e131003ff8b6a10029bb036224f2f61a77e84aeac4292caee2fbc84ec2b0cf85571e582b477073989308ef97c0bcc65fa23e889d4d2fd9df325a1dd949694ea12710d3f6fe3fe0a64741737781624d64021813532024ee1a8a6a35826142b02c021230bf1f42ca36"}, &(0x7f0000000040)=0xae) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000100)={r3, 0x8001, 0x30}, &(0x7f0000000180)=0xc) ioctl$KDGETLED(r2, 0x4b31, &(0x7f00000002c0)) 07:13:42 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x80000) setsockopt$inet6_buf(r0, 0x29, 0xfe, &(0x7f00000003c0)="fddd801f459acbdd65a27ef0d0fa93a12834d0795724b40bd68f769cd9d18a0fa9235136c615cdef94e552e4b2635356ceb13d1b4aa8818ce5ad53f3fe2509f4fe605789e046d6cfc50ff0e0369a57c912e6", 0x52) ioctl$KVM_SET_XSAVE(r3, 0x5000aea5, &(0x7f0000000500)={"55ab33c8c1f97fda2fabe2a5c2ebe82a0185112bac63afc02f3a977a6f21fd4ca63de3a9eb2d62e1244c717354a42b848b529eaf78da2e4f7c13e22967c50ab6c457ddf364a1c8f7345fce2345ccd008bcf0947fb544916da3ac5efff50c60310428ae0fa371c5aba240695d93b7735b84ddfa82e60b9542a96bc0c5ddb04a3157acb496cd90a50f52885d60c0eccf09dac5b1d2bbce475671ee68ba8d1fc1bc5797080a12e05570c3da3771de22947fa38f6e4eac5c4f2d532b30b7d3e949777a2d0fab4e176154cff6ff946c7aff7c7fedcb0acb3bf7f8b9d42637b485386999523ce844571aad495e0c1dac83a53330bd21a79a25434434b4bf48738cfd5c3b1d8bc7caff01fe290c978867778ad422c79b317be970564b8cdee9f7e32e17b7cf33198becc06edef5702d31468524e5c0d8fa8e6496659a80d62ad0e0d0a14142fa9e811c682b8c9b6c7b8ed19def675b18b05b68b83f6e3e9957b6a46f8b470303170ed9cdcd8b45fdd1d6ff358c85238d0642e199fa9ce5fe7f5cc2d66f710958be240a0c3620faad96f4e655a25d932091881b3bf26f084b8228dfafff2c3625d54c688381e257a62715d2814a3663fef1567384e4fab42d82fa074fff7a62e42b5127371d0514528fb86db4f309cf8f20a4232554cdc51d4cbaf9be0703fd89005afb3ec2548ddae25332ba8144b9e34426946f48ac9f126c1ed23ff612c1823da7acc5bc2491127f7b82ae1cacb952894302ff2133764fae2f7d82dc6a9b449baf5d5deb5e03e322380605f6b8f2e899926b1a58b775f6745b1708e405975e1b5cdbbb30bd188e8d6c3539927283adab1bc00af366a796a0a95c27f29b9a23d9aada43e8eb51e45c439fcf7110582eb07bbe99fd0823bf6cf3d34bdcc968cd7933a5c3be470d585224884762c10fb8d099535a88490224155bfe9c19fa3b86843350126f513e2b904ef9e86befc1b6db1aded5262e40579b3375048673e472a2631c1e27256312c1396e63d4dc74e5ca37e66ae088c5d92f40039f0c9fbd665cb04a3277dd2a25de38890399cdb5cf45cfa152b0b1bd48670214ee12194cc4f5247c053322e411f08eb351e385810f2e99f6da18e85549e568c5fa2849bb65a0a0a556ce17320abb292efa02c936a510d7a75516c0853a97a8716f9f49f4db2cf0ac1863b6c493a3f8014a38a1273ff940a01ff0e57d6002196a9274affd4b77ab1dbe3300fe30fe18333049ba37cc9ec31a318f74c93adb3f71b686414471ba9d3b2c78f37850f1b279f8319ca1635bddc90b5d3f1d382833f42a88a4bbad3aed017ee624b67db2e6f8ee047413ebe1edeb8f80adeb95e235be842f6ff3d8c4b4e8ac616b2b112e9b680289a900eab583fd16bb0c23e36e8410ddd4dd343309d5431d8adb365bcd1695a6fd9fbf4fef78eb3ca27f29ac4ebde7892f"}) r4 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000000c0)="173e1a69a960ffe74f660cf8deb2cc4669ad6056d013df2d3ae502531cb803f8d9dc0ac3c6f92493357ec5b5e736fdff5236000c166aaaa49a688dc962f3b4582d3901c160f5c503c930b17538f75df92364e6a5065c4482f8fcdc84c8863e2d01878f7aaa3ff2aa4fad607b9a109ae5ffd27bfb20", 0x75, 0xfffffffffffffffa) keyctl$get_security(0x11, r4, &(0x7f0000000900)=""/104, 0x68) setsockopt$sock_int(r2, 0x1, 0x10, &(0x7f00000004c0)=0xfd, 0x4) sendmmsg(r1, &(0x7f000000d8c0)=[{}], 0x1, 0x0) read(r2, &(0x7f0000000180)=""/153, 0x99) ioctl$KVM_XEN_HVM_CONFIG(r3, 0x4038ae7a, &(0x7f0000000140)={0xffffffff, 0xb15, &(0x7f0000000000)="d47ad19147d881042f95879da354824ee5b4842b970501e745ccf276791e5a46bc5dc9647607f7cb729fe49605cd5d2f", &(0x7f0000000340)="8dff4bb7ccb3afa0392644823f8b5b8de0abb9fb47a55379f085cea5fa8279517560f218d33f09d208e8b9a23787d08563f9119f7b5bb28f402b33e447c0b19ca5066a2505f22858c05e358c54f63ed74fb913b74eb88104b2cf9806a15ec61b68ec026aa2b775", 0x30, 0x67}) 07:13:42 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000380)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/qat_adf_ctl\x00', 0x2, 0x0) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000000200)={@rand_addr, @rand_addr, 0x0}, &(0x7f0000000240)=0xc) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000280)=r2) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000011000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x2000}) mq_open(&(0x7f0000000140)='/dev/admmidi#\x00', 0x40, 0x184, &(0x7f0000000180)={0x105, 0x5, 0x80, 0x3, 0x7c4, 0xda8, 0x9, 0x4}) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x6, 0x2000) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r3, 0x4008240b, &(0x7f0000000080)={0x0, 0x70, 0x0, 0x10001, 0x3, 0x5, 0x0, 0x6, 0x40020, 0xc, 0x3, 0x5, 0x1, 0x1, 0x0, 0x7fffffff, 0x7f, 0x6, 0x7ff, 0x401, 0xf393, 0x100000001, 0xead, 0xfff, 0xde, 0x2, 0x2, 0x0, 0x6, 0xffffffff80000001, 0xfffffffffffffffd, 0x1, 0x7, 0x6, 0x10000, 0xffff, 0x3, 0x0, 0x0, 0xffffffff, 0x3, @perf_bp={&(0x7f0000000040)}, 0x20000, 0x10000, 0x2, 0x4, 0x2, 0x3, 0x1}) 07:13:42 executing program 1: mkdir(&(0x7f0000000680)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)="7379736673002a864f4bc00bce1bdb20637213b1e894d120715f9dc1125b042c7226eb0136d9624ea1d23374a660fe5ac173722fd367ad22e8553025a2e8be0bc5514379af7213d32b8d5d06dc8fbf2c849ed9cdefc74b03dfa9cb5a90b28b4b24d7862c3d66fca53167d5424235435a3dbb76bc7d3c42fc2e9c696114a6f888f0da85277683cfc1c4d2bf71c255a3134d64cc3fed8e97798deb8631cbf7682c9fa2ed031465aa191df922f764297cba22a8499d177f49fba940f55bbc8b723fd374f1fed78c8aeec6811d9b5879487387d56594a14c2588274de84fa27610302b3fb54172a8c910a07e7c76ea465aa68402", 0x0, &(0x7f0000000080)) r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x3d3e5e67, 0x2100) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000840)={'vcan0\x00', 0x0}) sendmsg(r0, &(0x7f0000000800)={&(0x7f0000000880)=@can={0x1d, r1}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000380)="c6a97aa54b887d9e88522af39cdf96b18d8ed138ef5aeae98216a5484bcd965da69702d0935c74522dfca2d240f755627cca3be613c3eb816a665b5111c7cd3819e6b296a4c49deddedf0c5ee7268727242d37900e01e1ab2ec3f1386cd1796122b08c8bf42736b79825afc12bd490ec899ba20481f98e6030bd825f3f26880d1f306d4fc1a9abbf177f01d5ce947ef704ef8dfe55df744198b49cd0b0158a1a7e1ed7519e94209fb29a2a824055b0884b6e27672fd97b20150b5aa764144bfdc7d46cad4c249e57c1c8e3385b23342d0ad718090fa71629f6bb", 0xda}, {&(0x7f0000000480)="abcfa14d91d95d664d51dccda565136ac5a57f0d2189a7171f2f76e9913c307e6a2d28fb4a8df6217b4f870c676c4259052a66d428ec05370ebe0801ad45cd7f34e8af248d92590cb018eec30c23df7e34c812d851863fdfdbfe2f156328b4f1a3994ec28346970a205f08724156d9f9ebc56dd9d57ed462044fb4faf64a568eb1caecd96eb2bde2bfc09b26f3be71fd70abc0c05972b00deeea5dbe7a14a69f9566de95c45e894212f648fbda0ff48d0123e192abb9df5205d90c0fc48417421ad590aa97b418385640995459d00bfd9f1730b5fcc3a15e2a3d9a5505", 0xdd}, {&(0x7f0000000580)="54eaa1b9e94f94251896c92e5672ebccfb3717a109542f8cc8c8da082ae693a3832f0b38fe96232ff83f42e59b5b5fa7bb46e592f88ec36c33b7678157d345addaea2a3c559650edf299d343ba4a9e898ebd6e846c13d5af4745f0edf24dd0369d4c330c78fa8f718648ef73b4568a1d5f4ff0832e88f76947c4329f6b171614516844df3b1198a5dacc19a5adb2f6287402e19e9be09898bbeb8de963cb33d16ef7639f33834f2420ea81ed3c4d203df26d477b7a6740ebac3caaa91d3c9906bdca060966585b424369633d8aba1de6e697eac85a5f00449c", 0xd9}, {&(0x7f00000006c0)="78b26236600554cf5bfa785d508316a3c6eaeed1e2fe69a1fcb5d7ce45273937ecc7184b0877ce18785365884e968560f4337ab4df05287b8d4285f198a612242a5f14f44b0c21bf24c139c27e4e71749a20a9e7687117ad033cee242285d8b4837d50f83058d0d000111766150ac7d70733f2fdc7ed2f9ab288c4beb71ccc15f358c5a446eda3096c4b407f82fb6ce447aeba300992c0806016501298802d5f196a6fd868c82ff13e1408e55db699a1ff44d12b80daf7e85101c5b9b0c40a430236eae27592a12bdce828d7ba140a729951cf0d8dd6985e37c820888632dff2839b821ba072db1c6c090dc14c9bc52a6db5401b183b86dcdf5aed973a1d", 0xfe}], 0x4, 0x0, 0x0, 0x20000005}, 0x20048800) connect$bt_rfcomm(r0, &(0x7f0000000200)={0x1f, {0x5, 0x4d, 0x3, 0x0, 0x200, 0x100}}, 0xa) lgetxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=@known='security.capability\x00', &(0x7f0000000140)=""/150, 0x96) [ 265.181268] binder: release 15867:15875 transaction 626 out, still active [ 265.188333] binder: unexpected work type, 4, not freed [ 265.193663] binder: undelivered TRANSACTION_COMPLETE [ 265.202916] binder_alloc: binder_alloc_mmap_handler: 15867 20001000-20004000 already mapped failed -16 [ 265.213874] binder: BINDER_SET_CONTEXT_MGR already set [ 265.219304] binder: 15867:15875 ioctl 40046207 0 returned -16 [ 265.219442] binder_alloc: 15867: binder_alloc_buf, no vma 07:13:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x2000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 265.230820] binder: 15867:15876 transaction failed 29189/-3, size 24-8 line 2967 [ 265.240807] binder: send failed reply for transaction 626, target dead [ 265.247579] binder: undelivered TRANSACTION_ERROR: 29189 07:13:42 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdoi\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:42 executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = memfd_create(&(0x7f0000000000)='\\ppp0+\x00', 0x3) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000040)={0xffffffffffffc9f8, 0x5, 0xff, 0x3a4a, 0x1f, 0x2, 0x4}) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000001c0)={0x18, 0x2, 0x2, 0x800000001, 0x0, 0x0, {}, [@nested={0x4, 0x2}]}, 0x18}, 0x1}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000013c0)='cgroup.events\x00', 0x0, 0x0) sendmsg$nl_generic(r2, &(0x7f0000001580)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x400010}, 0xc, &(0x7f0000001540)={&(0x7f0000001440)={0xd8, 0x1b, 0x22, 0x70bd27, 0x25dfdbff, {0x5}, [@generic="d4886e12d5ac8b64e1f823bf11cbdc24fbab77a9ba1fab97a3d003d4d439e345c690b2a6705feb92f23b5b8e4992d4fe5fb0d18819ceb624d2066c234ebd545ae3e79cf03cbf10892e49cdb42a2ce721a8b608cc6836c9ed1ff58c539be44e5c46ed54a55e38efb79cc7729f8b0f7c2269ee0d74c332de4e2dce3fe248231c56a33c2dd9cc056f2439c8f39ca52c00dfd0daefba9e4842359aa567ec1f2e7902da7f3e2dc331c57ea29e4cecb97570c3081d5b8d64e61f33a32cd85b2e631affe5e9ea"]}, 0xd8}, 0x1}, 0x1) 07:13:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x8, &(0x7f0000000d40)=0x0) io_getevents(r2, 0x0, 0x4b9, &(0x7f0000000240), &(0x7f0000000480)={0x77359400}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) sched_setattr(r3, &(0x7f0000000040)={0x30, 0x6, 0x0, 0x80000001, 0x0, 0x8, 0x1, 0x8}, 0x0) close(r1) write$binfmt_elf32(r1, &(0x7f0000000640)=ANY=[@ANYBLOB="7f454c46000000000000000000000000000000000000000000000000380000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x58) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x8, 0x0, r1, &(0x7f0000000140), 0x700000000000}]) [ 265.423110] QAT: Invalid ioctl [ 265.429704] QAT: Invalid ioctl [ 265.444732] binder: release 15905:15910 transaction 631 out, still active [ 265.451709] binder: unexpected work type, 4, not freed [ 265.456991] binder: undelivered TRANSACTION_COMPLETE [ 265.466605] binder_alloc: binder_alloc_mmap_handler: 15905 20001000-20004000 already mapped failed -16 [ 265.477287] binder: BINDER_SET_CONTEXT_MGR already set [ 265.482621] binder: 15905:15910 ioctl 40046207 0 returned -16 [ 265.487081] binder_alloc: 15905: binder_alloc_buf, no vma [ 265.494212] binder: 15905:15913 transaction failed 29189/-3, size 24-8 line 2967 [ 265.504264] binder: send failed reply for transaction 631, target dead [ 265.511150] binder: undelivered TRANSACTION_ERROR: 29189 07:13:43 executing program 3: syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000080)=[{&(0x7f0000000040)="eb3c906d6b66732e666174000204010a020002260af801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[]) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) statfs(&(0x7f00000008c0)='./file0\x00', &(0x7f00000009c0)=""/171) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x140, 0x0) bind$vsock_dgram(r0, &(0x7f0000000100)={0x28, 0x0, 0x2711, @host=0x2}, 0x10) 07:13:43 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x1}, 0x0) syz_mount_image$btrfs(&(0x7f0000000040)='btrfs\x00', &(0x7f0000000140)='./file0\x00', 0x9, 0x5, &(0x7f0000001580)=[{&(0x7f0000000180)="768deeb9ccd4c26cc949828ea6e3e57c878e8d81d6c9b3d2f39d3d9f4d43dca9466895af582f90c374350927654a8cd301d481bbacefc818104eae789098bd00fc08d09ed8e850f73eeb4558c593cf724d4a3cee01dcea2440378b06dec67b670f21b29d179262e68b6aa8cef1604c807fcd31815a81e8a9", 0x78, 0xfffffffffffffffa}, {&(0x7f0000000200)="8ca379c0bec5739c2c078a1c", 0xc, 0x3}, {&(0x7f0000000240)="5ab8f7d8073cdf9d55172ea6031e14d833011da5b0ec2289ef9a04bc9c0bd843b3548d962f0e3721e743bd25aad645901d35096bd93ba593e632d1b67d52a0318050ccb2a6039ab7fe7cf82393b5c21a802404dbf8e1dd2b150aefe22f19c926a7eb1583be6068c25bcaebc4c1a3ab7432c13f9c4456bba0bbc562424a", 0x7d, 0x2}, {&(0x7f00000012c0)="e9615b5f101dccd1745a6710148c8f75c6a2bb2a4b11f8845bab0c411f4e606022f81327c9419338f3ccd78c1eb9a0346a4c28ee5d938d39d31e7969baf75075f151d8d6c5e4e5c7d216082f65661e7cf8d3e4d3dde26e13d764297478af9c0d50a6d38d1a6fb268808e0553eba5d323aab34247df63f15c2c0644c6a05bc8793fca266bc40e2c7b86a965c763e8fd706ce4085801fad3dec2beac33ce9798c839218ef67487cd1a230237d7b6a855d27d662aa1d9491b14367ccf8b5067acaba544abc6b53d0984087d931f8fc566a3b0640a57f085afba136e3b364f002e78f7da1dead129756179c375f099ecb7dcf6ba58", 0xf3, 0x8000}, {&(0x7f00000014c0)="6064e28d00964205c1f2516bb3238b8fea084799477d5a3a55b651ad7b984d873c2c5e0a898da81011fda2fa5e2857270ecec94b82b43953a5f8bc106e4ee4eae23e50695bec8e004df78e015d45dc97f0f7a9b11c4ab4bea22048728babb7928fbdf3e7f445aca6d8701b82bb56b30e70dd0e5ff53de06a48c3239717b30c6107276c607f1273cc53958ddc82f4ea0640ce71f9a0618fc164560967f10e561cb2129fd6", 0xa4, 0x2}], 0x10002, &(0x7f0000001600)={[{@space_cache='space_cache', 0x2c}, {@metadata_ratio={'metadata_ratio', 0x3d, 0x8000}, 0x2c}, {@nodatasum='nodatasum', 0x2c}]}) r1 = accept$alg(r0, 0x0, 0x0) ioctl(r1, 0x1c, &(0x7f0000000000)="8da9") write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r1, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000002c0)=""/4096, 0x34000}], 0x1, &(0x7f0000001400)=""/123, 0x7b}, 0x0) 07:13:43 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = epoll_create(0x6) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0x0) poll(&(0x7f0000000100)=[{r2}, {r0}], 0x2, 0x80) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)) epoll_wait(r2, &(0x7f0000000140)=[{}], 0x1, 0x47) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 07:13:43 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdod\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:43 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0105303, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:43 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x20000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:43 executing program 6: r0 = socket$key(0xf, 0x3, 0x2) connect(r0, &(0x7f0000000080)=@rc={0x1f, {0x30c, 0x5, 0x9, 0x9, 0x100000001, 0x5}, 0x9c}, 0x80) fdatasync(r0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket(0x40000000002, 0x3, 0x39) sendto$unix(r2, &(0x7f0000000cc0), 0xe0, 0x0, &(0x7f0000000d00)=@abs, 0x6e) ioctl$sock_bt(r2, 0x8906, &(0x7f0000000040)) recvmsg$kcm(r2, &(0x7f0000000540)={&(0x7f0000000000)=@rc, 0x80, &(0x7f0000000440), 0x0, &(0x7f0000000480)=""/185, 0xb9}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f0000000100)={[0x3000, 0x7000, 0x6000, 0x1000], 0x9, 0x20, 0x80}) 07:13:43 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000080)=[@in={0x2, 0x4e23, @broadcast=0xffffffff}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1a}}], 0x20) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(r0, r2, 0x0) 07:13:43 executing program 5: mkdir(&(0x7f00001d4ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000179ff8)='./file0\x00', &(0x7f0000000080)="6726b4f21b4af4cb2535d2aa0faae10017df", 0x9002, &(0x7f0000fcb000)) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000014ff8)='./file0\x00', &(0x7f0000014000)='ramfs\x00', 0xb3b9, &(0x7f0000005000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000012ff8)='./file0\x00', 0x0, 0x0) connect$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0xdc08, 0x6, 0x73, 0x4, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x1c}}, 0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x2833}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r1, 0x3800, 0x9, 0x2, 0x100, 0x6d7}, &(0x7f0000000140)=0x14) getdents(r0, &(0x7f0000a30000)=""/4096, 0x1000) 07:13:43 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f0000000240)={0x18, 0x0, {0x1, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 'team_slave_0\x00'}}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='stat\x00') r2 = socket$inet6(0xa, 0x1000000000002, 0x0) recvfrom(r2, &(0x7f0000000040)=""/218, 0xda, 0x0, &(0x7f0000000140)=@vsock={0x28, 0x0, 0x0, @reserved=0x1}, 0x80) sendfile(r0, r1, &(0x7f0000000280), 0x2000000004) rt_sigsuspend(&(0x7f0000000200), 0x8) [ 265.954223] binder: release 15950:15964 transaction 636 out, still active [ 265.961237] binder: unexpected work type, 4, not freed [ 265.966557] binder: undelivered TRANSACTION_COMPLETE [ 265.974470] FAT-fs (loop3): Directory bread(block 2563) failed [ 265.980595] FAT-fs (loop3): Directory bread(block 2564) failed [ 265.987051] FAT-fs (loop3): Directory bread(block 2565) failed [ 265.993868] FAT-fs (loop3): Directory bread(block 2566) failed [ 266.002164] FAT-fs (loop3): Directory bread(block 2567) failed [ 266.008402] binder_alloc: binder_alloc_mmap_handler: 15950 20001000-20004000 already mapped failed -16 [ 266.018519] FAT-fs (loop3): Directory bread(block 2568) failed [ 266.024681] FAT-fs (loop3): Directory bread(block 2569) failed [ 266.031218] binder: BINDER_SET_CONTEXT_MGR already set [ 266.033062] FAT-fs (loop3): Directory bread(block 2570) failed [ 266.036576] binder: 15950:15964 ioctl 40046207 0 returned -16 [ 266.051439] binder_alloc: 15950: binder_alloc_buf, no vma [ 266.057124] binder: 15950:15970 transaction failed 29189/-3, size 24-8 line 2967 [ 266.058953] FAT-fs (loop3): Directory bread(block 2571) failed [ 266.079095] FAT-fs (loop3): Directory bread(block 2572) failed [ 266.082991] binder: send failed reply for transaction 636, target dead [ 266.098563] binder: undelivered TRANSACTION_ERROR: 29189 07:13:43 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo0\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:43 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0xffffff7f00000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:43 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x400001, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x6, 0x10802) linkat(r1, &(0x7f0000000080)='./file0\x00', r2, &(0x7f0000000140)='./file0\x00', 0x400) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x3, &(0x7f00000000c0)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2a, 0x27}, [], {0x95}}, &(0x7f00000002c0)='syzkaller\x00', 0x9, 0x4ae, &(0x7f0000000340)=""/207}, 0x48) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000004c0)="0a2d93dd7fa3f2df4be34358421406e0adbd22df5613048499e5f264c46b99060b3fc2a3601a351c085bbc236e01a4e6c5fcadd68edbe25100a1f1a85e5c050cf66e4c012f062e78bd65efa8f5bf5dfcad5bee633f4a4840d76942ca21eca1689166af972ec0460f79c34ba8d4c8d3da5bfb3fde7dbf0eb84388a51c1f5e17366b5f3bb480", 0x85, 0xfffffffffffffffd) keyctl$read(0xb, r3, &(0x7f0000000300)=""/25, 0x19) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000180)="561c19bb7616d9a9f4949d6d8845c237", 0x10) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x80000000, 0x410700) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="47250800d5e38c55f23a57e57e51c05d", 0x10) 07:13:43 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f00000001c0)="4679d76635d06c7509", 0x9}], 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc84a6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0x0, 0xffffffffffffff3f}) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) write(0xffffffffffffffff, &(0x7f0000000140), 0x28d) [ 266.289205] binder: release 16000:16004 transaction 641 out, still active [ 266.296226] binder: unexpected work type, 4, not freed [ 266.301526] binder: undelivered TRANSACTION_COMPLETE [ 266.312833] binder_alloc: binder_alloc_mmap_handler: 16000 20001000-20004000 already mapped failed -16 [ 266.325476] binder: BINDER_SET_CONTEXT_MGR already set [ 266.331212] binder: 16000:16004 ioctl 40046207 0 returned -16 07:13:43 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdou\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:43 executing program 5: r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x7fffffff, 0x115200) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0xb, 0x20001, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f00000001c0)=0xc) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000200)=r2) inotify_add_watch(r0, &(0x7f0000000100)='./file0\x00', 0x40) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/rt_cache\x00') ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000000080)="e86219620072") 07:13:43 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x68000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 266.338239] binder_alloc: 16000: binder_alloc_buf, no vma [ 266.343889] binder: 16000:16012 transaction failed 29189/-3, size 24-8 line 2967 [ 266.357732] binder: send failed reply for transaction 641, target dead [ 266.369671] binder: undelivered TRANSACTION_ERROR: 29189 [ 266.489965] binder: release 16029:16036 transaction 646 out, still active [ 266.496983] binder: unexpected work type, 4, not freed [ 266.502280] binder: undelivered TRANSACTION_COMPLETE [ 266.520704] binder_alloc: binder_alloc_mmap_handler: 16029 20001000-20004000 already mapped failed -16 [ 266.532998] binder: BINDER_SET_CONTEXT_MGR already set [ 266.538807] binder: 16029:16036 ioctl 40046207 0 returned -16 [ 266.541127] binder_alloc: 16029: binder_alloc_buf, no vma [ 266.550336] binder: 16029:16038 transaction failed 29189/-3, size 24-8 line 2967 [ 266.560854] binder: send failed reply for transaction 646, target dead [ 266.567847] binder: undelivered TRANSACTION_ERROR: 29189 07:13:44 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x3}, 0x1c) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x401, @remote={0xfe, 0x80, [], 0xbb}, 0x7}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@remote={0xfe, 0x80, [], 0xbb}, 0x1, 0xfffffffffffffffd, 0x0, 0x5}, 0x20) 07:13:44 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0xfffffffffffffffe) r1 = syz_open_dev$dspn(&(0x7f0000000340)='/dev/dsp#\x00', 0xff, 0x444000) r2 = syz_genetlink_get_family_id$team(&(0x7f00000003c0)='team\x00') getpeername$packet(0xffffffffffffff9c, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000440)=0x14) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000004c0)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000500)={@dev, @broadcast, 0x0}, &(0x7f0000000540)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000740)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000000840)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000940)={{{@in=@broadcast, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f0000000a40)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000ac0)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000b00)={{{@in=@rand_addr, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000c00)=0xe8) clock_gettime(0x0, &(0x7f00000035c0)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003500)=[{{&(0x7f0000000c40)=@ll={0x0, 0x0, 0x0}, 0x80, &(0x7f0000001dc0)=[{&(0x7f0000000cc0)=""/245, 0xf5}, {&(0x7f0000000dc0)=""/4096, 0x1000}], 0x2, &(0x7f0000001e00)=""/51, 0x33, 0x7ff}, 0x8}, {{&(0x7f0000001e40)=@rc, 0x80, &(0x7f0000003040)=[{&(0x7f0000001ec0)=""/184, 0xb8}, {&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/143, 0x8f}], 0x3, &(0x7f0000003080)=""/248, 0xf8, 0x2}, 0x7fffffff}, {{&(0x7f0000003180)=@nl=@unspec, 0x80, &(0x7f00000034c0)=[{&(0x7f0000003200)=""/243, 0xf3}, {&(0x7f0000003300)=""/105, 0x69}, {&(0x7f0000003380)=""/39, 0x27}, {&(0x7f00000033c0)=""/236, 0xec}], 0x4, 0x0, 0x0, 0x3}, 0x5}], 0x3, 0x40000003, &(0x7f0000003600)={r10, r11+30000000}) accept4$packet(0xffffffffffffff9c, &(0x7f0000003640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000003680)=0x14, 0x80000) getpeername$packet(0xffffffffffffff9c, &(0x7f00000036c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000003700)=0x14) accept4$packet(0xffffffffffffffff, &(0x7f0000003740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000003780)=0x14, 0x80800) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000003880)={0x0, @broadcast, @local}, &(0x7f00000038c0)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000003900)={'vcan0\x00', 0x0}) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000003940)={@mcast2, 0x0}, &(0x7f0000003980)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000003a00)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@loopback}}, &(0x7f0000003b00)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000006b80)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@local}}, &(0x7f0000006c80)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@dev}}, &(0x7f00000002c0)=0xffffffffffffff21) accept4$packet(0xffffffffffffffff, &(0x7f0000006f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000006f40)=0x14, 0x800) accept$packet(0xffffffffffffff9c, &(0x7f0000006f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000006fc0)=0x14) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000007000)={@rand_addr, @remote, 0x0}, &(0x7f0000007040)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000007100)={{{@in6=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000007200)=0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000007580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000075c0)=0x14) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000007600)={@multicast1, @broadcast, 0x0}, &(0x7f0000007640)=0xc) accept$packet(0xffffffffffffff9c, &(0x7f0000009a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000009a40)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000009b40)={{{@in=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000009c40)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f000000a5c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1010001}, 0xc, &(0x7f000000a580)={&(0x7f0000009c80)={0x8fc, r2, 0x1, 0x70bd2a, 0x25dfdbfd, {0x2}, [{{0x8, 0x1, r3}, {0x22c, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0x8000000000000000}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r5}}, {0x8, 0x7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xffff}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8, 0x3, 0xe}, {0x8, 0x4, 0x40}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x5}}, {0x8, 0x7}}}]}}, {{0x8, 0x1, r9}, {0x12c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r12}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r13}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x150}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0xb43}}, {0x8, 0x7}}}]}}, {{0x8, 0x1, r14}, {0x7c, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r15}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r16}, {0x148, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r18}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r19}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r20}}, {0x8, 0x7}}}]}}, {{0x8, 0x1, r21}, {0x25c, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r22}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r23}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r24}}, {0x8, 0x7}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r25}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r26}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r27}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x7fffffff}}, {0x8, 0x7}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r28}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x80000001}}}]}}, {{0x8, 0x1, r29}, {0xc4, 0x2, [{0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8, 0x3, 0x5}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x1ff}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x14, 0x4, [{0x5, 0x7d16, 0x3a, 0x4}, {0x0, 0xfffffffffffffff7, 0xdca8, 0xed5}]}}}]}}]}, 0x8fc}, 0x1, 0x0, 0x0, 0x4887e9aef45e8989}, 0x4000) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r30 = socket$inet(0x2, 0x200000002, 0x0) getsockopt$inet_int(r30, 0x0, 0xc, &(0x7f0000000040), &(0x7f00000000c0)=0x4) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000001c0), &(0x7f0000000200)=0x4) epoll_create(0x400) r31 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2002, 0x0) bind$bt_rfcomm(r31, &(0x7f0000000080)={0x1f, {0x8001, 0x7d67e9c5, 0x6, 0x4, 0x5, 0x5}, 0x20}, 0xa) recvfrom$inet(r30, &(0x7f0000000100)=""/85, 0x11, 0x1, &(0x7f0000000240)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x1b) 07:13:44 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:44 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdop\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:44 executing program 1: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x5, 0x44400) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x2}}, 0x1000, 0x5}, &(0x7f0000000100)=0x90) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x3}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f00000003c0)={r3, 0x80000001, 0x8, 0x0, 0x1f, 0x7fffffff, 0x9, 0x902, {r4, @in={{0x2, 0x4e23, @multicast1=0xe0000001}}, 0x4, 0x6, 0x0, 0x8c11, 0x6}}, &(0x7f0000000480)=0xb0) socketpair$inet6(0xa, 0x800, 0x8, &(0x7f00000000c0)={0xffffffffffffffff}) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) fcntl$notify(r5, 0x402, 0x4) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000780)='9p\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c002c0c51cc51b28ee984011ce9d74de6fb6b6644929f7d054413c07bcd484bd5750e2e425eb3389ef97ff73a800bd8c312fa75ca1793aeaec1eaccd77418141d1bf9d28a7f056a04333de851b2ac4a984dfd4dd4737132002597efbed81eff04f765e72206aada0aa4d73157910ece2252a6d925"]) 07:13:44 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000040)="fffffd7f736e0de081fe6d7000") write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000080)={0x28, 0x2, 0x0, {0x2, 0x0, 0x100000001}}, 0x28) sendfile(r0, r0, &(0x7f0000000000), 0x200) 07:13:44 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4040534e, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:44 executing program 0: socketpair$inet6_sctp(0xa, 0xa0332c2da1bec8b2, 0x84, &(0x7f0000000040)={0xffffffffffffffff}) getsockname$inet6(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, @loopback}, &(0x7f00000000c0)=0x1c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x501000, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f00000001c0)={0x2, 0x0, [0x40000071, 0xfffffffffffffffc]}) [ 267.202644] binder: release 16072:16082 transaction 651 out, still active [ 267.209685] binder: unexpected work type, 4, not freed [ 267.214987] binder: undelivered TRANSACTION_COMPLETE [ 267.220638] binder: 16072:16082 unknown command 0 [ 267.225536] binder: 16072:16082 ioctl c0306201 200007c0 returned -22 [ 267.234434] binder_alloc: binder_alloc_mmap_handler: 16072 20001000-20004000 already mapped failed -16 07:13:44 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f00000002c0)={0x0, 0x1000, "a062d3fff871a1a7f14e2f15646ea24751b6453c4f666bb5326d1b7d1e53fefa63899081b096d04bc26ec141882a4593169fa4004224c34145c348956448c4be5439c848de235dd26f5c16d263a890da799acea41490e25da18a04c0d71a2bf92b12919d42871435703de16b0243b5745551d6026a3bc6f6359caa8c51be2fc19ea25f841ddad4eeb8f675b6cfbe103431c78b6633d99d3d955a9eeb4269d8c745cf2b2009648b5dce26786a9bd54d00f2188e785aeb0a435f9163b896429230ebfdde02249bf6643eaa1a88663ff97b05fda955dde0097e8ab84a36f997c94638b34b867a8d24b87433b901360df69ce42df1ab6e1a4e7618d0c4f192d43e7c5607ad09a23f697143c3fd77bd018a7b3510860dc8eb0d46d4f22effef5328408f93ece0e2b7528ae4ab70f5fc5d80c22c29073320fd828ac13231c95fe4b8aa7936d3472c1a80f1a55fc32d7e4f318d2d75f27fa876ffc158b3dec06d092d6c5c039fc9b7b3c47e378ff7707b935a0dc5e735f97688e43a2e560732c8ff1b45dd8fc452dc249ec901187819e222f4734f83b316f9ff0342e974b1e80c2a5973fddb7b080c0bf32aee0688ed15a897c14c621cb7e83a17eacde4db2ad77dc27efc10a99e6e047d88c4c67292ff28441b89b36aa4d554c21d1620f26b86c5c434a289375f3308aa86f879503c6406beeedab5ecac3e022167eb183ddca8c69f23976a4d822768e70adb71b735fca9f185368626dcdcb9c0bf31e842a17ffc47769b5ba399611b49df6f6135befdcd55139ef618ecb0fe4737e79ef429463a09befc3bd0afe10a05d62c49d6f7931808e108560ad3ce543a279978e197de2d7fd1f00074eaf1491ef11087c9432f10517f22a240ef2f2268f6eb520d16c47a8ebe965669e59047d3a6a8ef978f5d0d9232e5828f06779f65e48d4aaedd62a7e049ac17cb923a57d1739e004714919d05d30ecb808f99ee6895b5f3c75f0841a2c3d4de005e3efd6f8827ae4fdd6e8cf118cfd21313da35fab3256f52c3502fe9e2bee937887eaa427b148cd6c22a96faf5fb2eef6a39d0453fe1966592a53cce04be05d6f611ca5ff08d6483d8b2f5c7913c26e2a76d31ab479c3f2a4d778fd9dd8314894a78d21dff6a4c70a9e179774c7444b180796a9ad398ba982f55c7138dc7e97d9279d5b6bc6ba1a02b363cd7eeeceee73fca30801ea7f13b69ccd1955ee9b65fad1337c67eeb97ef9e9868a8b4e1760d3cd6fe90f2e33e87b8965750e0130e8222a782ad4ca15c480a73443cbbe79e8989e212d195d9dab9f67315b70c68b8c9bb20f7910a4451782d2d93350dbe9f977408391829277dc0b51ebe0961d7ad9537435d6da025ac6443f3624e68ab09d777e722379ede2ee117dc8ad1cfa79325ef3779fffccc9e8935e545a2386671ff318782ec2cf0c574e3ed830af7d17737fc762dfb334569847a3b3dfe1b66dbbdbe3028b42dd4698f5a557473c3a2e6c551abebba6f0e0ed12a76bcaa6390edb85f9f3bf034205db7f66fa6ad19d6aba4e58923f1924de8f6fd3514b6ed43b495bb959b3ca2d5a87e48f2d6606f5939700ea7b23b5c905e273812bd57cce40f933b66d4f7f7662d396f9adfdf431085106f581fde005418fc8486ec6befd72cfb3320efba95eb96858e457d0339f6b74e6b94e8e9fedfb0d24d0f7bf7c062728c97105b1f2a8325e8565aac65250e328a88bd272b29b1f0c1f0c56f3e2c03179dc459ac5458f332c228bd8220e5be14ef67bebbc9e08d76be3e256fbcb651369a9c8f9d5d8c467b7cebddc58e4f503204398859f58b2c38da0581f25718c25107d0ebdec2b0260dc98cbbde00d2f9673afcbba0b1dcdc2447fee7478d4395b6f99f86a69fe0de60d122595f9f694dc8763709e1b704c0f61fe18d699ca948c615ddb5ce62d329b27a9c3a041874f319aaa785f58bc9075881313db9689d953ce0de4052fad79bbbac9ec7ec9bdae06e5a0b0e84d36243d6d61ae8122c5388c20689daf2f376baed47524c997a32d954be7508d6ab25378bc2bccb1c6bef27def7189b140791f01b199e1fa5dae176c11f9fcfd6d90ac173c481be0361479c1c6f60874e190e6738a95748164f513b8539454707f8f6b53b3c366cf93d0883479ed17a9050a3ba476c3154dd7b246f1af1bb9320a8a2debea8aa7f12d34ceee8a60c73a1821d09ededf8c48b532ec657884a2d587ee85d8a50bdef0a46abdbd1de211ef33e8f0bbd3c2489b81634d7bba5311986a26b7f6796b667fb9705da4df9feb9f60ea7ca34da0c6597616d207fc38b0bb002a83dad2db6da381f7f4fb0d8dbd03a22603397b3d7a6b17d0a835a8e8cc9fac208e56de6225b72502bc899cdf946ffb8f3bffbcc46c1962b03fe2ca790adcc84415eb1ea7d660287bde76e105410447981ceb5d3b5922b8bc52898ed9ecbd67198ef17532c5b7671bef009fd8673c6ce4037fae25f619e4671ccac8bc780654e6e2764bd2f44b306277d36b85a34019ce38c3aca81b36f3234c0d1b332ba648f2f538c947cad4c9edd97fbb20216b34b2bc7c7150257e437e17f797164349eca330ecaddb36702b75745641ce2f681b1721a20b30d3f0fef04c0ca399cdce8d3cc05c9fc6193456f676b715735cf7613e9e6fc53737cf54be838df868257af813bdfa43a5cfebcaf24bf284fae6acd6129b5073ae894da0a19e689ac947c8116fe847a959a1e33f413c07cfa143268dba169b6903f82fadb9df43ed0d6dbfd0479eadedd59af5d3f74c914095c5e109faef4d94e24817e767bd69116964a9c0e80d94fe7116ffac8210109762df1c5ad0d539cb61a19f651522d4b150c0a472812160e15cb718df1ce33d33666ba74dc095b6eb609c9bee6df7b3cabc131e027d36f4ff7959e1f5e5a12b7ea4e47c1f57f4a6d2ab322872d149eb79b82d8f0bd0c9e8b48d305b82bd3fdeed9f8b34ead326cb72225cab754f3dd7fa964eaef7766ad57561f077c18724c5e9cb32c2c8b8e1472fa503f0e6ade825d2ceb557719f1a78ea6d2854f4239d0deecfa24d9cd8b28cd9dfee752eb767c47727d06e9b5beb406c429f2da86e6eac4aacb87bb1121bcc09e1e533468cbce66ae139bd5d45a09ff6df83b1a00b6eaed3c8acde9a5ceadc5ea42f111ca60f38ca0140d61b8dd5b218f285da1fdc62caf6de6d06dfc41178d268dc2ec054b7b8f964028b4ce937b3abf118c692219ebfa445b0bc33be70de354d6629d90f0fbda63e3323fb63bbb46ec1d0b517bcd4e8c91bc05aa61f589430489c029e487f20055b624b85ae4979d99862a94461d1e9b3d0e48a631f40781eba9714c2af87f89b65a5e02bcd49629e766d9d0ded12a96d9de6586d304a178d90a8f39b1d844ff915617bb5bdf1aa8efa89dddec02da345f439ea0a2e0b8bc91feb6bc30c1b241432099ef0ddb55068104009faa30da992a69ffb85bd0de67130439e2de46b1236087b45b8817ebb8223264c29cd33d259b7d8aaebebb565c73e9ee860239957170943a4e258573e821e9ffa1358988423b0be26f8a6ee4960a230368bae350d943e967e76c80bcad2845c0b7ffc6c876a4c8a9045537490b79410c67061658bcd11f590f3c26c6ea3d0434a1115a050537c2f3d2edaa140a6a6e9b82cc525f6422db58142b3b4470547384894ae591682e477bd2c5ae814eb8b27d7be6736833a7485571b847031d4d5c37631b5ecbb6ef70cf3a0c17424d33b124bfb05a0ed6570bbe8c5a4254980d7729ee94c48f2f4dd8180c3ba64c455c112fcaf28ab975b737345bad416c019097b7e2902eb08c3af66e46217993772c4bbc559387b083fd1459771e092735871a8151542aa54ed78db340e99c8ae6096141cfa01e306a11f1f4a39f664afd2ff83830c0d317816c946d07d94e5210e6093cea17b1d1fbbf42f5982e3f74a9c0fdfe894ea5a8fba4caa5780928415bcb7b792882ce2d76893f9d7d5e5f37b703b55c0d1df00495479e09ffddeaebb12c2e15fe0204e7a6194523acaf49cca432c70f9949f801cd4af349555542c96bfe175f8ad4c67527a956fb4a6541e8415f441ba095d26dad8fb30b9159c62b58f3aff9c75316382f9921b08575c75d2f6a3f02a08dfee69f925cb52082e4855822cea10d7686c4e5e5729172f1d343e5cc87a675e81126f68400de6550b5c357ab02e4e1da10b766e798f82a1bb8a37ade051c9a26bd1d8a62639b2c7bbf81013f16543229992a37a4ef490f1f0445798ea63f2dd17b538fadaf9297845823dbfbe6b569f173145ba105837be32f54d414e7a9e71bf14afc65befa51690da788adfadfdcd000c8088259252d8ff4e0638d303e15fcc0f4c9f313ed5c38b5bbaaa0f23b5e46b261742981ec2e8450d20d9b2cd04b888b4622b1fcb5ae1a94e0d6c83530ca7d9ad144b7b1dab5d512eff1b0bece5f509c3c19ef525b5181af4c61826cac22b6ee8f3ecde9c247b71fb0685d27510a22581b70f18df39d308ad1c89d05c2cff2ed63097beb71e05bc655dacca657ecf307eff22c604557207321fc984a038de95145ce3fda7196ad54d211b3e266ff40a5c6a7d7b6d204425e05d62c03c5cdf43593749520f0f66fcf588f796805e8f6b9c8780fbdfc85b56b49a18bbd7032b88af00ac7e20b40d9f059b473b3c84698a1004f510f4ca5f576a7801fd03c3c6ecb754811be36185a91422ea22e4b3407764ea09636990ec91adaeac5ceffdf342c2a05bae8b68dc283b2eba3d922fc315e34ce099789c67cd761b816d816e7fd5a860664a795e3ee8f3da0d4c6bf7e6f2596760f5c2ae3de166dbb6d2ae7512d7d13c6598dcfb9b0b8665016de7aca13bb83d6dcd6e8a031a2d1dd977226530f09ff35b61539a3e7fc2e0490ad9f0bc8f4baadfcc540c723253253f22b302cb3682e984928aaab9808b48141b4ea985f56fed5824a6bcb5cd8acc6c0adaab91679d460c9883c48cca08d6f162ea353cbdbd525d14b4172dbf5287a5e1a767b6eba9eadeaa030ed58f951162931335843df81740aa5485cf59c4805b65795a3565008e7e74a3a675d98f185863c6b63f98c56d8abaceab1d8dc928245f76075cd32adf38fdf45b8120f93689004fcd15a87bcd8b54d803be5e55eaed15942146f46b9d5d38c136cf6d1ab759fc0bf31d94856ebc55ef8fef19517ea9ab3a3907f382e18d0348abad7bf7afbebab40e311224707d946ea086f6c630642523dc17d7530ad58c9056df103b06c0967beafde562bb0326cc45337c7d3f63ac0771ca69a38715fd67b16d91316e212c18b81c9f0821eeaa4792c5ae46a37eeedd6a187ef95cbbe449122eb0d4109ee12b8cc1231e9c6edbd266cd29e692b75d8fe95402fe45111422c9d3930cff421b60769825dadca0e30f7516179f5e9602cbe1ca989adc04e7c3cf5b0c8aefce71c57d5491df7e09eba4f7cc5636f1d884b0960988c00ebf89ba35981316c0beb4adf562e95aabdb18b64fa245cb11f260036b45c4a9283bac08d592b3f99d2619a9fdab56f950be5203208e39d52cb46dbfc2dfd4f9067aafb77538f34c4ba18e6e7aa06cdd9c44f694354d4b1a93fcaeb8b74103b2701ef90d3ac8b215707e0654e6f20b1433945e190824552bcc744204fbb09655c9057c74fb2e27468a7bcf93fe7423c1147ce8aba592c47ce840cfa12b9ffdcb6dbacba5e29e5c135811668b7ea5c0bc572a2a7e5c3c5bcebd97c1565c7d61167a0db26600d6900a2f9d814e3c789fbdce01651094fc26b84c22052e2bad2b0"}, &(0x7f0000000000)=0x1008) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000080)={r2, 0x7}, 0x8) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae0a, &(0x7f0000000040)={0x13}) 07:13:44 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x58) ioctl$sock_ifreq(r0, 0x8970, &(0x7f0000000080)={'syzkaller0\x00', @ifru_ivalue=0x4}) syz_init_net_socket$llc(0x1a, 0x3, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000002100)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="d4", 0x1}], 0x1}, {0x0, 0x0, &(0x7f0000000580), 0x0, 0x0, 0x0, 0x4010}], 0x2, 0x0) [ 267.257460] binder: BINDER_SET_CONTEXT_MGR already set [ 267.263761] binder: 16072:16082 ioctl 40046207 0 returned -16 07:13:44 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$9p_rdma(&(0x7f00000000c0)='127.0.0.1\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x0, &(0x7f0000000340)={'trans=rdma,', {'port', 0x3d}, 0x2c}) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) 07:13:44 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0xf4, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = getpgrp(0x0) sched_setscheduler(r1, 0x3, &(0x7f0000000040)=0xfff) getsockopt$inet6_int(r0, 0x3a, 0x1, &(0x7f0000000280), &(0x7f0000000000)=0xfffffffffffffd2d) [ 267.298161] binder_alloc: 16072: binder_alloc_buf, no vma [ 267.303824] binder: 16072:16085 transaction failed 29189/-3, size 24-8 line 2967 [ 267.323184] binder: 16072:16101 unknown command 0 [ 267.328866] binder: 16072:16101 ioctl c0306201 200007c0 returned -22 [ 267.337544] binder: send failed reply for transaction 651, target dead 07:13:44 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdoX\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:44 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x100000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 267.346029] binder: undelivered TRANSACTION_ERROR: 29189 07:13:44 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000140)="025cc83d6d345f8f762070") r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x10000, 0x0) epoll_wait(r3, &(0x7f0000000000)=[{}], 0x8e, 0xfffffffffffffffb) dup3(r3, r0, 0x0) 07:13:44 executing program 6: r0 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0xfffffffffffffffa, 0x80) fadvise64(r0, 0x0, 0x2, 0x3) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x9, 0x7}) r2 = perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000140)={0x0, 0x1, 0x7ff, 0xffff}) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000180)={0x200, 0x80000001, 0x3fe00000000000, 0x1, 0xa7}) [ 267.483523] binder: release 16115:16123 transaction 656 out, still active [ 267.490559] binder: unexpected work type, 4, not freed [ 267.495858] binder: undelivered TRANSACTION_COMPLETE [ 267.507471] binder_alloc: binder_alloc_mmap_handler: 16115 20001000-20004000 already mapped failed -16 [ 267.518992] binder: BINDER_SET_CONTEXT_MGR already set [ 267.524773] binder: 16115:16123 ioctl 40046207 0 returned -16 [ 267.531261] binder_alloc: 16115: binder_alloc_buf, no vma [ 267.536924] binder: 16115:16129 transaction failed 29189/-3, size 24-8 line 2967 [ 267.547504] binder: send failed reply for transaction 656, target dead [ 267.555997] binder: undelivered TRANSACTION_ERROR: 29189 07:13:45 executing program 1: r0 = memfd_create(&(0x7f0000033ff3)='\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000180)={0x0, 0x1}, &(0x7f00000001c0)=0x8) select(0x40, &(0x7f0000000240)={0x1, 0x80, 0x3, 0x1ff, 0x8020000, 0x4, 0x5, 0x6}, &(0x7f00000002c0)={0x80000001, 0x8001, 0x9, 0xe2, 0x5, 0x1, 0xffffffffffffffff, 0x5}, &(0x7f0000000300)={0x9, 0x4, 0x80000000, 0x1, 0x8, 0x80000000, 0x200, 0xd8}, &(0x7f0000000340)={0x77359400}) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000200)={r2, 0x6}, 0xc) socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000380)="433844ce3a79412e17743e3d277379d5cb549525dfa663c9df6605aca7b9f72cc6421831a0b72104fb1f8ab8d7eb7f55b574caf2eb5591986659502deca5b78da9fff2") r3 = dup2(r1, r0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x1, 0x10}, &(0x7f0000000080)=0xc) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f00000000c0)={r4}, 0x8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0xc0bc5351, &(0x7f0000000100)={0x12, @time={0x77359400}}) 07:13:45 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x0, &(0x7f00009ff000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [], {0x95}}, &(0x7f00002bf000)='syzkaller\x00', 0x8000000001, 0xb7, &(0x7f0000000440)=""/183}, 0x48) r2 = socket$kcm(0x29, 0x1000000000002, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f000031aff8)={r0, r1}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000280)={0x10}, 0xb, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x0, 0x0, 0x0, 0x0, {0xd}}, 0x5580}, 0x1}, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r3, 0x119, 0x1, &(0x7f0000000040)=0xfffffffffffffff8, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000500)={0x0, @in6={{0xa, 0x4e21, 0x4, @remote={0xfe, 0x80, [], 0xbb}, 0x800}}, 0x5}, &(0x7f00000002c0)=0x90) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000300)={r4}, &(0x7f0000000240)=0x8) 07:13:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0xffffff7f, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo*\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:45 executing program 5: r0 = socket$inet6(0xa, 0x8001000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r1, &(0x7f0000002000)=@in6={0xa, 0x4e21, 0x5, @mcast1={0xff, 0x1, [], 0x1}, 0x2c}, 0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000006000)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f0000000200)={&(0x7f0000004000)={0x1d, r2}, 0x10, &(0x7f0000002ff0)={&(0x7f0000000180)={0x1, 0xffffffffffffffff, 0x0, {}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "a702ca9c1a8d1dc1e4e29ed4d2927b5e8155ac02a25334d332f97653d9d90256b4da4ec6f2b44831a3b878ada2f3e5883f2f7c806fb61c1993cc4f19a22c61e4"}}, 0x80}, 0x1}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000011000)={&(0x7f0000010ff0)={0x1d, r2}, 0x10, &(0x7f000000eff0)={&(0x7f0000000040)={0x1, 0xfffffffffffffff9, 0x0, {0x0, 0x2710}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "68759a67d8602d3e4b207446a705148d03f1f86e60b22a6ec7e5b35afc19cd0ed506fb9cdba948697c01f3ec6bc0f8f98290b0198d30bde485753f80c203fe81"}}, 0x80}, 0x1}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x30000, 0x0) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000140)={0xffffffffffffffff}) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x84000) syz_open_dev$sndmidi(&(0x7f0000000100)='/dev/snd/midiC#D#\x00', 0x5, 0x40) r5 = fcntl$getown(r3, 0x9) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, r5, 0x4, 0xffffffffffffffff, 0x0) getdents64(r4, &(0x7f0000000200)=""/162, 0xa2) flistxattr(r0, &(0x7f00000002c0)=""/26, 0x1a) shmctl$IPC_STAT(0x0, 0x2, &(0x7f0000000340)=""/76) [ 267.911198] binder: release 16156:16161 transaction 661 out, still active [ 267.918189] binder: unexpected work type, 4, not freed [ 267.923503] binder: undelivered TRANSACTION_COMPLETE [ 267.933604] binder_alloc: binder_alloc_mmap_handler: 16156 20001000-20004000 already mapped failed -16 [ 267.958469] binder: BINDER_SET_CONTEXT_MGR already set [ 267.963990] binder_alloc: 16156: binder_alloc_buf, no vma [ 267.968061] binder: 16156:16161 ioctl 40046207 0 returned -16 [ 267.969683] binder: 16156:16166 transaction failed 29189/-3, size 24-8 line 2967 [ 267.988251] binder: send failed reply for transaction 661, target dead [ 267.997382] binder: undelivered TRANSACTION_ERROR: 29189 07:13:45 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534b, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:45 executing program 6: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000057ff8)={0xfffffffffffffffe}, 0x0, 0x8) r2 = epoll_create1(0x200000000080000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000300)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x3, &(0x7f0000547fa8)={0x0, 0x14, 0x4, @tid=r1}, &(0x7f0000044000)) timer_settime(0x0, 0x1, &(0x7f00009c8000)={{}, {0x0, 0x9}}, &(0x7f0000105000)) 07:13:45 executing program 1: sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x3}, &(0x7f00000000c0)=0x8) r2 = memfd_create(&(0x7f0000000180)='wlan1&usertrusted/\x00', 0x2) getsockopt$inet_sctp_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f00000001c0), &(0x7f0000000200)=0x4) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000100)={r1, 0x39}, 0x8) clock_nanosleep(0x8, 0x0, &(0x7f0000000140)={0x0, 0x1c9c380}, &(0x7f0000000040)) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r2, 0xc0505350, &(0x7f00000002c0)={{0x9, 0x7}, {0x4, 0x1}, 0x3c8d, 0x1, 0x82}) 07:13:45 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0xd7, 0x8500) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000080)={r0}) r2 = dup3(r0, r0, 0x80000) preadv(r0, &(0x7f00000014c0)=[{&(0x7f00000001c0)=""/67, 0x43}, {&(0x7f0000001440)=""/90, 0x5a}], 0xffffffffffffe73, 0x4) getsockopt$inet_opts(r2, 0x0, 0x9, &(0x7f00000002c0)=""/79, &(0x7f00000000c0)=0x4f) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x1, 0x4, @mcast2={0xff, 0x2, [], 0x1}, 0x4}, 0x1c) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000000)={r0}) sendmmsg(0xffffffffffffffff, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001180), 0x240, &(0x7f00000011c0)}}], 0x249, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-des3_ede-asm\x00'}, 0x58) 07:13:45 executing program 5: mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='rpc_pipefs\x00', 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snapshot\x00', 0x0, 0x0) umount2(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x148) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000005580)={0x0, 0x93, "cf5c1bbd32b212df58a3c249d856f600618e9aea5b22a3986a8310c07b7369f80bf58a7d4c220be2e67f1eb74fed5fb4a70064b6c9ee2d50311f50ce6b87267e8b7d94546ec4b4befe54d8b9f4cd7cf4d0856868c6e84288f5ca9dce8acb762376d3190abf5dc17023ba13606d19067217057cbfcb704037e21e9897df04c1bd48383a7f82e634dc201bc0033b52dc650a5925"}, &(0x7f0000005640)=0x9b) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000005680)={r2, @in={{0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}}}, 0x84) r3 = getpgid(0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000540)={{{@in=@multicast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000000640)=0xe8) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f00000054c0)=0x8000) getresgid(&(0x7f0000000680), &(0x7f00000006c0)=0x0, &(0x7f0000000700)) fcntl$getownex(r0, 0x10, &(0x7f0000002f40)={0x0, 0x0}) lstat(&(0x7f0000002f80)='./file0\x00', &(0x7f0000002fc0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000003040)=0x0, &(0x7f0000003080), &(0x7f00000030c0)) r9 = gettid() getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000004cc0)={{{@in=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000004dc0)=0xe8) r11 = getgid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000004e00)={0x0}, &(0x7f0000004e40)=0xc) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000005440)=""/85) symlink(&(0x7f0000005500)='./file0\x00', &(0x7f0000005540)='./file0\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000004e80)={{{@in6=@ipv4={[], [], @local}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f0000004f80)=0xe8) stat(&(0x7f0000004fc0)='./file0\x00', &(0x7f0000005000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000005080)={0x0}, &(0x7f00000050c0)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000005100)={{{@in6=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@local}}, &(0x7f0000005200)=0xe8) r17 = getgid() sendmmsg$unix(r1, &(0x7f0000005300)=[{&(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000200)="fb978f9ca309fccbfebbeea60d7558d08514398d32d066bae5d42b32e1c0e018e66b5d96014ea289280cd8a067835b533d7b9f131ac49fa32d279a874ae9727527514a91a82cd9982e94c406facff916f034126d415efd1d32b1d3b0bae75552d6ee1a4f18afb0c7fb6fc2b13ceae4b25ef99e1fabbb5aa7b19aa0234181bb5f400e138554bc0eebef36eb0cefefd3e4eabb770bb3e961b5e7402d480b085e9432b8a2e8298c9fc3f8df90ad661428757879f702605468f2e0d2d3af8ce47c83bb", 0xc1}, {&(0x7f00000003c0)="4ff0406922fb6773f0b89e2f332a32b665bf1cdb6ed38f06367c063aaa40d1fe211ef84803d631fc6e8a380ea9ac4b2dcf0ee4614037c8a43fb2710e63d662de6953aea3f3e28787a6d168e87fc82eb2a0ccd2db3cfc957cbb0896387d5759ba3c070351538e483149423ae5a7c5eebb34e7be66b1c1bc9678fccabfb3be68f7f3335657e095de30933fd51e401c7b461ccf08ea4368b5bdb431f661dc19632b8501951eceef3fee5599bae1bc16eb26d10eb80c3efe6efeba502b58ea717aecd4831c0cdce38a16608aa53418d95cea5a52156b710e5f65fa62fbdfc8400f24b3e223a09140fc", 0xe7}, {&(0x7f0000000040)="6293e91aec3d7371e815e8b002ed3eb86e72bc0dd9de3a2b14df8365adfaaca505a0b1", 0x23}, {&(0x7f0000000300)="19213b6db41779975b8a22c382dee9dbb82e80e3e5846200762d559687778ebe2e227c7b5fb910bdd4e11679a44f83f7b0b94e2e5638c07e72d127f8d89f972b81cfb6d35df351a79389fb31ed1796653403f69f64cf0eb4756dcb100dd5d8ad", 0x60}], 0x4, &(0x7f0000000740)=[@rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}], 0x88, 0x1}, {&(0x7f0000000800)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002e80)=[{&(0x7f0000000880)="4ad70e653dab7e9665118e079923c039037e126149fc1b5c6a23ed93872bae9906d26560ca5b11d0fd537c6611df41d34213acbb0b", 0x35}, {&(0x7f00000008c0)="bf09068c8c2098dde41fc59f7ba253251a0678fde6e76f8635ff4e1dee27c000f2bd739e76f87b9f07b083677a119666c8a453c4e269459a6ba22dbe395df51ca94661164b091a22b1ef4d81482aa11ac7fdefb219a39748199352215d0b745c5b4312d1bff63d7fefb91b844199612042c91c99c3127bd3a29ebaacead24ab715a9acc55d0baecb3306da7866e3a7d2e36fd0514c55b514181efa2dc82f7314455d57d9d253c968b4f982389a2801595f488a4ce5bd0108d17e7b12646162081d3faa8ff862a7bbde4cd563b50afa2199b6e3a86ae6866302f1e14f0b2ffd5e3dfe5d04c1", 0xe5}, {&(0x7f00000009c0)="04551833125137683d37d8b140bd9b716e164ec48797562b372a3328d87dfb2fad301331684676ec73fcab2fd79b442dd6dc531d7fefa6fb3d9794f34d8103f34b6abf16aea7935bd9d94fa7cef18c63edae66167eca75f05fa6d7c906a6060ad6da67a35120cc470f08e7bad2fe61f2ca259e2e05f0bae6aff3a6371bc7f926fcf61440f726febd23bc75644e3e740eb6174b433d47c3774afcfaf89c7da896ddd319cb0f43714ad97644cc2940bdc4be8907e7f0f10b332bca94291e7fa38e75938aef2125a0ce0a40c72c0eac2f471a0f48837d6a874098be934c80eb498c0fbc46eb472371373ab6c27fbdf5c0be7b", 0xf1}, {&(0x7f0000000ac0)="287ffbde411ec41af454fb3ec7dcb9f0069fb4bd9ff7d7ad7d022a363063ffe8e0f42c2bcd8314e3f19b668a6f5a6d6daa90b1211d12287c24862de54b34514a86017ec049b49b702d57f74c866221b46183bd9a2592a3a822fae6a5c42d4fe9d277f8a4aeb844fc3d3a551c3afdf481cb77482587c05cf9542f188547de18ee145f5cd8b106180e7347f3973fd7eaea3da9a843e001b66ba41e0337805cfb44312e1ee7feb0e02f13db46ba1415679ab3be4fde2a3fef4fbfda06c342028001d7046d388df420d75a18325be076aed6892f1b9325fa28ba4743c216eba708e5ab4d2d9afc2a4d53", 0xe8}, {&(0x7f0000000bc0)="04e9ae37d42bcdc417cca78261db2d0f92671c2fad76f2d5196e284de46287ddc8a38cf18173618e63a3b1258e946b41aab053dffbb41ecece28d2e5552f865056f49ee55d81217b1c2e842dcb9f2fd659679240d9e8800ef2132a3b52d30b1de8d5a12a8026ad3b0b78e1e36a7f18983d7db0895303046db3baf9629001ace458d8a9194583fc23ae60e1e691f53cfad5c78b514cb80862cd735db1f484d2d22b483378f249565ad6484cadb148e60e8b206e1c2a076a2d50a4817795aab92522f683eb1c11f2d9c27ac1d7ff88fe0567aaa7c27b7d187d343f3dd116b85665e011991d6a2452f8d0b44895", 0xec}, {&(0x7f0000000cc0)="aa597925260514dcdc79ea024319a160d50e3ce912e2bc48ddd24ceabeb99fb2a1d66113a0c683176914888f17a47d5a78abb72945f0497986364763479f91b08cc89a8d6215f86964539996ce7bb9b7b3ebe43926e669ebd5436f9d3212ac813d337f9d0fad2de1ff8c025cc643c1171f1b20e6774e87c42fa37f294ee0fdd19001dda7503b13a8a6a91a4d97a5fd5fd414d7055a6a795aa2b82a52b2d10f0e04d71a883ca8022677284f7ce4f5c98291a3844522f8bef748b984eb85862e190b00b8777c85c2784ad51a20fde81edf9fdd5b12838fd08c8b27", 0xda}, {&(0x7f0000000dc0)="36251fb8a5a0cbe624d2d4ee89ea7d713305d43cc25321a2a89c4347f460a3bb009aca6be86feb28efb20b7f84aed082bb61a44e229ef1b9fc10f0528685bdca03f985457fd846bc450e26ed77fcb94a9a9ee9b38ee8907528076036d6b8f2b3cf06f33c347f6efa2cc5f2207ef46fd4576777ecc9bf247a0311ec81987fe7bf91f73501fb7501d0e02ecc153802de6cc88066446e421d2ed5e3d9faa51758a9df281fee27b2823d1624c5799a4912a876334385af58a46a98d2af75370a4dcb73263a68a17ec42ae4561e972971e0fc380700965e5acbb86d9a2923a19356d3aaaf95f959eb0a1786fbe13f053acdaf26d7593a36f4d559a1fdab70b4564dfc0368673678dd5b0c9bd793d4fa3fe2c1d8c727cc9dfd7874006955d012374b5e57c4fb1137981badf3f5554caac2d4016cf51f9d3d13b71fa0e2fc62d95af71d306daa8a5daebf5fd527185a7fd6293f4198a43e6ba1cfc9a8611f19c73a777a229a26e7b8f6933838a48578b40af83084e6be4aa21590081897e944194fa9b76a3342224643e44a8018edc8fb83812ad832570b0f375f14b29c77aae784ed9c256733071bcf55bef458fb420f2ea66f4d5d839799dedcc72e5f9e4cafe1ad594708e3cf4d4ae6077f913c13c8d1a01c472ddeed5386b7ea114e41f3db980f130fe4893dcadef8db669b7b29afa3f01d176bc7b41479d181660dc011e285641b8f23a9e93b149b2595b4a5521acea4e5a100c73b4a4fe2b6761431368c25929492e8d52ba4b786b41d028fcdf961b42f5421468db4bcde3da6b2ec9e052fad5a879b0e2a9df58a34a4635a4737f47af4054e4d4a68b9c042efa5b4a381474b6065615149de3688f49b7c4fa90345abaa80f6d7e93bda983bd47ceb7ad957c5f9ca4f51a7b98d3d80bb23166df3ead264190e8265c037fce15b706b734eb94d84245d78d6e455f4a423d98aeea7a1cf883b0e1ac1f0ac457dc6558ed1fb02e176754199b71708d9098d207f1d401eb605c1bff4ac8e72c5e9186c13d593af9032137d2ed96355569819dd647af6b905d7947529f87fe80ccdbe3f962040084dcf46365aef6796b7e7a62c875b5af42ddb4fd3a85842e07e33f84429dd5c679a180bdb6968ba0f79c70c94ac5ba86d22ca9c927e34857070f34e472631604f355edfe91aa078bed3643987f1f1d9d3ded332e0d6451e724e2c3150d30e9e85f07e5c6c85c527c4c55b198279aee2630824288c2def4656ab895df14d62e04ea4036e7c080e8256878c3029c8963cae5832eee9ec8eba71acde62b786f0c8ea0702d1c399e0137f96d10873caeb4a78f88f1dc89ce478b41e9c0643f252281e1cf22262f5d3b883e47d224cce42dbf332665c348c3ccda710f1a07664996de9d6213804e13af073bd450106340e5815da68656b883e10c36a093590884bffe3562a3ec77d44c7d5a60125b982a64fe7779b2cc9cef3ce445ee5464478373d084e75e332a2f6a228e7fec53458f2aefd84e145eac9bdee72fa8a154e8887f4b78131ae26d049127e4bd68fc970d6d4516c4dc9a79e2e19493f3a71f999d4763def6ef7dbc9125ab998e4e1d7a2eedd436a927e24a8d0140a7b3b704bb906d375f89b0cfeb8d2a7cc0bc88cedbe46c3957ef925b509bcca60942e3e1dc7cec5ea08e0cefc14898345a65141bdffbde442de0c511e0e0299d3c28577bc174c3295d85df16f117a1b01a8ba1956ecf697d4c99de9f94b30ae50bfb9f90ec6a79aa1ecfdb5aedc45ca0b28cb15b6e457833f4ef02fba6aa172ec5418b66c7983c7a69afec6dd416d9405678de3c07f2fedcf6b913859896df00d536d56b48a7da8315dedddc681e5fca74deb05c662b956f30d1035d8df31686711006ad809eba23e2f975e73c32d13450b146879c87e41f98f15a7d81e50321f4b091626eab0de2121b384239606c5d130e566f854f4c9a4183e419f340cf2d8ed90280bb5fe55775b766ee88c62e08dd187d01ca76174f53f952e8a323e4217c0590fb21e1f95f9f35de23f55817b9ec4ceb6300ea0a1a4be3bc0a44232fbd272d7a115cc9e42d5c13b79d7e335c65f2fdc08f16bfaaf3bba01ea1e5e58d1c68a06ab66b8cc453cd83819f108cd8736ddf0e3c2a40356f3d3dae7a13d96b777e98b839ba6ac428a4220b4c99b7d2108be5d8c8057c3fbc035b7c762c2ba21b3a16ed0d512a84e09c18df32e2d41f1d58a75b924f76670db97ba2269034e8d0c99ed626a5fcfa32c1445151613cfa425ad13069fe762017ca79402e7b2d4f07d4f40a4f0c5c8619823cedd241ce625d82171c398cc399756bd4d7c5217644a24b6772ade2f91fc181afc71e396d734dad7b3c581fd63fbda59a06038a57bd5db18e7d658a49c19f527edbbffd445bc8dee50237f89f2700246bd04816e6fcabbd836c74f0485de9012b5178ab69cec93b653af4303a9e1ad68405f21a8f83f419b9f28c1f83f6fa8d7c6ffa2f10625dc8e17f36aad7c62c335fded22aed32d1c641b0daa906aee5fd3a1d7fb2ac0dc5dc82b4883588bef2196943ec2cb3451e48e3619a4cc8a59d41e2627d8ddddbcca6dbbc4bdcbaa7c17a6aa873f5fdb92b08e84837fcc91085dd84c69feaecd59b5d8aea446c2e20ef11d44007fb885bcf83e63808023af089b7b6d72445546d9580b32012420b297cc295c2866920df3794677254e15746bf5439a14fd38130c9710bc3d8c98858509284fd45115ff3f46db428bcf6ca0a12b71b8142365b8c1e0ef80609fd7e695a80bcec5d94f0664079704760e30671491b6cae19a883441fba13e2e1c43cd2af6cf53554b97a975d924df5e644259213d24d628ec84888511c96bbcd0226c34ae3d055131e0331de5369eca118943755520183d43a32a71f2ea1a4c1b4b320eac9a9446192e26934e35694014219b61b05c0f6b22f8919380c09627859e7cc613d509458631aea347d019217c8911e6554fbf9c8f0ce6116fa0714628832385db38bfeea695664443415b4a4bf3046c5011d10e9cfdd98d7b55cbe4d8441e703d5342d034ff77f97bc6dc0814cc6ebc585a1d8a55a883e37eeeff9c1db4864f02b06603174cc620a58572269c5c3bb29a4f3e66e821b925ec5ae2e273316e1c49bf74a0c7f85636102094712667397eb976e8f3e2bf75df85785a9d4248c8bdd1df331df9ffd258f773cb1d5eae3fe545f34037ec23cc834c8ce9605cc83e337bde850ece6759649ef8a0c4616c3c625c9cf80425769dc10c365a1e5304fa46bc132599abb36ee54a28b26950a129c22062b11ffdb61ab94aa1e5ad44be0349c9f0bc31141b37d32e20e9571fc40e249dd9d4ab368c568b325ec383cef8ecd41b533de24a623a03768bad1cd7927182597d0fbb196772c30d6e89dea3d7e22503e45093d9d04ebe1bb16f6fb1639ef28e647a1bad11bb4167368a99d4be49866203e25ce9313a347102727f69afbce3284f1965b2e5a67cf85429b9e87f6a2dcfdf50be1e6dddb26350db620523390997b632b9f50dd1af424322b892d8ff06a8169e4f85f0b3ee25fd9ea8b2b7b3bd016bf431560c0b6a68b4b058b5e434490e94c8914ceb62135e8f18b9cdfc6a69a533f3a974862939531f583f9c4702e46d2a62d2542cdba45811ac684eba198bfc86f4c022dff46a868957cead1dcb209173b7fdb7a62bf4de290049f09de0406ea019a8b59ca1499c9addb97a8bf9bc62a32b058c6aaa3cc1d028d50d116e41f53390808574d42ced90d7c96809a01d1cedc429e93ffac0f976af9e003f3893821350738b6b64cf7fb2d8f50d2d29b2c897a9014c5cb5021180580723e5a59ed5229f7169d043aad4e3499a028c34981be83dbffa1829e9bd549e74acedebbb3ea1edecbbf7fb58082e34b3a72393775cda8766b86c074d751f4c368501945860c6a1f4f709d331dd2599bc5d3906b56d676f0b7d1c2db0efdada4db5f197ce984cfbb0b205104f6d40728ceb3b19b3291ad4baa1cabd3a5ae7917fa7d5c6bc5a551d4592c90b611db2aeefb01678eb6b2fa4edbff438ebdd52a6b67dec031114d2aaa42183297881c88a5d112ed05b1ff3aee7100e003f413c5f3e26b6ed55595aa7507c292bb7721cee7cda07572a541acd3c33f45a1f559ffa286b92cbc180ce0dc1df03f94462de24f35c048902843e44648ec33e93ef680af8b91c52c78c9c43e08da2e7e760d50427000fbac1f21304ead4a4d3b9368200202d740e8d162ba356266cdc36584633414b8f12efa08f35c6bd09b61709789de517451621dcd7f5357874ae6e8300b821f5ce87f75b43238b25323d45344fa4026b191c2f0586cd21f0239825051994c3cc1f1e67ade90a191d90b873a048a377af2444b16a5bd3c9c77279007d7ca02357a6db6ed2f9a5a33545b8315ebc5a61a663d47a575f60fafaca5fa0a08eab5c9bb13611a6dc63f68f849688079a81575a7b98768f129c226e3948545e9a7cfb86289b5b80bc2dfb7d57ce83c81e843d37f49354b049dbef1c285ee0a8ac6ea74537b35d3438ccc4670af8d76e632714903d45f7a29de7f9012f0cdb2dcc228483b3d8b46ab7a2d04a38dea9b889ab12396e51aff582938a5fa9d1c1490d4b6929ce922b7bdb548c96202dd5ad08e4338184239402f103c13221d835c9e26dab1340f8deb985d841912d76c0efdc08dc069a6d5d1afbb48d5b68dd12297deaa78e9fb238174345c7391a0d5679a38d41b0b8db5d089bd5c51119e8c0a2d5fc4a9b429ca18bf1c28c36cfc0ef1fcab22524ecfe3c3474ed9dad09779556f878b79bac1941e1c66bde17277b4e7b7adc604e3280ce5ea18c16fc9fd404c879266c93742fc29063cc3eec2b74a23cef1923d04ce5f5b19e01bfc589b9eb35770e3553afdfff8355369ae454143c334f63ec944948c730dfdcee47918379a0f9c13943619864eb5184f708026f4e188c0b483b7109320f11081efa76ef51c5a605851a9198a6cac2bec77eb9c826614435b6fbf58f12fa899c3490906590b3d2fb41370a87a7d34655928470b5c89dd3da27c76508847bfc6666e47915d795f40308ecc15b5f701ee689312f2113942a9e181b9d2dc963ba996c341551659dace5d9d0c3a87ced3d6292cfc730f23840ba1390b264787881263a00e53d43efd8eba7f4abe45a7f57ff12d0ea4fabe5fbfbe3d1b7dc1fc8afe85c01b04d81680f3ea9806c992eb768baaaa6b513744d6cf1d691d825991e632d94b0662cf21fdc1371c9abbab7ee564237047dba17a890d9b4992729365ee450316543f5b4cadeacfe9dca5aeea393d66b72de198a1321501bb5dcd728768773f2315056cde894889171d6cd89ee3c0d8576c8f9b8704ae43d79aee549efa5b2daefdd9a70d3d0eb7bedaf53c44ac74d043f8868d4f3dbe78c7e7d012944ba3f57c1914ce295c0585edaa01a723b1dccb19fc322cd6141063d763d7050e203a9453302f16b21e093c7e6adc8a8a5b846308d62eaff6d81e0665ef458aa6df0fe94b4a8fcfad5a5ecce5488911efe51c3b86877a52d20f8b4f2426109fe5534e55b7aadfd7829cfa28a8384f0f3620e7721760e06c725f650ee615cc9a2c98d2ecbc38e75b54949b78d192e79b18be0f0646370554bbcd202375dc8e8ef2cdbf4ef407b12110f20477461b3690bfdc9c26759e192702ea63ffa301e99b88f30a9d30a46e2e2043a8ee48fe49e678b42c5601ea5f393bd02b858dd56cc7e28f0fbd20e2fb42f2f7e7f37ed59ad699e2640962f0319cec036bc80c4357683a426b5", 0x1000}, {&(0x7f0000001dc0)="c20108cdb4142bee17e1ec7bc9b2485a31e0646fa00894d0e3d32a84433bc7278e14e87466c720ce0fe33b13a0cb27fffb2952b057968ebc76bfc33141ecd7c0f2f29ed269c31871e59b2bf1c382830569709acdb0cdb4345c0c0c1a65b7a7317e4e3a212400a0b39ec1791d3bbe168b9cc191a2c7e7bd27b04e54adfc7aab37c874a3740ad021b20ad8b6e02b1ffe93f381aef604", 0x95}, {&(0x7f0000001e80)="3f7da6f232b11bf049a1b44523a879f6e3412267472beec4da8f27f80c0a03192c3dd232bae525c417a662fa806c4fbf66ca4c51214ada4f881ebb2f4ef6101fbcb57ebccbb9d776c74a98126fd1738204980ebbd56a270050c8475cbf0832185f16900b4eee58a6da24b7e3ac6c345a4a1f241a177a912773af4d15291ed0ca07c53f5774eebbe498b1ffc8f9f7327a6b9d6dc26692c8b28f2147853258a440cfb458d3e1c57bbb049a6cfc229bd3843d103b098a7f462b5f28c7e679b9f54295720fe0e6311a4415514c055a260ea7544ecf4829e716566b534baf7c286177dd24efa37dc681f1197c08e371358fce6af059f30cf42c070e22c8e22554712e150ab445a7dfbfd3a68fed5754e2d2b1d0d09ba543f5698367eeced53dd79abc58ec40789b2c866972d70851c7ae95869d1c30344131079cd31e6d87f0d15bb11b306c15de50159ddefed404790583294e3566099dbb1d3ae71c9554e47208d04aec873a97c959687c63da577c077d93cbc9228dd51056b1876c94e68aec666578e4d7b34ac04e9c6e5691514fb80260afa62dcb9a3a4fd98a8b44bccbb2500fd0381c95b26264d6e243507603b290919a7c1ef7fa215caabe1e682c32df1b98bab493df303f14dbee6130949b8de5e359765f8aaa98797475f6b6bca663bbdf8b2879538b65ae3ee5803cc01643492f86c15f024448ee81ec42ceb83b08c44c452ab38a35f9cbedfa01c09a4be96de214b136a5082963c53d162abb072197060edcdcb60afa9d9a01b629eff93e784d5a19665db3594312053468aa18af6cbc37eb70dd30bcdd3f6447c2e192c1f30dbcf3e74d41fe4ea99160acca09d64dc3a7f42899bbb8ac67dc9c62b8fc5e68ec126d54cf65858d34f7a45be6628020a9d19dfbdd72fad56e57e9671553daabcd2fc435f9fd2410d6bb2986e04860d8bf152d63f98471b11624229eb48e3e3455a7dff3f100d963b49f29a00f7f36caefa82a876ce653c736cf76011598673966b7decfaa5ac267888b3b765ab36b58eca999ced479657d112574beafb4d8dd267df8eadfe554173e5f2c056e19ba8418e4df9541c8c003f21b583ef1540e8c025c80343d0a7b252b16c2e73954412b025524921cd6236e7916891c84e216c8eb55dd25069e205108ee4d66a5175ab5567249bde324354b5c8e0e17dae0a77ed7ad90de7dd25dc3ec612d29e83604ef091870398f2c01d2f4397eb700addb881d9343996b8e243c1455aa719f90971ac1d953e5f0fcecefff0b00f52295f707bdc501d23c0f7a96a88cc57158e7ae8cc7fe9cda144913c2efd48f2effe6cb8a26f57c3700b4a2ac9833b9768226960f7f412f198bba5941df1879801d17fcca96b9cab75c7d3c044fa3645c8c01ffccb24a8f91196ba85ed6df1c8dc612b6cb0793d764680ec83f079d6a318a6204e7ae5e998e9c424a2bfa82afa30921a94b1e9402d79062246bc210848571d170a647b7ef60647d1f57138c475682c739258579b5af3cb54f98e36fcc45c2e79df55414ce31b16b4d5e36882a0e7ce8618a3c18d24c012c12b6379e5dc753e3a5f4c301601b13769d4bbeed22c875d1a3e604ba4f1641b98fc60f0b633abf2144e297fa70faa4662bbf3eca7f9a6add08e575db3fb0994a3ffff43474aa0ed201b33ea935df02f8edb9fbef4fa70319dabc48bbe6e91c1398bc5350815a37d6338f321a1d15f2b961098835957273e08f8322ec96ff7f10478d39837360e29d37a59b34b4a82a5752aa5c380b79af67adcdfb7780888f3e7b7f190065fcd527ea75e135f6d0e9dabfdf63293b1ebfc896598f8d528a8e76a5ffcb2322bf223feb99f3481c6ebde32a5b3a3812991ed90ad65e25869abb26e5a8e24e03a20aed2026ce1e478928a23361bd582e7cf99ac5c3724cfeae1705838bbe638e9927376c796f1bad1314c12f05d290dd4f1b616fa85044369e258f9bc86180d55c1cb6fca63c284c6ced652709dc9827e71cd5ea3038741f7698c5b733ae8c3024b2c5935f57be9823d4ce959b8d034c4e8bb650d960ce88b3b160bcd91b291937de0709e3d5b9f475161de58cf6d2088107135f502276b488a317f6755f32a634030afb505c75d287fb6c004799397995f5daa4f56b9d06f1b7a5eefa3722aa63605ef474cb985194d2a2016b54a92e65e2a1b1116b5d6cf7848c8658121da0bd4456d7159bbfa7dd44e8b7841745a43fd61f0a8252be0079ebf9e879ff9e959f9b1da5bd21edb7a0056485bb87ffdbc9b5c1b927baa583b097f1e13afe288ab8defd8273220bdb9bf062317e0d6d0697bad1828b0d71f23e75392cf21557164f208b08b6603fa59a1b44e6af55a8d7572456db811ff1d789213dfd0b78a9dee9cfb9cb3e4407a6d0e2e524eebcd89aad0d1350cf77290b9a4fe685cd39ebca9f3131aa14dbc1ea9c294fab7bc73df18e0881ee0d9e24d0362ea6e3f598590cc7a34cf5f64a937059efcfd73440decd11120cef702b9c256bd13a6bf47b0de48768f78de29fa17c09eaa45eeaea86c9ad7d3a1b3d30b2826da76a5f54bbd503663c1630e32b88725fb1e5950e8da790149ed4daf90232be27ee8b76f1088aa587dc0ec5a6b607662bd03ea444b20a18450748eaa134a17546df81e49fbbedfbb0f0a0379a5db0756c8a57d045633a464a8075571201749569119661fda1302c29d7a66a76d429dfaf22a095672a28f134282b6266dce6da61c001ecc8fd584be245447da9a0677a002b559fbb64a625d784947d3e8b43b5bdd66671e2514a72c2e47a8cbfea253c205c7eec585d173ae601a1dafa59115f0f2bc5180cfc9c9a0e4505282a36eb90bd9c56afc08dbf40289d8d7c2e6b6a0a091ea60385c071027fd6a56b472fc4bffa3a67d5f9f8c75c703db9d0eeb127542e69a77e791304bda7b5861ef1f72528988b8df75526c3560b799b66535ae0111576a75bf54134dc941e9a25376ed4b9b993eed30f2a81209b6181043043bcf91ed0bf38dc665c6d78a4fbbdb639853647e8e0ec3848ea52de52a2b1a2f7caa8faf810b0e36304f88ba1588bf3d1a851da52c91a7942466f0348e128bd34d4a2cba90a199405c0c88c52cde883539387dfc546bc74c8d92200a3fe6c374f231712f20d8f9ee3ee5e04d507089f4967dea61f08e47e4f58e12c9366059930dd63b259887001b074665b7109583a3afeab7b5411746eb5d3f3be652087481c0e74b2fa9961276a6ca90fe268ccc135113aedef4295bf5e5b1e10932775e2703a5e0fe1c0340fe4c2678ea1e7cdabb09bc37d7e152345b70592c629a394bc16c75c573f6f828fae328bfa576f91b1e6cb3900e54ddb9bd30e46efa00e0a51d394408af3ffe34f1c0f088892ef63a3d1c0c6e4c32ea92362300aebb3c039ee69bcf3deb14834a80d4c518ff48286dd2b692959e08e1f3e8af418975f7b518d258fcf4066c8ba2304e8ce4c110d87dec49bff73094e4ecc9e1d05cfd53c6e1d24c9d96661a9e57761c38a13a0da99c9e8c58fa26ac353f3d82939de792c190914dfd1f03c810586ae7c81b9d3feddd9c3108d8552eff09b2aa1a88e86d370352114606c7c41da72c600b63902e2ca27af970f9f079a54c5cd90432da45fa65804eacf11536024e70ad01d028a1fe65f08ac5aba8dcd1892261fa868307ce127bc0fabef4396221fe15113d8cb51cecba7a684f8adee2f104eef5b2888d39dfc1bf1d458a7e8d29c0cd68e1d940c553a15938f7af1c9f8db17797f464262dd15ca25ee308b41a8bd2720d7bf72d1b1301391547e6ba89e5b6c6457cb2a5bd5e0bd3d7fa0003b8460736788373184b2c062de49632e39d7e5a424832fcd153ecb9bbeb9d032422ab4290c96aacb92f3a8a25a10c2474ee22e62b4a2dcb5517c909390bf88b21ba6b7f7d0b4da360420eab266b923b957fb48cc1e80c99afbbb11ae65dc378f6c83f55bf32efa5c6f57c3c8a8f425b339b5a24be90159386e1a1a4ac7aa01ad973838b42b941834acfff0bfe391ef1937df743fecfdb16990b9163d6b5eb443fecfc9068c7a1a7289b61c26688b0000b705d8f3d50f78f8529aebd91b597f910f169a7cf7ff3d915495d20e56dec49a3da730f82ae621440aefc67474a2703a26d8dd9e7e07212d0f0e8db18ea36d45af8760c2bae70163068ec7f76fe894edee374c8df75eae3abc0dbcabf73e64eddcd6576fb95629463cd58655a2693d621289f4f4adad151e31b90f8b61a27cffdb668de433f74a6a04805d649638c20b7bf6ef7ab343975f3b2ea8fabdea9f17d15931ab0f6714568892457a82a61feb747aff309b6b92d722da80acaed8e685de38221361c20437cb8c7b8da10f55cf98b11766d5fca134d13702dfda6914c4008a1062ee0a0e454eb513d090d4cd701fbe8ef1c0a5d0af46697c27caf1b1a3339afa6bae1b00eee2bed83086d50841db29cbd9a90e125bc3794a82e8bb6119e6d5e42ac025a39d38ac9abddd673125bf24b101152d71412a69f773cf2e303e53b8fefc47e7389d0f37cb9d5c7de60368ce69b1d692b25332d2356e7c6796831dfe863ce91fe682d8b829ad804fe64cc078e22efdd6eb369c76eb1ae41d5b065beda06d74f3ef78fc47843579912ebea7988daebcf36a1c1c3494eeb914a46ba9d76353d17e6ef3351cece57a5debda9b32cc98344799990849f524c4e5d559c3591f23b3ca39a815ed753e667e0a29b093622eaa0b8e972b732fd69e6456a4b1c613cc09b2b1f2b162cb939e621c2f6ab781e117c94112653968798ab38d246b678bad718a40cc6b5817e20301811d2729f6ed99a9777045a6868024ac8841f77e74b4da03468075ddc4112cea68f8521f8a10bfd85a4f9d286c7e4ecc81690533649efec79701fa41a763d183722f0d1cbf8b776259c1542b5d33295c7e9e0840c23ec14e8b05ed1dab51c7fcf9a599b77b7e3b27b13b17abc67f8b45ea23f4f1710d151f1bf52562eb5fbd555881de398c1f759520ff878af812d9e6d7dd45075b4895bd5671aae32c03d74e0292a3f6645ab27fb92a00f1c8e323df4ac7b1f3a286ee5d8dd56e8f9f988d0148e7e2b84eccd1c9e96b612578d7e1e37de68f3e789526f475931888d8c50f606fd29ba140c70fa111ed21595c887e3e7aee899c6291482b1fcaa5abb4ea20a99f019f6b972618036262a6eb05c6bbe9875f56493d57b09de042fcc13328907a7b20f30ee54ab07b3718b878bc9e7b40ae68826281781acd1ea805b1f9fc521c3da02793242543cf76de6b776871548327a6ca07876ea678503b7f2c5be308329e5ac7d4196b4dd3aa4e7f379f940c2816df7a7de23ba3dfc5e9e8b168a3e7bd6aa948a6f2873b8660455f1cd5ba8eed93ab3add35d406ad33303652285590bfea3fabafb931da48118943e052a96b6dd11f9129324d7a990191e2299f4933092b0b409421a05dda93294b5aa984b5e808a4d58325c2c0c142e6b2e55bf2690fa1257e1ded3489901091c8ac7692dab4cc18a9fef511467d94460a0d3fd7e569181521553496d8e2c428149acf78cff503635bbe8e4bf151ab78501c2a6b44c51238f2b878e7633e340bb62b98d18ce71f2de706daeffc626ee87a840b5b0198701920034398415ce084e16d2b83b0df41a907b34195af839be13683596c73d5a04ed0c0f521171ee896e105ad808f917495d93c89f36e93541f2c4349cb7e752068fe058da114fd2f6211542fb770682670ddac44f14ed2885b870680a73d001da1c8fa68ac365f6e875b938652", 0x1000}], 0x9, &(0x7f0000003100)=[@cred={0x20, 0x1, 0x2, r6, r7, r8}], 0x20, 0x20000000}, {&(0x7f0000003140)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000003680)=[{&(0x7f00000031c0)="b98c36b967d90e6ae6dd61a29b57e1c0c971abf834d941ece72dda6583f2e001ba75f4af4ee0dd47700e0e58a891ffa89538d2f162b63030c909c3dc23f465b733b7b3325d7a18dce61ba98b6014dabd0c9dc8f40b4ec2aca2776a4d9edcd9d14c948ff1a832fcbabacf27ceea900d509041d70c89997b86f9b583948cc46127852f95584b2d50e1e0149fd95a9911e642cd3c491456fa34f6970d18a5bff861e458152d3efb0bb267a4be873a6fa6ab0d98e8e1c50c2ddea3ca807da86e33a635130b5181d3ad094e0401d188c1c4", 0xcf}, {&(0x7f00000032c0)="d2f078d42a65a7e7a950680f24879bedb4b6768e84506925c899d93a4e2ab4cc3645833e42bb438ee8b9484b4e3a14bccaa64d90e8f9c675c7ef38ddbd20be2fd661f148556db9a5c31235a8498a11f71c9a0088f4c4809796e60b40cc0469449ac89d1bbcb1fdd89a415cd34192918abfd71b246ce23b705e2a6339fe888f038d6137e84582bcb169416c4b2157c16ff2f9bb5e1af0e72bbf659fd72fec6b99f80b21cc5cfe1464b8c439146825545a9d80aef2f2b291a74fea1a6c6e89893b20ff0e284130b33d9fa3eacaac448a365ff7a78dda683327ae0ff57be3f3031710f0e6ba251a38996e7fae839cde8e2691a344", 0xf3}, {&(0x7f00000033c0)="7d47fea60e18bf054eb788a33f8e0261155611024597810c5da6e7772c5ceba9cbb377a89e72802d0d1d7cf361370620f8e64362518d48cea34ae0107f1102b363244293755a5c497d9c2611f95dbdf90e69a3220ce186af467b453556", 0x5d}, {&(0x7f0000003440)="49720f829f2cbf6b08b7126c8ba2ecb39852b8000584618ba61a020f34cce2437fcf1bd4e541afd1fe15aace346802", 0x2f}, {&(0x7f0000003480)="99023822ff6123b1cd411b3a47c911f6b06899130bdcc32ce221321aea2d959f06d7140524e892b730a7e18ea85901a9a36e2372116cca1410ba8c2c8fe3642223", 0x41}, {&(0x7f0000003500)="6a2b0e0ed225bc41ef535c88401e16cee62a03ffa5695128ff5402f64f870aaa92fcaed255b54098a6029919b6e0d508c13c693e91ec6ed0fd9e2ddd5ee376fc813b9bdd202cd4e71efb8abb5242f56ab0db9f3193f2a07323c041b2e6dec14b85c04431788ff1769121a03311d2608a02e98cfcee7ab0e2c9f2441e309107efc3111ec98ff0b2b031627b316b035d6ea5f394a24b603a4e36ad", 0x9a}, {&(0x7f00000035c0)="94f05ab8d3083be4f3a3a5c623023171030277819adfbfb0b65ae63855b80a25ffc35d048e2e8dfd0b13d2757582f8eaa3080fca", 0x34}, {&(0x7f0000003600)="dd1f436ffc177c2b901e7fb0562cac49b4254e3dda3dcd1b732159209e6efb1064b496207542a92cc415b3a77c0864cfe4ae5ca59b796348b350465e94dac5ce640c9761294aa3273ba20afdd0800f5276255667d84321bbb21d", 0x5a}], 0x8, &(0x7f0000003700)=[@rights={0x28, 0x1, 0x1, [r0, r0, r0, r0, r0]}, @rights={0x18, 0x1, 0x1, [r0, r0]}], 0x40, 0x20004000}, {&(0x7f0000003740)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000003880)=[{&(0x7f00000037c0)="67f4e72c23ccec067f950d9aa64b761d29ff6bcb4e1c1b1906705b7a3c27257ca6026778dbc64d4a6bce0ab06d28db7ca042860dd5a19b7790adfddbd02317477856efbf65dc46c1145fb33d74a0fff248b17a9398d4ff48670257468869f1112099285b08516aea45dad328278d54003bf7b866babe882306f179e98bd67ba83ae36ed23ff2f90dac31d609e18c65bfb5326d865ad9918e33f5586cb5bddd60aa65dfbace0b731221", 0xa9}], 0x1, 0x0, 0x0, 0x8000}, {&(0x7f00000038c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000004c40)=[{&(0x7f0000003940)="4a14a0e3c30774cfe265f2f5ea4997b6d927f116dad87c63926c3831527396e38bec16a307779af32e4f505124bd4bb7eef8c58b0e66a1dde2fcca789a86eeb69f3ac565e21e72739b3410b3430b8af5f1f5aa7a2f22eb574743b564ea03d466bf11", 0x62}, {&(0x7f00000039c0)="b5c74528546ec19ea326c4986c094c91dd65144d04009192a622522c0a74efff15494d9ee1b3eb3385127412e999b9f04fec2f97517a7bb71e3c2bc43b536f07939f666b72bc457fb3c193ec", 0x4c}, {&(0x7f0000003a40)="7700f8e387b2bac88e1923ca7447c35f25150805e304e9fd85eb508f12c90298b21bc62e586b46ea04aaf5567c52256bac2deda00eebe098baefc9eb4706fe9351a8608327cd67112bd20deb93bb83b10d5265b5d2856219b06e0642d30a90d812abf6967dea51da4f96fdf914bf10b7473586d7f0f98e228ab8e2a99f432c401164e0e1b5670fa171a972c22c46c853ad5cac84a94a09a6117d1f", 0x9b}, {&(0x7f0000003b00)="538584e8220b7e98d5bc4e855612d7e550c3560142dc586d8e7e83e5c061ba83e4b93636f0b38d0b66e3068ba7d555f0d4cb40e70b512c9fb716d3f6a95deab01f275b4653e55c559e4971d47b2310d85bae91a21f9ab7e016c3744767bd9ed1395fe19fe525bc9fd137c0d86199b931ef67fec39c7d9fe6ee2a968fdc638f987ff731880092a9486912be9e2062e03d10a5d3bbca623f84482babc64b6c09b62f8f990bac1f3551887e796dba3731ed9f4d86fd43b9801c50286f6295bc52c566e3aa3f6253a1ad8aec1cd739920c344df31caf8d543079ebbc91cd49a4aa2beac9f243adf43b095e7fe9fc1b46159ef8afe1fdefc58b479521ddace5bc93671ea3655e7cf5dc2eb8d579e9f64c9c79da672667ab2a804e7a3aaf436fa0a98ebf77b56ddb1a58bc00fbb7b53833f89d0fd0cfd93e684d8139b63458af65210ddfcd90cbf572f30a81b3e04c90304ba15059edc1297257d0f0d359251887ae05ca50590cd242860e285979d8316a9205914af92d54ad6ae5f440f85f7b885d529ef9b490a00291edebefbc2835feb6bca3f3e6309d49df47291dfef22433d6f326a95ec40bb691d6d5c3a763e58797cef183fea19e4c85a1c344c4f8207bcb1db03ac487f5264033d719b689865f319989c509c0476736a59688710728c9a4d537e5a63775bcad9cc0d5c13cc39f20fc5055761f314d0226e9f73ad8c5078e1c9d8c008a5e73ed58aea64cafbad04f4feacfb1b7c432c86290d286e7f0391fa60ab37ad25e42a76aa0558a464168b4699e76beeaf3b20b524b22866f97e2d33bca4fe234ba201db490db27decb729168d6337aec78791b3d1328c55d6ca7c09f26d44110cca70a2c8c3e58b037f06dffc921529be82baf148dab3f393aebed76bec780e9e0e2b8d1c8fbcca035d178321ddee0bfe1cda24903bfe566861fafd5e4ff393a15fa9e7e919bf17916340b31a2b84c7d5fc396a89a4a0b0e218359d12ed323e4c75beb57d8841d2691d9acba84affe6104940d2f5d6ea892ed15f8b091ba4d0952f1af9fb85427926a0906b57b0aa17099b540f6c86c9c0ca8cd56508cea61223e669e8ba56264f410f6f52d6923894443df903d811d09e26c0c96b633950e140a66df534facaabf79fd6e6c9a266208268ebb93273123d3ebeb949f3291ba6bde2ebc6ad2341fa2b6ad81ccebac4dd1fa4567b2d56e880c9a5ed9af0c3b92f7e254a7d3138d12bca908209b064c3bed3a4cf585673c82c851e17e2c767e8e2db641e7af104561786d3289fc478ea0be512e64f287fd547b0556de58ffadaad632d5d724fce30b7697d1c0ff2fd1c063ac6cca8f52ebc00900c43ad682fcc51fbfe5d2bf0213233c79b389ea1b270177913140e098d1e398aeef2b4bb3393f9f649581f81e1a96dd91a3d29ba378ebeb523239d8bcb6464bc540fc2d5fd9ceac262b8b16b96fcf8193409b48d48b8b006ec40862d0695b8470db14a5682eaa7e6a8412675638a78f429da61f7b3c55567b400c75dbc1b4d2881ed3a552405dd7c4d32b7c69e86ee6730be7e4f4a9b0ebb9e155a5610d0de5a944ca1e58ec36ac44e79e1558221e42dde9adc37fbef35729aab737a69a7402f6c9af2b4e811f992fe2b696dbf282c431054a1da3356881e0c29432d296b4f95a406d544c29c25ade6fe2f4ceafdb1fee97bfb58b7a9922504d12eb4cc241781e5771e7d370e18c0ab79957ceab9cf8f96dc303f7d498ad4b6efa5f6b424d5d28672a47b19b11e25a4a0309db647118692621492a93f8216c06de84b704801cfc4179b69addb200e6f1b1ca73ad305d7fd1729fe6ab562e6fbdd32661c47ef105ec11ca1cf76f525b5a1ce0e6ed8fec5e1d959955678faf1378b370d5fecb94a53a4e38dac945a8472be0c4ca02531edb8fd44eaff3b0f78d05c9f3e805f416b3ca5c74ce56cbef52576dfa08c5011ddb9e723341e1307a8bd525203361058a4e739fe0588ed2fdbd08fd06e45059ee0064354951b0894528eb76ddc8fec56dafc5a57dae5ea147b09c2c6667f1386ba6db0c59019afbbda04521b86356bb757dc747cbf01d727c77f72126785e7feb803ff377340f5e1cd9003d00945073edd9779a3a8285024fef321e0aa4ccbaba8fb26472d5525a6310be3c8b062fe0776f487f21f6d46a2af6442bdb68c37b17eebd41a8885b405f6db08003b634b73021baa7f49babcb1513427cd63a8401f7a58ed72cf11d6e00849c3ab4b2ca863ddb8a6848d29406f4459471d28a6cdc5d3877d6f1b0c6b598db80049c7b114d195fd8bd33277e9fd623181b8362b88788564f1230ff5a563ab35bba3e64634972f8f044da62ec609bfe9d3c7c58daf14728f5931b1daee44d3ec97ed9c89922e20dd309878aaf884d185367dfc636e4397997a99a265e4a5a2905428d7374d6e1af70fa6545374640a53e5b79da8198985f2b8bc789e3749b262f2fc7c0ed6175b42f6a41f953a98dff8f9618f21615a4f323943e70eb06e2118365f1a059c515fafd06b09b98ad39d2f3b30a3ae14ece0f2efd0a9c90f7ba78092f779ea93c996f5fa415196ae84b1606084faf522cb09ee5bd9ec9345916840da1e81887e2295fcfd689c80300c84a88a5151823e3ef64fdd392dccbb673fb241929d70b89d99eb12d71cf63c79b898c4b774aab6ecdebd177a4df7dac0f94f73f7c48e1a98d7568192e286eadb294d03ba12cf450a88f8e899941f29b7313b20e127a246f9682762d6ee562562c791e8d48db1bb8fe72e121b97a3aa71552e24650e5ba4c9703d60b78f0f14d9cb297004a527592b28021a43b4776b1d115ca5e8edbdf0ce70cff0ce4555be131a4243514171adc62dae979bcf28298d179756d5f16b884c46a98a0439c1132b77e3deacde3d9c46cf10757074a97554e7ff3ab1661f657cc9656faed280e0c6fb29a30a7d61e94bcd862d7d8247786c14b53079ca02240052838204023cb834949a31846b5d34172dbc342abdb236611878714ac45f89a5337e31fc96746f6adb726ff82ec52237796e05ab5cc0fc2344b0a9002ac01dc908792c6134faa93c05210cd790149d84e1b4c940b4c966f324ecf84ed6cb2322c32f8d75b2e48e6e0088484997e5781a70d5868de349afa31ad7dbb085a293518d6301549381a11ca2e6e65a9086d43a3e616070ad2472b01f86cd564ae9ce78ba3c4fc0728a711b06f5246b768cc2734dc9f1a29923aa91ffa22fdfeae3afde935e371036b7bcfb124e0543395fbf2fe5c1332c7a1e66c5cbcc0cb5d42baba74ddeb6c9d3f91d7fb8cda6d8698f98eb6f7211d83d19caa329ee161f195389349ec42a4d02bcd058650e26cfab3b5c73429bd76912b2aad94ccaf94b9a07be93c70e274dd43895c38043a924f8d93c7a98135eebc5a5e006eb7e79d9e2c28ec93d73af5731fb45ad93b545a3f55d8b17a7645318f47a9c118cef3f9e500e373381ef2d55d0e4d5fbabaf4e49d114fa19629058bb427e4bbe10421ad5ca5073020593bca3742fb3584bef8f505b4c8f620e94ed4f4c7e42aa6c16eebae8ab1fab80b00452f797ffac0d1330e0158fe4477192c5d3df9c31b25627e64c1dbd762a9ab0a0eff8ce966233e886bd81967386fcb579dec3e129122936b313aeee292f6d4678c23b8ef831ef3bd0b1ed3d46d3b968227b313f162edc5eb684866a4e09ab5040673dfb2ce4e57d4f6790b719a6d3266ff9752c49f7efbbe4182b3387931ccca0013a35ee12cd2b77c779264e7da44c7eabe7599d7db2caf50f345e55f5d007b2316ca66cdb208e78f74bcc0e5c5f6ae131aeaa676a62d42f1fa6295dedab39785555acaf20abbe63aaeb842554ffb609db180745ee641cfa02995aca2d97a49cff2fa1d91730704a39aafc87fc600b3f197470430818f4efba10790597eb3af61249f5aa57cb68ee7edf763001605a00b91c6e9b2498f56217ab38b2a776ff0888b86dfa423aae617e3185d7f700214e84299861a14a0fa91c5014f7f0f9fe1a1d50750ddc091f91539a73185790cdc725e6ae4f17b8bc921b9bbbb6010ff92894f5b25a1d23f0ca2d1158dd9bc3ad02d99ad89d2c97154d2a5b3085bd051a4696b122276c35f50f2d77da536d645ff91a2f90fba9eed9d15bf324dd9c5c6b06429504c9464b59936e8ecd49b577f1efff4b375996c946ad824ac500ad2089a7f3fe7ef2cc789993da5af2ac907972a28b080075fbeb9509fda29a17fc5326f3ee13bdcad6321d41e2ebd5c56240f69052951fb8c485ba5a3cfc39b5c5601f626114ca2de6bd5e98e5079b90bcfc3e43fa9cd60737370b073e8d06b9b1e08dbfd19df26a36d3d74f333c95521547cfba4af7041c0a9445743bceb487dd8accc4c2a3ecf0bd80c95ff458ef870685d73d568ba32f69e2e7da79feba1ea917a520becde64a4c2af99ca7ab80032793c5dd08213764a0350a4ce7ea8783784c748d0b98214ac1151dc2cec0cec782628ee91a87ea3450a2f908ae0b9109c0b3ed2224a917d2eae5bf8bbe8949f886f47ee64781bb23a5a4f1ee29c8dcd6f515c8591dfa781c4f0408be3e49547be3d380731d204876e2885cb1cf0dd295c96d2983dcb0e6234327636c8323f117cc38d1c2eb37a12b8da1271c763131dba56a0327fd0901fae9530ea195f90a8605205141011b8c2490baec7e3f1e55793bf6749399974bf6a2e5aab5e2c2a26ba977ea58d7e8e3d0de53cde9d89df6c2f9c9d4ced9fcd02b5c8aee8f2f2856a0f7e8b9e64932f6e509a27083606d6e8762318bf9775c35fafad2c156a9f03ebb8f03185e4d1d590ad3418d1137e05e377a26ac5e95661b899f4ea6787e6db28e93999af8b6a409c284d0be2a22e3b8bfb1708c9c498f85b64d70344c931123f8aa8e7b0308d2f83f8b9777db277a3f4af8702d03ebf9dbc857967f2eff829668aa921891e3e687a4a3545123097edf0180fe1a17244f47a4bcd7877a2999513ffa296633a37dbc90021cf8bf5fa7f19d64374f2467eff0f766e74485ab437af7539759f2732452a8b43ff090ec6b09a7b68ec8454f801e589d3a5ec6c921baf5f2be98ffab9a1d47e247ffa8588cdaaeced06bc86c85b3ca02eb95a0d5be635913e06a2753f9b594b106d51b7b58de1c11074b2afb0360eda2584b658b0bfe1b83a08576865d536d31f5da0fe3b0a9f09c0cb2f9fc3f878fdeba80c04ddd42737f39d0f7559982261de4c2d24722f59009506e5dac9394b7535e20b283126acf4588bdd327ecaeff99254abe4b5d3fdd004faf29d0ff2d445a75242f86a77d66eece4d3525135e8c0d61d3571987060eb51f2f243a052158b9c1271fe3d83651740fe724af0e83a847a5d02585caa311e3d74b9aeccb409785c198b738a9a07881d31d86a62313969c68c56e5e781a600d1be067fcfb4091bcbcee3eea40d6ed7b36f1e56587f6f0d0e9ec1dc49bb784631c3275b081bd506f45a472cc5994a6d7909356f01da1316b39f81bd2178a08c31718572065e49ee7bfb86b1475eee33c62484c367727f1a89ed67a73d0753a01f8342f1dd2440652dcabccc2861c536886658ad2e01055d3aca4695e44a04c4d5408baf425b4dea0fc63f1fa9dd3ed78b336a780a3889e69c3d1912ff199dd00c172353f5dd799c26a8bf4ae7a08bed028adfc472a0a0085e7866c1fe4eee79d9b2ce29b409cfddaa3da51c4cc0599a84007e5c843d7b62977eb4a03ac87e7d1f09c20b424b4c1188bf27346a9b35da06eea546dd4fadc2f0d9cc02177e498f8bee6f9708", 0x1000}, {&(0x7f0000004b00)="b3d1b87b4f0f4e0b50225bdd45e749fe3e60deff7adb94257eb955e2634bd2ca3c8586415b725cbb1adc95fe5f36d21cf6d67f5042abde708de16c50b36f1151818afcfa35f5d0eed901d198b8b831ea8dee84094c61e2d956204b787dc44dfb52bf7559fac3ed677e8aaf7dfc93b1a264e52750449ad34eb33d44ed21086aa2331794d7a17c1adb42ca78b6ca4a9ca65e57617df4ad8a9e4e4b3ee31baf1812af6b5295c9d2e1d1d7d8648088282cb199fac6a6fa5587", 0xb7}, {&(0x7f0000004bc0)="b93129a2bdeb9e8bb06a7d43962586e217e92727c2d66bad2ad862184ca5c0efa06adb4795d0b2b045a2a7e6c7e6bcd609fd3c41d63245df6633a3dc08676b39d5f98bb438b195541532d236", 0x4c}], 0x6, &(0x7f0000005240)=[@cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r12, r13, r14}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r15, r16, r17}], 0xb8, 0x4000}], 0x5, 0x0) 07:13:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4c00, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdox\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:45 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4040534e, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:45 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) fstat(r1, &(0x7f0000000300)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000380)=0xc) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback=0x7f000001}, 0x10) write$binfmt_elf64(r0, &(0x7f0000001380)=ANY=[@ANYBLOB="7f454c4600000000000000000000000000000000000000000000071ef4b80000400000000000000000000000000000000000000000003800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b6060000000000000300000000000000d0170000000000a77c19cb000000000000000000000000000000000000000000000000000000000000000000c67e9b790000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f5ffffffffffffff0000000000000000000000000000000000000000000000000000000000000004000000000000fcff000000000000000000000e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000477f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000da8617c6584e8753f1c85b870351000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fdffffff00000000000000"], 0x353) [ 268.377921] binder: release 16190:16198 transaction 666 out, still active [ 268.385076] binder: unexpected work type, 4, not freed [ 268.390410] binder: undelivered TRANSACTION_COMPLETE [ 268.411208] binder_alloc: binder_alloc_mmap_handler: 16190 20001000-20004000 already mapped failed -16 07:13:45 executing program 3: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x8000a, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f00000009c0)="76565a1b317486b1b0b70cf8dab6416b8e8a3e748a255fa2c2f203fa3563be5cdcc2918644698ee616a292ff1a19fc494b39806c557632232d345a61f6e08cc142a05bcfdd0ad37858acadd00c00a61f49c406bb94435503876fce76b95f57ec718251b387ed5c7f6d7e9ff41927c8381b", 0xfffffce6, 0x20000801, &(0x7f0000e68000)={0x2, 0x4e22, @multicast2=0xe0000002}, 0x10) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000008c0)={0xfffffffffffffffd, {0x2, 0x4e1d, @rand_addr}, {0x2, 0x4e23}, {0x2, 0x4e1d, @dev={0xac, 0x14, 0x14, 0x21}}, 0x1c, 0x5, 0x7fff, 0x9976, 0x0, &(0x7f0000000800)='bridge_slave_1\x00', 0x4, 0x7, 0x800}) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={0x5084f74d, {0x2, 0x4e22, @rand_addr}, {0x2, 0x4e21, @loopback=0x7f000001}, {0x2, 0x4e24, @broadcast=0xffffffff}, 0x0, 0x6, 0x0, 0x40, 0x0, 0x0, 0x3f03, 0x80000001, 0x4}) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000480)="0047f82f07d82c99240970") getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000600), &(0x7f0000000640)=0xc) madvise(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x9) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000180)=""/193, &(0x7f0000000840)=0x47) r3 = fcntl$dupfd(r1, 0x406, r0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)="766574683100000000ffffffffffef00", 0x10) r4 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000080)={@remote={0xfe, 0x80, [], 0xbb}, 0x800, 0x0, 0xff, 0x1, 0x0, 0x0, 0x5ee}, 0x20) setsockopt$inet6_int(r4, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x88d9, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000006c0)={{{@in=@loopback, @in6=@mcast1}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f00000007c0)=0xe8) r5 = socket(0xa, 0x1, 0x0) ioctl(r5, 0x8912, &(0x7f0000000680)="c626262c8523bf012cf66f") sendmmsg(r4, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="0c00f3f400ebffffffdfffff0000ff006b3be7bfdd0962a7c5a8ada5d0a58161bf04efa2625db2f4f3e43d17d6b6da2b2d5253c7e685e6efdd81dbcd77a48ce67c88f0d811a744f6a4a29ea88dc1abcee917cba9028f038f1eebff03000000000000012992f15353391448e9ff15a814aae74edf82702c426dca60d28d67c60297f43a06983394fc306a5923401819711321e155274a369d633e308ed1d5ad070000000000000069e17fe273cc3120c6d78ae397ecf26488c37f30384660e67321fe614e07cdc41d994f1df67a0207d16fbdf91bc921eec605000000b0bb2c608e5874a4df"], 0xdc}}], 0x1, 0x0) getpeername$packet(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000440)=0x14) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000940)={@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, @empty, @remote={0xfe, 0x80, [], 0xbb}, 0x5ec7, 0x20, 0x2, 0x0, 0x2, 0x4, r6}) r7 = getuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast2}}, &(0x7f00000003c0)=0xe8) setresuid(0x0, r7, r8) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0)={0x2}, 0x10) socket(0xd, 0x2, 0x0) 07:13:45 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xa, 0x4, 0x6, 0x2, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000400), &(0x7f00000002c0), 0x1}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r1, &(0x7f0000000040)='n', &(0x7f0000000200)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000003c0)={r1, &(0x7f0000000080), &(0x7f0000000300)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r1, &(0x7f0000000080), &(0x7f0000000200), 0x1}, 0x20) write$binfmt_elf64(r0, &(0x7f0000000400)={{0x7f, 0x45, 0x4c, 0x46, 0x8e47, 0x6, 0x3, 0x5, 0x0, 0x3, 0x3e, 0x9, 0x6c, 0x40, 0x23, 0x6, 0xfffffffffffff801, 0x38, 0x1, 0x3, 0x6, 0x8}, [{0x7, 0x1, 0x4, 0xad7, 0x9, 0x81, 0x8, 0x2}, {0x6474e551, 0x80, 0xffffffffffff8dec, 0x2, 0x0, 0x4, 0x0, 0x7}], "0c98718553ecbdeb53aa62c160d04c7b700a780d05937cdb1cada607550d829e5bf08b86e160b027a3855e7bb9ff032e5d5ae510922a50ebe68916aa8050bd8b1415525fb9877d199ae7fc1ccdb6b797a01252046ab2e96aaefdfe008ad4c0cbc5fea038a4ab19b375a3a641e4d2344f", [[], [], [], [], []]}, 0x620) 07:13:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socket$packet(0x11, 0x100808000000002, 0x300) socket$packet(0x11, 0x2, 0x300) getxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@random={'btrfs.', '{ppp0!\x00'}, &(0x7f00000000c0)=""/16, 0x10) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ptype\x00') sendfile(r1, r2, &(0x7f0000000000)=0x3e, 0x80000003) 07:13:45 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo-\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:45 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x2000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 268.430126] binder: BINDER_SET_CONTEXT_MGR already set [ 268.435581] binder_alloc: 16190: binder_alloc_buf, no vma [ 268.435975] binder: 16190:16198 ioctl 40046207 0 returned -16 [ 268.441262] binder: 16190:16210 transaction failed 29189/-3, size 24-8 line 2967 [ 268.460405] binder: undelivered TRANSACTION_ERROR: 29189 [ 268.471419] binder: send failed reply for transaction 666, target dead 07:13:45 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x0) r2 = dup(r0) write$P9_RSTATFS(r2, &(0x7f0000000000)={0x43, 0x9, 0x1, {0x3, 0x1, 0xee0, 0xfffffffffffffff8, 0x0, 0x8, 0xff}}, 0x43) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local={0xac, 0x14, 0x14, 0xaa}, @rand_addr}, 0xc) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f00000002c0)=ANY=[@ANYBLOB='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000100)=ANY=[], @ANYBLOB="00000000000000009167e362d94d9783acd3abab55cfe09b6ce63674c44de82475ec4c0d09741d749cdc33a60f677c81615ee99f37e46b7d8e47d5ba867e485e4ac1df0420bfc31563d746ae1e9fcd812ecb48acbf9852c55532da36e95fd4060f770303419e0e1965f7cd4ba4702b6d80cc8614229ff537a69c4df211f1ab241111d782ba3f20d6b8ee2f819c2ea25491d08a4a877172f4088e47b21487403a7a7b19308d50ce9dddc9f7f92cbc"], 0x78) close(r4) dup3(r1, r3, 0x0) 07:13:45 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80dc5521, &(0x7f00000000c0)=""/165) [ 268.659918] binder: release 16232:16239 transaction 671 out, still active [ 268.666927] binder: unexpected work type, 4, not freed [ 268.672223] binder: undelivered TRANSACTION_COMPLETE [ 268.687987] binder_alloc: binder_alloc_mmap_handler: 16232 20001000-20004000 already mapped failed -16 [ 268.703701] binder_alloc: 16232: binder_alloc_buf, no vma [ 268.708763] binder: BINDER_SET_CONTEXT_MGR already set [ 268.709460] binder: 16232:16246 transaction failed 29189/-3, size 24-8 line 2967 [ 268.715137] binder: 16232:16239 ioctl 40046207 0 returned -16 [ 268.733608] binder: send failed reply for transaction 671, target dead [ 268.741634] binder: undelivered TRANSACTION_ERROR: 29189 07:13:46 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x40605346, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:46 executing program 5: r0 = socket$inet(0x2, 0x3, 0x1) r1 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x5, 0xd2bc582df0db6e83) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000380)={0x9, 0xf, 0x8, 0x1, 0x0}, &(0x7f00000003c0)=0x10) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000400)={r2, 0x870a}, 0x8) getsockopt(r0, 0xff, 0x0, &(0x7f0000000180)=""/166, &(0x7f0000000240)=0xa6) r3 = open(&(0x7f0000000000)='./file0\x00', 0x800, 0x2) ioctl$RTC_RD_TIME(r3, 0x80247009, &(0x7f0000000080)) accept(r0, &(0x7f00000000c0)=@nl, &(0x7f0000000140)=0x80) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r4, &(0x7f00000002c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000200), r5}}, 0x18) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f0000000540)=ANY=[@ANYBLOB="7b000000e9f2646a5f4bbf8af60b4a7fb010694acb364af8622d8e6f1c9408ab29390805f46dc3a60fc1ec39fdc153c9c9ac810d146378fe12a79ec5b0a474547b72e914d2b115186d2513dff9465cb651bcef1fd0b0292e53fa9def616b203008baf3e5358705518071994990efe6cc9f817cee73fb0b0a686fd0e1677b6aa4ad6ff009eb4bb35bdc31dc0bc00cce7a64aced34b085e49bc88eb12fb575653bca7e4b1912854561b9b91c51bd4af9f2937373629884f9f4d1e6bfab602e51c8e68da45acbd913e2738b6d2b8e2f04439bc9f8be26b29922769105be959878924cc8f6efb6b14153f84d"]) ioctl$EVIOCGSND(r3, 0x8040451a, &(0x7f0000000280)=""/233) 07:13:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x7a, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdo#\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:46 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) dup2(r0, r1) sysfs$2(0x2, 0xfffffffffffffffe, &(0x7f0000000280)=""/105) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x43}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="7200008b5d0008000000000000e400bb0ba4a7a733533362d21e5ccf35b702fe577d6e4cfbf2ed3147b5def07caaffc13956300f832d3afc2d8c5737a2cce5577a4ecc7039828b8c3ce6ed49a958c447fd6e1526c51b6742c15a1a9666653ca4ce52ccc75c656c6a4e14397ac68ac4e3e6b34e24e0ba83617d52dd7922d1d4d64c234a4ffa", @ANYRES16=r2, @ANYBLOB="080026bd7000fbdbdf250e0000004400020008000400c40d000008000b000200000008380a0000080000000000ac4d08000900ac0a00000800060005000000080003000000008a34291db0730008000500050000000800"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0) 07:13:46 executing program 1: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000140)=0x0) process_vm_writev(r0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/247, 0xf7}], 0x1, &(0x7f0000000180)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x1, 0x0) 07:13:46 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4040534e, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:46 executing program 1: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x4, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) r1 = syz_open_pts(r0, 0x0) socketpair$inet6(0xa, 0x5, 0x1, &(0x7f0000000040)) ioctl$TCSETAF(r1, 0x402c542b, &(0x7f0000000000)) syz_open_pts(r1, 0x80000) ioctl$KDENABIO(r0, 0x4b36) 07:13:46 executing program 3: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0xffffffff, 0x100) write$FUSE_DIRENT(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="8f2ca67134ec171ed8e6a442a25dafbfe79dddced66b9a65a2cc4c20fa3e7414ef91661b3d85af00aa89d39b5fd246dc39c5ce98d1b3fb4739993b3b805f270201726c05425aec0b6c51fd912506d2f9c6d0676519e3796cada8b24e48b14fa9236df49b1e4761ef0f5cad700db687c4e01c1d2618fe27d29f65c6dd0031c920e09e7af95ebb337ffd7e57ef11c82edb73624b2c5db2fca3e63b55f0a2c8536409decb65a269ffccfab5a0804ad658ef5add35"], 0x40) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x805, 0x0) syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x4000) sendto$inet6(r2, &(0x7f0000000000)="c6", 0x1, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x5}, 0x1c) sendto$inet6(r2, &(0x7f0000000240)="93", 0x3bd, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) [ 269.606955] binder: release 16282:16287 transaction 676 out, still active [ 269.613961] binder: unexpected work type, 4, not freed [ 269.619388] binder: undelivered TRANSACTION_COMPLETE [ 269.647073] binder_alloc: binder_alloc_mmap_handler: 16282 20001000-20004000 already mapped failed -16 07:13:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2=0xe0000002, @dev={0xac, 0x14, 0x14, 0x12}, @dev={0xac, 0x14}}, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', r2}) write$binfmt_aout(r1, &(0x7f0000000780), 0x20) 07:13:46 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:46 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6800000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 269.658788] binder: BINDER_SET_CONTEXT_MGR already set [ 269.665597] binder: 16282:16287 ioctl 40046207 0 returned -16 [ 269.670252] binder_alloc: 16282: binder_alloc_buf, no vma [ 269.677072] binder: 16282:16297 transaction failed 29189/-3, size 24-8 line 2967 [ 269.691089] binder: undelivered TRANSACTION_ERROR: 29189 [ 269.697109] binder: send failed reply for transaction 676, target dead 07:13:47 executing program 5: truncate(&(0x7f0000000080)='./file0\x00', 0x6c) r0 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x3f, 0x200000) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xffffffffffffffe1) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f00000006c0), 0x0, &(0x7f0000001800)={[{@logdev={'logdev', 0x3d, './file0/file0'}, 0x2c}, {@logdev={'logdev', 0x3d, './file0/file0'}, 0x2c}]}) setsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000100)="1b590513390939703eed8ca5e39462f59847610d44f9d9b2babd9e3af4a5767171096b2b7df179deaef996f41f57f3889ec550", 0x33) 07:13:47 executing program 6: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x100000000, 0x4}, 0x1000000000c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105518, &(0x7f0000001000)) [ 269.830752] binder: release 16319:16325 transaction 681 out, still active [ 269.837763] binder: unexpected work type, 4, not freed [ 269.843067] binder: undelivered TRANSACTION_COMPLETE [ 269.854175] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 269.865738] binder_alloc: binder_alloc_mmap_handler: 16319 20001000-20004000 already mapped failed -16 07:13:47 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x2, 0x0) ioctl$BLKZEROOUT(0xffffffffffffff9c, 0x127f, &(0x7f00000000c0)={0x3, 0x1}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'rose0\x00', 0x0}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f00000006c0)={r2, 0x9, 0xb3, 0x3f, 0x800, 0x8, 0x883}) futex(&(0x7f0000000040), 0x400000085, 0x0, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x4034020002) 07:13:47 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) [ 269.890750] binder: BINDER_SET_CONTEXT_MGR already set [ 269.896187] binder: 16319:16325 ioctl 40046207 0 returned -16 [ 269.905112] binder_alloc: 16319: binder_alloc_buf, no vma [ 269.910803] binder: 16319:16335 transaction failed 29189/-3, size 24-8 line 2967 [ 269.920563] binder: send failed reply for transaction 681, target dead [ 269.927678] binder: undelivered TRANSACTION_ERROR: 29189 [ 269.996249] XFS (loop5): Invalid device [./file0/file0], error=-2 [ 270.054535] XFS (loop5): Invalid device [./file0/file0], error=-2 [ 270.081568] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 07:13:48 executing program 6: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x2, 0x4000) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000040)={0x1f, 0x400009, 0x9a23, 0x7, 0x7c2}) r1 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0xc1105511, &(0x7f0000001000)) setsockopt$nfc_llcp_NFC_LLCP_RW(r0, 0x118, 0x0, &(0x7f0000000080)=0x1f, 0x4) 07:13:48 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000240)='fou\x00') pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f0000000040), &(0x7f0000000080)=0x40) read$FUSE(r2, &(0x7f0000000480), 0x1000) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000440)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r1, 0x101, 0x0, 0x0, {0x3}, [@FOU_ATTR_AF={0x8, 0x5}]}, 0x1c}, 0x1}, 0x0) 07:13:48 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x40505330, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0xa, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:48 executing program 5: r0 = socket$inet(0x2, 0x2, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x8, 0x40000) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000080)={0x4004, 0x100000}) ioctl$sock_ifreq(r0, 0x8992, &(0x7f0000000000)={'bridge0\x00', @ifru_names='gre0\x00'}) 07:13:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)="6d73646f73a8", &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:48 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4040534e, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:48 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x40, 0x40) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0x40505331, &(0x7f0000000280)) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000200)={0x6, 0x6, 0x4, 0xfffffffffffffe01, '\x00', 0x6}) writev(r0, &(0x7f0000000100)=[{&(0x7f00000001c0)="390000001300094700bb61e1c3e4ffff0600000001000000450d00002000000019000a000d0000000000280f00000007fd17e1ffff06060400", 0x39}], 0x1) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000300)=0x10) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x10000, 0x0) getpeername$inet(r3, &(0x7f00000000c0)={0x0, 0x0, @multicast2}, &(0x7f0000000140)=0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000000)={0x0, @loopback, @multicast1}, &(0x7f0000000040)=0xc) [ 270.860626] binder: release 16386:16389 transaction 686 out, still active [ 270.867636] binder: unexpected work type, 4, not freed [ 270.872961] binder: undelivered TRANSACTION_COMPLETE [ 270.881788] netlink: 'syz-executor1': attribute type 10 has an invalid length. 07:13:48 executing program 6: r0 = socket(0x10, 0x20000000802, 0x0) write(r0, &(0x7f0000000080)="240000001a0025f00018000400edfc0e80000000000400000001deff0700020000000000", 0x24) pread64(r0, &(0x7f00000000c0)=""/251, 0xfb, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) r1 = dup2(0xffffffffffffff9c, r0) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r1, 0x4008af23, &(0x7f0000000040)={0x2, 0x1a14}) 07:13:48 executing program 5: r0 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x100, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) r1 = gettid() sched_getattr(r1, &(0x7f0000000080), 0x30, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000004fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000200)='./bus\x00', 0x0) write$cgroup_int(r3, &(0x7f0000000040), 0x1) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x201, 0x2) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) exit(0x4) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x1012, r4, 0x0) write$P9_RREADLINK(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="0e000000d6c3000500002f627573670940339337e8f9dc28b701963a45912c8117c9a58eafbf01cd18d4626a31dd9e1e1af2cd5e342eac933d7147ab002d456546423913b305000000feffffff2d54edfdae00000000000000"], 0xe) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000100)) ioctl(r2, 0xc0884123, &(0x7f0000001f64)) r5 = getpgrp(0xffffffffffffffff) fcntl$setownex(r2, 0xf, &(0x7f0000000000)={0x1, r5}) [ 270.903139] binder_alloc: binder_alloc_mmap_handler: 16386 20001000-20004000 already mapped failed -16 [ 270.921536] binder: BINDER_SET_CONTEXT_MGR already set [ 270.924167] netlink: 'syz-executor1': attribute type 10 has an invalid length. [ 270.931748] binder: 16386:16389 ioctl 40046207 0 returned -16 [ 270.934391] binder_alloc: 16386: binder_alloc_buf, no vma [ 270.945891] binder: 16386:16397 transaction failed 29189/-3, size 24-8 line 2967 07:13:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x74, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:48 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x2000, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@mcast2, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000400)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r0, &(0x7f00000002c0)='./file0\x00', r1, r2, 0x400) r3 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000002fc8)={&(0x7f0000016000)=@nl=@kern={0x10}, 0x80, &(0x7f0000014000)=[{&(0x7f0000000000)="5500000019007fb1a12d1cb2a4a280a80a06050000a84321a7052369250009000800001c0100efd6a289d936a78b00880d0000dc1338d544000a9b84226eb75afb83de448daa7227c43ab8220000060cec4fab91d4", 0x55}], 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="c0000000000000000f0100000300000015c1def8bd205d09aef714a391f595a9fe44cbb2a7afd92fbc6755dd4eb6104adedc1362bbd6535c7afb4b6ab9f015cfe118a11eabd8bfee36f25fd20aebdae09aac2fa0fe6826d60a72d5eafc6998db7a3b1a039dce50f4d4d971cf3614d8245638f00a979fbc65c1b57a6c477bd58e217ae480cba629f53e8837fc2c7b04691905cfd269204361c72c5d0795126a241b528ce4fc5fd30730738e66fe0000000000050100006c040000003607c0661a08ffe86735277c568f33c7ddb2333cce6f49663419ab109db9bb45ea8e4a6999bca916bd073ef01eb34145204254cb06ba82b6da9325e63267c7e1dd19fb6743e6e8d828112d132cc19b7bc171148bba7470206808cc762b7fbb13844208600653fb062471c5a1a5f5d9684dbdc0a1c29cf89f4c2cee6d8d20a2b8f738b7ad35e52f1473de842d6e01551a7974ff71427f9a25fac008228e0313546786eeeebb81b4a3e7cce700000000680000000000000000000000e60b0000a0ff1d7d9c65172bee696da64b6aa14528518dbe84c0a510d49b959428ef229243bac913d02adac093b945e5b55a956eeef7e4878f599e2f3532857fd4e10476c1265647e1de534a2d2a725eae60822fff1d28f124a12ef200000000000000000000000000000000000000000000"], 0x1e8, 0x1}, 0x0) [ 270.961300] binder: send failed reply for transaction 686, target dead [ 270.972441] binder: undelivered TRANSACTION_ERROR: 29189 07:13:48 executing program 6: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8914, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/fib_triestat\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 271.086552] netlink: 'syz-executor6': attribute type 2 has an invalid length. [ 271.096046] netlink: 'syz-executor6': attribute type 2 has an invalid length. 07:13:48 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'syz_tun\x00'}, 0x18) add_key(&(0x7f0000000080)='ceph\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000000), 0x1fe, 0xffffffffffffffff) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f000001e000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000140)="b805000000b9008000000f01c1f080a4b000600000000fc3180f09c744240000000000c744240200080000c7442406000000000f0114240f08f3a5650f050f20da0f01cf", 0x44}], 0x1, 0x1, &(0x7f0000000380), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000dc0)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000020000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000000)="f2a766ba610066ed48b813c4830f000000000f23d00f21f835300000000f23f866ba2000edc441175d392e67450f01cb0fc72cbe67400f001066ba4100b0a8ee36420f015900", 0x46}], 0x1, 0x0, &(0x7f0000000100), 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) preadv(r1, &(0x7f0000000d00)=[{&(0x7f0000000700)=""/168, 0xa8}, {&(0x7f00000007c0)=""/30, 0x1e}, {&(0x7f0000000800)=""/119, 0x77}, {&(0x7f0000000880)=""/77, 0x4d}, {&(0x7f0000000900)=""/53, 0x35}, {&(0x7f0000000940)=""/1, 0x1}, {&(0x7f0000000980)=""/152, 0x98}, {&(0x7f0000000a40)=""/246, 0xf6}, {&(0x7f0000000b40)=""/226, 0xe2}, {&(0x7f0000000c40)=""/159, 0x9f}], 0xa, 0x0) process_vm_writev(r3, &(0x7f0000000640)=[{&(0x7f0000000200)=""/28, 0x1c}, {&(0x7f0000000240)=""/72, 0x48}, {&(0x7f00000002c0)=""/226, 0xe2}, {&(0x7f00000003c0)=""/50, 0x32}, {&(0x7f0000000400)=""/100, 0x64}, {&(0x7f0000000480)=""/65, 0x41}, {&(0x7f0000000500)=""/93, 0x5d}, {&(0x7f0000000580)=""/37, 0x25}, {&(0x7f00000005c0)=""/91, 0x5b}], 0x9, &(0x7f0000000700), 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 271.140645] binder: release 16419:16426 transaction 691 out, still active [ 271.147691] binder: unexpected work type, 4, not freed [ 271.153066] binder: undelivered TRANSACTION_COMPLETE [ 271.164645] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 271.166396] binder_alloc: binder_alloc_mmap_handler: 16419 20001000-20004000 already mapped failed -16 [ 271.185769] binder: BINDER_SET_CONTEXT_MGR already set 07:13:48 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)="6d73646f737f", &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:48 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6c00000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 271.191190] binder_alloc: 16419: binder_alloc_buf, no vma [ 271.191561] binder: 16419:16426 ioctl 40046207 0 returned -16 [ 271.197013] binder: 16419:16432 transaction failed 29189/-3, size 24-8 line 2967 [ 271.215336] binder: undelivered TRANSACTION_ERROR: 29189 [ 271.227196] binder: send failed reply for transaction 691, target dead [ 271.401503] binder: release 16448:16453 transaction 696 out, still active [ 271.408517] binder: unexpected work type, 4, not freed [ 271.413810] binder: undelivered TRANSACTION_COMPLETE [ 271.424592] binder_alloc: binder_alloc_mmap_handler: 16448 20001000-20004000 already mapped failed -16 [ 271.438262] binder: BINDER_SET_CONTEXT_MGR already set [ 271.443630] binder_alloc: 16448: binder_alloc_buf, no vma [ 271.443705] binder: 16448:16453 ioctl 40046207 0 returned -16 [ 271.449212] binder: 16448:16454 transaction failed 29189/-3, size 24-8 line 2967 [ 271.455412] binder: undelivered TRANSACTION_ERROR: 29189 [ 271.468695] binder: send failed reply for transaction 696, target dead 07:13:49 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x3, 0x20000401) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f00000000c0)={0x2}) r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000002, 0x1, 0x1100, 0x0, 0x38, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x40000000000000}, [{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}], "fa49851831f518099596dd5faec6"}, 0x66) getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000140), &(0x7f0000000180)=0x8) 07:13:49 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0a85322, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:49 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/tcp\x00') setsockopt$inet_sctp_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f00000001c0)=0x8, 0x4) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x2, 0x6}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000000c0)={r5, 0x3f, 0x30}, &(0x7f0000000100)=0xc) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000580)={0x2, 0x0, @ioapic={0x0, 0x0, 0x0, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xfffffffffffffff9}]}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mq_getsetattr(r3, &(0x7f0000000200)={0x26dd, 0x3, 0xfffffffffffffff9, 0x80000001, 0x7, 0x6, 0xd9e, 0x5}, &(0x7f0000000240)) 07:13:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @empty, 0x800}, 0x1c) listen(r0, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) sendto$inet6(r1, &(0x7f00004e8000), 0xcd, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x4e22}, 0x1c) 07:13:49 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x400000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:49 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:49 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4040534e, &(0x7f0000000140)) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) 07:13:49 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x3}, 0x4) r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x0, 0x24200) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000040)={0x4, 0x0, 0x9, 0x7, 0x7, 0x20, 0x8000}, 0xc) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f0000000080)) getsockopt$packet_int(r0, 0x107, 0x15, &(0x7f0000004000), &(0x7f0000001ffc)=0x4) 07:13:49 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getpeername$inet(r0, &(0x7f0000000000)={0x0, 0x0, @multicast2}, &(0x7f0000000040)=0x10) socket$inet(0x2, 0x80046, 0x80000001) 07:13:49 executing program 6: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB="00000000000004000c"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=ANY=[@ANYBLOB="b4000040000000009f00000000000000400000000000000000000010000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) [ 272.131450] binder: release 16494:16499 transaction 701 out, still active [ 272.138499] binder: unexpected work type, 4, not freed [ 272.143799] binder: undelivered TRANSACTION_COMPLETE [ 272.151124] binder_alloc: binder_alloc_mmap_handler: 16494 20001000-20004000 already mapped failed -16 [ 272.165905] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 272.166600] binder: BINDER_SET_CONTEXT_MGR already set 07:13:49 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000000c0)=0x0) r2 = perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, r1, 0x0, r0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x0, 0x1}, 0x0, 0x0, r2, 0x0) 07:13:49 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:49 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x580, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000040)={@local={0xac, 0x14, 0x14, 0xaa}, @multicast2=0xe0000002}, 0xc) sync_file_range(r0, 0xc0, 0x5a2, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendmsg$nl_netfilter(r1, &(0x7f0000d65000)={&(0x7f0000de2ff4)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, {}, [@typed={0x8, 0x2, @ipv4=@multicast1=0xe0000001}]}, 0x1c}, 0x1}, 0x0) 07:13:49 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4c, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 272.196960] binder_alloc: 16494: binder_alloc_buf, no vma [ 272.202603] binder: 16494:16508 transaction failed 29189/-3, size 24-8 line 2967 [ 272.204185] binder: 16494:16499 ioctl 40046207 0 returned -16 [ 272.225786] binder: send failed reply for transaction 701, target dead [ 272.232696] binder: undelivered TRANSACTION_ERROR: 29189 07:13:49 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x4000, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000100)={0x2a, 0x3, 0x0, {0x1, 0x9, 0x0, '/dev/kvm\x00'}}, 0x2a) ioctl$fiemap(r0, 0xc020660b, &(0x7f00000002c0)={0x4, 0x400, 0x4, 0xfffffffffffffffc, 0x5, [{0x100, 0x80000001, 0x8, 0x0, 0x0, 0x1008}, {0x80000000, 0x6, 0x100000001, 0x0, 0x0, 0x2}, {0x94, 0x2, 0xa061, 0x0, 0x0, 0x1803}, {0x0, 0x8, 0xff, 0x0, 0x0, 0x1102}, {0x10000, 0x0, 0x2, 0x0, 0x0, 0x2d02}]}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000000)={0x1, 0x40000004, 0x0, 0x7}, &(0x7f0000000a80)=0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) pwrite64(r0, &(0x7f0000000040)="bde18b67e8a965b1c341fce3d354f87d2d9c94ec1b3ced1eb77dd057b028b441d615b552e7ca83b9e2ce306aa479a0b0e49835bb93c64d6fc121b9b4d98222bf31aa459056ad816c422c39d07d5a6524ca", 0x51, 0x0) ioctl$KVM_INTERRUPT(r3, 0x4004ae86, &(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) 07:13:49 executing program 6: r0 = socket$inet(0x2, 0x200000002, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21}, 0x10) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x1) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f00000000c0)="11bed610f1b8bedb31271619872a1e562c4636bea0e4600c7671eecd393ba68fcc730e471db8687c021573ffca636bf30f94f3c88351f7f1d75a513e1944730c183cf41f80e646a495a5d69157947c1c2e8c5289fd6196170f7d401e0ef58898a2ea6d05f8a2da312ae55b79fae882cf628da1f0e0e1258748fc6c") r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x3a) syz_emit_ethernet(0x2a, &(0x7f00003f3fd5)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) [ 272.387305] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. [ 272.399074] binder: release 16525:16533 transaction 706 out, still active [ 272.403159] netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'. [ 272.406047] binder: unexpected work type, 4, not freed [ 272.406053] binder: undelivered TRANSACTION_COMPLETE 07:13:49 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x89f0, &(0x7f00000000c0)={'ip6gre0\x00', @ifru_data=&(0x7f0000000000)="ac8be4abd0f79d6325ae476aab5970a3131f2fb4bbfb3c75500e33d0612f430d"}) [ 272.432235] binder_alloc: binder_alloc_mmap_handler: 16525 20001000-20004000 already mapped failed -16 [ 272.443042] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 272.451423] binder: BINDER_SET_CONTEXT_MGR already set [ 272.451438] binder: 16525:16533 ioctl 40046207 0 returned -16 [ 272.451489] binder_alloc: 16525: binder_alloc_buf, no vma [ 272.468319] binder: 16525:16538 transaction failed 29189/-3, size 24-8 line 2967 [ 272.479428] binder: send failed reply for transaction 706, target dead [ 272.487319] binder: undelivered TRANSACTION_ERROR: 29189 07:13:50 executing program 6: sendmsg$alg(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000340)="d2d2b7bf3c547ca55b450a644a37857b2f9bff4e396c33167db2d8bf001a851c6e16b60c822e4198df9c6c648c52c87c6fa0a3f1040e1a1737263d96938142152040ececd644274603d1ab4f7097267aa1db8803d6eccb5780b1f28986dd9fce416007dd58736289d698a35aaf37f515e3c52f77b6d6dda5a41ec9d5a594465e984a7d40251b74c78b01bc9a69946e3f69b27b6655ee980e440d0306d0edcdc9d99f93229b62f4ec56826b43a331b1fe3d29c68f458761c0527610a00b12a2b8ec4e26f63745038436d3817e8590250170d46bdf7196fe94c1c862d8f68ff3f096e2e8a86d506a3c5719ab9f665ed30530d3c08b6c4966f77fe13c51aa640a4a4ac6109424b72ee2280b8eaf000e18c67b6fdf479800b6f0b79707a7f49ae0a2c9867ad155b314b3a771752284b3c46dc0eed6af666a1f48c212b0acef45ca6fb4fd4e2121ab7fd4cf5179fea647f01b395b13b6e15ba547bd8a0d50f93cf2b3104a84a4783da0a96156b8f70559a50eccf33302706af387a408db5660c934c6398ed7463dfd1f218294f3798e499092a8837d25a243b29a9c2fc7ef1c51e956075b9d2e7c0bbbd9dcf6e1e79164472367fa5252cfcad312b9cfe2cdfab319a5cc9c794338ad8f8cbac04c627129990fdb2670ede015de9808d06188af8967398a55804ce019131bcbdebc30647c526a0e7cc3c45360a0cf793815a9a34af98901a6bd1500af7f7de7fc0e567bade21ac1d74f26da08584a0f7d77b1ec5d74808253ecfba43222abe84e4b5a24aa162d150a75ccc5c16949f09602e09e6d01cbdedfcade5776ce87d313d5d1811a1a362b2f4847fd676c91bf539259209bd8c3eef11b500a5d00018cc8ee58877fb7214e0f98be10ac541d5c3a15b8118b7614248300b530b103d324106d68a92946a467dc80dc5558145647bf2b87fbd15fb0d3946f5469ca89b66b477f378743cb8a31905f731a48633c8dcf7f68c4313288836fd8aac63254aaaa5d2a9105efc9fd6afc142f1a165333ab8395f1f6b78831595967960955dd6999c46bca1c1ec9d0ec06bbd53a78275728cee58c1e31452b09a29f5e26484cf752e47cb9db554837b3c835049d626fd2f3f79d1a691e66cf68e7cd876bde8c8e1d91fbfd41125fe455ed335e91a2c7e4734b2742ea189bac10feb3e21c2ffdc1639b36693e7273319e9f6a3628be6e4e6810647f368c6565fc3bc36dff2c49959d4e03926739625332cd38b450c14eb8989470e3f2672281a8c9e1ed71255ffb8fd15c9a6cd6f83602fb33661f4ff9c5e6d4bd5cad7398faa1b5fea188d42ce3a8c1bed1ceecec990ce64a51af0f114740799779747af6dcd4b534d7b1bbf1c49246c685c16a3fff7cb6724815bab9f8b386b48b5a39b6028b4243522d3937d5c89ffd243b864a30b4d77e0adabbef799960b4881b0574d02c8a3438e1f651044e09b676f06654ad265bf56e29fa5a06c634b1776cf4fb15d32c0b6eb22cee2a9240590e44032d42f6d9d5ae9d4976945f7e19ab86a84ce939d63a1377a5be92c2307b8bbe3c83a929d3c20742bdff76f97944d9b438fc75d75db46be5a73c554a7767df2d19a7273c4c629e755776591215fff0f0dbbae5a71fc9dce7736c3706e4ef958e0995388b1e96a6aedb6f4f9292b1fb076da1d715cdd98addeed6cdd9bba63f77c8aac429eafdfc09f466eb373a1ade6da6b0db8a283755afb0109e102fd21ff82c9c45ec6d74458305d94dffa8ffd810377e64827d6ca2fa188ddd0920ef5db4a0dd1ddf0c1f98aa42907f95f326f8f69a371dc5242be8d464725bc118983ccbe790a6618bfd4f804432dfd3cd727aa723efd81dfe06bba17da40563f0c5b66636f26612e85c268405609aad283150c6cc34879b5d70df037ab20f59ca4935c94f7939f0f5ac748b9ffce661a7bc9abd04678c4cc832e94f8fb4515a7632202efd70af3d0d6151cd55792f4ce792d0fe93e80f0f0ad4cd7c01e594ea0e1241024fc00fd2da7e5b7fae57e0822e26d9ae29b5a6363f00b3d6ac9cd2ebc8fcf06e7b9f40767f0302484b3c3fdd3d3bddccdd2da700ed57fc29528903393bcd8218d0fae2a8c2dc8816fd68a9338112c5861bae450ecd5be56be201681f5b426bae096d815fb5e38cf2f3de73b2c77d9dd14d9b7fd3ddada76cd626384153c4f4e4e33343030f75dbf7e6abb3d458910cb6c2c4655c9662af0a7209c4259a5333e5e7236b8f8f471c755b76578c1809726554877c20f01d387ea9563a8a5fbcda2839ab4d6cd710fce95e19674a9bf3f44b700d52653b3e20a5c3252d8d6adda34af0171ead0011b18de841375be3a9957b850ced9e152a1244dc497c137dbc7f0c6fa5f5d6d32bd5dfe9e5b97116f396441304b999ea4e39f9e60cedf6003e411910feb9e51531d2df7af9464370d522964b2fa1b0286af0779d2beae9a984a086b7441d68f673046af4628bcd54a0ac9c18392bbd5ed2b5a102729fc4fb83356f8d2216a0ce1c533a63a5740ac0da3293fad0574ad94fe1834e393fc17ac9c1b72f5907f5667c11c46ad1dab69cd2c25d735b32329b94bebe6b3b65248b0885bce2a6778a395307b0d2d0dbe6b5e3c0086c2472636b634ba5e9fb32413503397f787b7530c1ce3b178ac8eee4ccf03b701b5fa343070e2dc10d8a013cae0d4eb564084a1e4dcce48130c174aed19dbc76186292c6d1efeacf8ceffdd9d988aef86b4bc354d50790252c396f0119de562c35a1f5bba208b3703c59c4bdecc903ef0f5c3a83e9638829ee92817995fc24a2c1cd9876e97dbe1ea8ace395d224267d0c7d50d0ad991a2e85ff7cb83e23b4ec0949151bfcdf831375c82f08ce393497ab2b7a2d0d1ee2887881cd1f735264b79db4fcc5c984c28a7963584ab65dac1d5bf6c0c5c5788f5702523b880cb6099ef56a36d3d2942412b2c2cd030926d6fc9841de4b029677678148c37b22f3b2b83ef56bfea6e798167d2db547c8b64cdf64af90206dd8e5ab5acc8724351377eb47f619477e5c4d0ff537705abbf2297cc3e05488273b5230d18365f9225ac0220ef51501e11131401893707f20da62e2116b9677adf45b795fd40b73344fdf3b11e86cb3720e86397b66c3cfbdf30690d7820ecccb9ff1128aa4a35fb0e01573fd62c275c109094b4e1c1fec56384715badf7b99889b0ba660e008c63f67a0ac8afa1c65fac0ddf7780113fa74bd302492631fe847d1be6cf82e3a46fb657e479b64c4647c4617c9956a77cd5db46c74b5579912f69c633d84bfa7c81fd9f3f84dfda7e930b6f02d82ed3be50cac3dc0e313d32d47d7ff18743d8f21a3b6c3ee35c4ff3c1eb7387ad9210cbeff58623fda5496391bfa21fbbcf2377621fb4a47b0bbf969704e5c34e49a8e02eef6cba6454eeb7fc38f21b8e0cfee0d2d7d4f9dd8f612f01de5e892253ed2c5fff9be6b36a8f101a717a3c986804f54e9c10411f3792563e0e2cf0783cf01dbf8994475911640766dce58b787182d81ad2510026a4b8fbff96322f07bc616dbf861ff9c8ce0526cfe96797c48800f41a68b3a0cc3caf18913af60784ca54c89726a97965db9e24fee600bf74d4ff16d8ae60a31e7022cd8cbea65c5881fc2f1fa42fbc6bdeb2610fe558da4d6e8adc80470065b17e30dca82572d424ecd838fb4bb0cea67557aed465600759dcd55824ae4752dffa67908c099ab0af82ecf0ccaeb74e1a4455e5bd84d6e19aff10c5b0040b4fba6407f10630ffff4d71a5fbede849b5e143ceed4ce18a53e7181bee200a65e8620229ab8f795c0107b22be14e8a2d47aaed3f833037ae8deb7411486944d7a062fb2cbe5b360559835852636ec003f31c73b42dcafc0477e97a43cdac0a3f411fcb64c54ed59164ed0ce968acfbc1b4872c40682e97627034504ed512d293282028503ac2d21a56f9249622173e7a3cd7d42eacbebf6c1cb0ec35240e4ecca6ca1d0ee312f2971f36400c1fff3c36270f4b7bf20df5cc2e7d455eb61e20dcda0691c9c07257252ef674caab6d14fbf227b033a461298110cbde7561e9a5b1cecf32e94e28df2e1fb9202c71560425d7640fa1b3738e52b0f29e176a1cb37e4a31beb41c3d920e9d3de136e5273cad51e73749e347cd8c4578ee911fc211b085b06dd5cc7c8c765a2e55ab175d22e284cc2052e46f6b879d3e4a96995130016110ad077aef6f2afacdef45fccbe0f269b13edb12347f33aaa2e6fa12058e7bc31693d5d3d26f670027701158b36f5888e9ffea4421f949e643a509226ac879deb377ff284d2864e1d163521d24bec95692bf487abc3d1eb2cefe19d4be377f89747a3a5cbaebafd449b109f4bda29615b82e1475b0087e0f80c91826e2503c5ccbc8477b983024c3dadea30e4c2e2aa5981bc899b9d9fee9a70778e51420b5c82ec6c8d4ef672105eb10a70c98932f179a6d57d824299ea2e4a846f52fc6a7345786dd3e6219eaab42eecd270e3c7fda18f41fb3f1867c4bfbb8bdc72c37925ec01803e218ba91a13241179c5b82e0570b080cba31ec93d026f3addfc5a475b28f23c0eefe0a1c27102b3b5348187e1bb57682b4ffb640c5f9eea4f600d720bcddc92fe143247", 0xcc3}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="920f"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x1000000000000176) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x1) 07:13:50 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x6c, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:50 executing program 3: r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)=""/45, &(0x7f00000000c0)=0x2d) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)) 07:13:50 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000000c0)={0x1, 0x28, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={r1, 0x10001, 0x4}, 0x707316f65c484cfc) sendmsg$nl_netfilter(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x14, 0x0, 0x6, 0x1, 0x70bd26, 0x2}, 0x14}, 0x1}, 0x0) 07:13:50 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0bc5351, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:50 executing program 1: r0 = socket$inet6(0xa, 0x802, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x80, 0x60) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f0000000040)) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000140)=[@in={0x2, 0x4e20, @loopback=0x7f000001}, @in6={0xa, 0x4e23, 0x1, @ipv4={[], [0xff, 0xff], @rand_addr=0x5}, 0x6}, @in6={0xa, 0x4e23, 0xc4c, @mcast1={0xff, 0x1, [], 0x1}, 0x3}, @in={0x2, 0x4e20}, @in6={0xa, 0x4e22, 0x8, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x1}, @in={0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @multicast1=0xe0000001}], 0xa4) ioctl(r0, 0x8912, &(0x7f0000000080)="025cc83d6d345f8f762070") getrlimit(0x10b, &(0x7f0000000100)) 07:13:50 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4040534e, &(0x7f0000000140)) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) 07:13:50 executing program 1: ioctl$RTC_WKALM_SET(0xffffffffffffffff, 0x4028700f, &(0x7f0000000040)={0x1, 0x0, {0x0, 0x0, 0x0, 0x1e, 0xb, 0x64}}) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x0, 0x0, {"13db963e213929cbb402445738267575"}}}}, 0x90) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x20000007, 0x101004) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080), 0x13f, 0x100b}}, 0x20) 07:13:50 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa5, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f0000000100)='./file1\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000010000)="8da4363a00000000000000000000000000000000000000000000000000000000ecf6f2a3299748aeb81e1b00920efd9a000001000000000001000000000000005f42485266535f4d", 0x48, 0x10000}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="0a090000006cff030000000000002df0273be027e63dce76d677a47dd7"]) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x40, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={0x0, 0x9}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000200)=@assoc_id=r1, &(0x7f0000000240)=0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000280)={0xffffffffffffffff}, 0x106, 0x100b}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000340)={0x15, 0x110, 0xfa00, {r2, 0x1, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x2, @mcast1={0xff, 0x1, [], 0x1}, 0x4}, @in6={0xa, 0x4e20, 0x401, @dev={0xfe, 0x80, [], 0xf}, 0x9}}}, 0x118) [ 273.416200] binder: release 16573:16582 transaction 711 out, still active [ 273.423243] binder: unexpected work type, 4, not freed [ 273.428627] binder: undelivered TRANSACTION_COMPLETE [ 273.453225] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) 07:13:50 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)="6d73646f73ff", &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:50 executing program 3: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000001fe8)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x5, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r1}) sendmsg$nl_netfilter(r2, &(0x7f0000000100)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f00000004c0)={0x1150, 0x5, 0x2, 0x400, 0x70bd28, 0x25dfdbfe, {0xf, 0x0, 0x5}, [@typed={0x8, 0x24, @fd=r1}, @generic="3367f720fda0f5a6c88dabfcfaabf6cec2da47b9efa596c1b08ecf90135403e87252f2f6390ce20184517f92c6631415ed62ee9481a91e993792d8eca4eaead4981396a221cfb3129d0e88b9974d3304cf4fe9ce74b06af1978da5c8873b39714241f3591b764f8d2f8ea76200579c03716ec35cf87e1c2ea6059c22c7c0f31778542cdcb8e5a693ed9f665c5e103c7d7c40508411e79af1912e5010a6bde5471b67d27b69b3973356125be89f066fa34f0b14052538fb5554d46dad731a919fcec6808311fc2c04f43ab5f61ab37d85c355eff91412fb02360b41b18ef645344382abbb8d935c65b3b41fc1ed730bb808e30f76ea935d1bd9d0f0336ac5d639ab8763d91ecc45fb8cba1b206307771037ad07a70595d5b03a8fda1bbe1c64aba845fc07ea9aeb26175e103bd3408dd465ccb816c1cdd3d83a8797a73f5e4f954ab740ea7ec8336b97b3f56eaf156495911b0413fa649df73981d73e985d31d46f2990c97fcf4722f29b54f53edd95d618f5a98a067f91f84e5899ad2287eb55e234c8ba13377dedcf7ff9f4febba5ec9c5d97cf19f0bfe6a33c87bf7f5fa2870b4a5a14bfd617c1192a3b6a733ee69056c36667bc72f49c33208e1e3e2fb9c6c9e1d001a2b19733a06ca010786f13bc0be8b3399346e92cc37d405854fefdc25a6e91b6c88c7a29ef6cdeb709e38f0770a4b6bcb388fdf32e0fe35279e52baf9ca4fde5b84bbf76afea2486fbe8a50db41b075a41b8271bd677578d38e08533a16117ac29bb165853edb9917cece9728d1315aed8e865f6e02888424aa8741ceb5f89b0e0f18b67da4e3adfad2259ae44e2fef779276c2303fe352fb455a798fc883c01b4ef0b6684e57ed2e98f2bf3aeb6e3806f1691f8b1c12b674941c507290aece296e9801549cdeb5f11369dd8b7d1c9496431d0b57fa86b9edfe88f3eff32ffb99ecc035df42bf51e0cb26471d6f518cec529c8af4fbef3c2a5adaf28d14a1d81de0b00232bda838f75da322b348d3ec97fbfdf3e393d8e68d16c878b1137c56c1e39d9d6cb2ad99e69917b7a03abf3a39e627e0c583f7c8474ee2bab6f4220206f4abc530689f88258e8887abab1aa231db3a0134a1d9798a18c8774d3359f18576dbd1c568c6d7240b6664989915a2cbe25be4d63959e4787c2202cf439cfa342354e18aa00ea75b655617c00fbd574433d0d6537ca81a5a4845c0435a8bc1cc3bf23f8de1e1f99362b66df460430419689a045f55e003cee4e3ad438abbecd1a5a3da856c1fdffa8d7152bd4e221aeb06ac1ba9de1752bbe60cce88ff8bc4812989d676875161bb3447d21590445fa1d3cc33ddfcc698d7c3d87d39b67be989e0c4cba4aa3b331a03b83c81e7bd423006f034e7cc488a617612f1560fc485200fdadafbd32328c23765823e8a906df5ddd207c1252e958fe0b1987c45dc0b27ab523973793a9efc35a7f816ed5aadc9264e7f07394a836b212af525c8bb24cd4b5e6417feb2d0f07b449925c866e325e4199819996e4c2703e78c0b71b4723b8394eadb9414da72b17c990d1abf5822b3f297c278e53635ae104fd21fde08dbf02b4bc4f5b507c8d4a9110203c02fdd5ebdafa6f35ab5879bc5f08405db05afdade2f432aeef7d29d7c0c7e74d5a96b67f511ed1de0347a81cf3018a5d92019f3bd19b09d8c1224e170e11ca8eef36707fbba0669ea4cb705bdc7aaa9506fae928a348225d9e531da730358a7ee72dae2f04fd7b760afd736543add30b5e6b0d81854d1c682399dcb439e7e62a46ac84d0b22d5729d01274b3b45856e862a5ac603b15a70871f50b627def7cdd2c85db426572562a564f9d728350cc8b5789e8928812cbf7241e11e43de3df9b55320cb4f3207e0e53ff7c8e3f5aca22f38c6c371765ab72354d53ebb87c6cabbee5853645a6ed35c5c19656c239d3f1cb65cde8922f052011ab4ce35cbfafcb21fd416015fed9e6f4f10915be6546c0545a6a93073086dda7eb0edf05e8999a896f7fbbfa4589d0f6773f4904b500b7f19ccc0597fc1ebb54b99c0999f3fc5fd2d53faca108668a7d66a7aa1c44b986abb2f593779abf8637dbf7d63a227edad79c848a6d99a6239a8ca1577c69e1484c0288ebd85bbe7875b3d48991178ff4b90ed5ce3c222e9193e1f9a99cc9dfa372584421381aa36e448356f2d50e5d9ce280e2709e1ae11096ed33923518573a75cb9127fcaf150a5cf68a203ba2cba1af57f8ece105d6539d3b7f40f99edf28ed552fba64b152b19b7775d4b22804d002506a8db42ab795cb33586c737dda2c5d389ba9ce7c3a9725891c15d8310f7ecd5ecab4d806c4ae57c3befb36b84b6118f5b228a195ea07f6fca552a81becb4f2b39b0414a0c76a9f172987a0bd04e0be41a8cd69b486d678228e09dad561f6391ddbf581bf8a721faf9ba107baf1dced91d8f368f064b6070bb038bb3c81bc83819ecf8de7cf6adfb09757de7a802f35d54a667ea04896a1c364621e64b73bdf0382d90aa93ac2c01ecfc88a1b7521f6594aa76a45faefb4e1f908ba6657ced9e2d700c29fb9483ab4de336d7fa36396cca886b8c0777f63b39564c8bf973e6724fb962478262007cf5ccdce0ead290cbdd87e39fd6dfaed7aefb927e0c826d47125e1e7bcda23c3102b2a2d08116776aeb1a5a25b32298bd795d65cef5a06b1387b011c24a791e6c2fca066a4bd6607b6f052c6a3fde8cc69a8fcde1654a09424aaa64820a43e06728be5ad723edf415febb369c013fcb8f203e2030c68c2c64378ee7457ea4c980f785143adc62c5c07056d2587e09c1d6b92f760b68512da2ef2eef242d758a810206f9e01fcd616ee14a50014c47656ed909d3f7715099eb49145ab08713e0de00c68181f1ba8d7ab0819d628648e7b5c2769bc877b47f73505ebafd0d078555b8b154c73ed0381ce764f9a8126f023318b1955ec5a7b001a56161f5ee4120c050a12cda908e440f010d3f1e3f19cd3dc59ede45d036638e28b15a1688e01dce7238b8207833b7f19925efc8a2a1ea7190300388aa4f4e7591e4fbf836cc916be69cbefb329d0d2436077b1322e048771e3374332456dbd00a2d1579df79b244ba9a29abe3e41f5c3de0e579ad13fb57c473d0eb243402fabec9fdd2155df2f115f765fdd39c6fb62ec466bafee0fd5b5255082522c948b26bbdd74e935385fdc67c8b0ab189d088d579384dd4acd554e62c88a8ab5ef89b2f22946c77e648e8074315b4458d34b4782faf932dee9609ceae73e7a1655c5b3a18ad9609a833d17fd2f23ae6369d8d0296edb1487d78306944652cd3071841f9e04376aeb05a1bb886a93d61b8f504a80d5b767f585d57068297684e5e7e7c3c91a7c2ba5b1baa3a5e308597ff9c08389f65a9b5842e2d5efdef2dad65c1e571955fdb5d265d3864c7080dced3ac090dfd6103702d07cac23328b86f291f5cdd984f0d75236d3e43fb245f05c522a967edccfc597e4151304d18263e512b21ba5c6cb31be9550e1a774451f19baeee0508efb104ae1b6c5e7bc66bae4eafe7663096a1340d5d2d1568bf540b8334b7c79828172d202a107d846de044badc2b3339fb4281b5040e034103bc969f64f75655cea59c437569262773dc4061f17c336f651e37e77f9d9ee2d9405a7725cca21c712bafdb8efd00e5de6a9c13e98cabe1cb1b26d30e7a47532484fa4476098c59e18fce042f23259c8e2a9dfba43e2902bdd28a60366e2d98149922cbc93f0dc9f43e1b9210de20c626a84a1772fc56e39c72a13ae9d6eea3c52e0dd572b94a6b4d624a5f6965e9fa25cda58ed5417a7fe35f4490fd687bef0dc936a338106a1cb67e17326132dd1231048579434b6ab1f445dc673cb399f87d8069e642b4579a151f54f65af53e1dffeea1301130c2f101268d9619f2090d6708f8ab62e5eee143b9917c746b60999bd3bad7634ed4ed11f780df64e4baa73051d454170a1c18a3a8668d1cd871d42c27e0998a23b14437d4039f448b609c155768a02810409a2a540f3542d1e2a7080c099329917a895b148f25d945698be09ff47c9cbef5e43f9fb80c27e4a6c00bcfd3e2dfa53c20b6697606fc26763b40c3b7d2a02c5dc895dbc12079f50c917fb5fe7f270357bb600de65f7380b123011ceed794759344a4d4e0197b431b53d0982516277c998de1ec22947b11fc933787869a938d5ec5e662a7a1e803eb13475c17a52f64b201ef60c922ecab810da7d8f421718bdac06bb9da0a948bb179262ae63bcbb459a7756245a22ebfbc361bcec25d491f3e340471539560dc2521b5d62217f8408e3deec8ecfebab85684e891a8dd70db2ca1d96b75d230a531c2cd6ea2ff75d15688cbcf81bb9b274fc6362db38f879f3ca1054c821efb92f736f7c39618979e50d74b5e515c62583a91fb039f4e5ae129a2907834b94656d9c77c255ac097dff8e126b154cc1a2b35aa8c925f48ea25fafac652bceb70124dea179135a94ee38bc2e6ddc330be08d7e5e1ca2d243bc91fc8e70fe9754c74669f8d9d20d85440676e5fdba7fe93b2a64fe8cadc9b2fb3d67b1daff041c790be8abdd5832ad8bc800ca860c2de10159c0fac6a27e0d43d3eb64ffb02d9f11d71b7b5e1e0771dd86f77331cf4b3e1833f769733f068e5162f9719cfc1af1818b9e203c14d97aec39f1183590240fdeccb32faec796a38525d34abf60b5e2187da97897e1afc18db9d20f7b5c2a295daadaf533744e5b3dd7b7b9820c5dca0c9454fb4d76dc4c04a903dc782e29c1104a06e3ff06f090e768f9480dccad5c7d2f1c675a5eaf28d2fce4b9a1157a99df0fe0a19407971cab3e8ac898d4e61949c0f51c26d2be97cab7a32dec9e1f166d0be634170316db99f8db626e613061290afefe1fb6d46c5b6427add7635b2cab600472f7209cd874a34a70e07e7dfe33a82b20fccadbc305bd48ce483a6ec783dcc0f5e75a83347268525e869813cc31ca71bb5aae94ee42bf8aec4265a765aa23072c494c984fca11d144c232660070ce7001ebc5a17e58ea411734c543cc114abe1698a5be124fd9975842afafa44e900028f0291a8ceea644c957528f7f9b28572708d9f9c77f3abf8dac1b0673e4743d3ca397310aa0d74f0ddddd2e49c6d0f611e7734b6e3fe8e94bf1b18537846365634620867498cb46e6d6ddb759e1e57ea682e836bddb9c197a70ff3985ecfc3cb68cc4fff43213cb46c0b48d988e452358f75eca378a94c7f7f50e8ed846e07a626d798c90c1a66c9047842856e4d32aaf37139b827ff58e2e3122f8c09948d7c7c8a32a19d803b6b6852c3f1fb18d50f445f1597e23b46aaef917f170eb627d390941ef716d2f97c03bbaa4f45ab0288e5d2df2507f3f4efbeadab96eac141be1fe56d1dd5641f7ceff411ba22bd4ccfcafb5779cbbc09b1b1639e2bdd7f9f69b6fcb5249da50a31e646f90b0fe0e8ac7ca6e375e60da0a437985f2a057b7a4b646104bd64e76adf05df8591ea7dcdeb07caa26826c9a48eb0af7cfb0d464f13226c1ed37a731001edc16c163033792142adcc40c9a6b1506478bbfcfd68b5e158831aac376adac94d79b28962fc7f1702bda1f3ccbe9cc4e521e7e9a2de34071ced4aacfe18e7140251fcf9e224cc479695d0a74f8baee795df5e0a585013b850de73c6e7f63ae3044acbbd7cf79e96ccf5fc0d55862cb4f8a6b4688e0a6a977c704882335c7e2574c182e5f7bd296953c1f1d8869489106216b1bcefe59af474532994db5a7ed255f450665ceb08613029a", @generic="a0b1d74d7c3f4f4a56f4c8c78b797c5a048ee4568500659997eeddf6f2ffc5b22caf29b6783cc27a6fcae5765f5d7a1deac64da920eb9dc35ee3ed02de5f16e71fbb6f23c3f8c9ec18ddca751e287e6dadb27cb04ec4e0fa927b89d8e4d33c103f8942ce8bba0ff30460823e4569b2b2de356d59d60b5bf82eb267ef81f82afe36", @generic="dd0f0c0b6c0395075de5c0141af7a92c8167456a23f428e41943eab8cad963f2ab57530288af0a9aefd2a23f3fa1c556154fc28b03a8bd6d43a5170b98dd1f2f7e31a8d30c307630ce54f3e824a98b031804d4ce03ffa1d6923b13b7fdbfd865dbf17440f535040fc9afde2ed5d9d98a49c100a12908e75be0b5194244d61e4757069fada6784fb72cb40849375636048c9cf1dc9b4a3ab921099d31c4b288fb48f6ecc717d0f71fe5636df449eceae3"]}, 0x1150}, 0x1}, 0x40801) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f0000018ff4)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)={0x1c, 0x28, 0x1, 0x0, 0x80000000, {0x1}, [@nested={0x8, 0x0, [@generic='\fA']}]}, 0x1c}, 0x1}, 0x0) [ 273.474070] binder_alloc: binder_alloc_mmap_handler: 16573 20001000-20004000 already mapped failed -16 [ 273.487739] binder_alloc: 16573: binder_alloc_buf, no vma [ 273.489309] binder: BINDER_SET_CONTEXT_MGR already set [ 273.493374] binder: 16573:16590 transaction failed 29189/-3, size 24-8 line 2967 [ 273.506991] binder: 16573:16582 ioctl 40046207 0 returned -16 [ 273.518086] binder: undelivered TRANSACTION_ERROR: 29189 07:13:50 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDDELIO(r1, 0x4b35, 0x96a5) ioctl$TCSETS(r1, 0x40045431, &(0x7f00005befdc)) r2 = syz_open_pts(r1, 0x20201) fcntl$setstatus(r2, 0x4, 0x2800) ioctl$TCXONC(r2, 0x540a, 0x0) write(r2, &(0x7f0000000180)="bf", 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000100)=0x11) ioctl$TCFLSH(r1, 0x540b, 0x0) 07:13:50 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x4800000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) [ 273.525044] binder: send failed reply for transaction 711, target dead 07:13:50 executing program 1: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r2, 0x8000000000000001, 0x9, &(0x7f0000479000)="890528e4", 0x4) setsockopt$inet6_tcp_int(r2, 0x6, 0x4, &(0x7f0000000000)=0x7fff, 0x4) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) listen(r3, 0x0) sendto$inet6(r3, &(0x7f0000f6f000), 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) [ 273.683743] BTRFS: device fsid ecf6f2a3-2997-48ae-b81e-1b00920efd9a devid 0 transid 0 /dev/loop5 [ 273.697316] binder: release 16608:16616 transaction 716 out, still active [ 273.704345] binder: unexpected work type, 4, not freed [ 273.709645] binder: undelivered TRANSACTION_COMPLETE [ 273.717127] binder_alloc: binder_alloc_mmap_handler: 16608 20001000-20004000 already mapped failed -16 [ 273.729673] BTRFS error (device loop5): superblock checksum mismatch [ 273.732343] binder: BINDER_SET_CONTEXT_MGR already set [ 273.739353] BTRFS error (device loop5): open_ctree failed [ 273.742292] binder_alloc: 16608: binder_alloc_buf, no vma [ 273.748249] binder: 16608:16616 ioctl 40046207 0 returned -16 [ 273.752839] binder: 16608:16617 transaction failed 29189/-3, size 24-8 line 2967 [ 273.759062] binder: undelivered TRANSACTION_ERROR: 29189 [ 273.772714] binder: send failed reply for transaction 716, target dead 07:13:51 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x1000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:51 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d}, 0x2c, {'group_id', 0x3d}, 0x2c}) stat(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000480)) read$FUSE(r0, &(0x7f00000070c0), 0x8c0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/mixer\x00', 0x200080, 0x0) ioctl$KDSETLED(r1, 0x4b32, 0x8) read$FUSE(r0, &(0x7f0000002000), 0x1000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000640)={0x0, @in={{0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x56a1, 0x7f, 0x5, 0x0, 0x2}, &(0x7f0000000380)=0x98) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f00000003c0)={r2, 0x1f, 0x8}, 0x8) mount$fuse(0x0, &(0x7f0000000000)='./file0/file1\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000700)={{'fd', 0x3d}, 0x2c, {'rootmode', 0x3d}, 0x2c, {'user_id', 0x3d}, 0x2c, {'group_id', 0x3d}, 0x2c}) r3 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x200000) recvfrom$llc(r3, &(0x7f0000000240)=""/98, 0x62, 0x2, &(0x7f00000002c0)={0x1a, 0x107, 0x2, 0x5, 0x8001, 0x2, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x10) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x20000000}}, 0x50) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="90000000000000000200000000000000010000000045000000000000000000000b000000000066ce656d316e6f646576656d3100000000000000000000000000000000000000000001000000000000002c00000000000000000000000000000000000000000000001c000000000000002b73797374656dcc6370757365746367726f7570246367726f75701500000000"], 0x90) [ 273.816719] BTRFS error (device loop5): superblock checksum mismatch [ 273.833695] BTRFS error (device loop5): open_ctree failed 07:13:51 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:51 executing program 5: r0 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e23, @multicast2=0xe0000002}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) accept4$inet(r0, &(0x7f0000000040)={0x0, 0x0, @local}, &(0x7f00000000c0)=0x10, 0x80800) setsockopt$inet_mreqsrc(r0, 0x11a, 0x0, &(0x7f00000002c0)={@multicast2=0xe0000002, @dev={0xac, 0x14, 0x14}, @multicast2=0xe0000002}, 0xc) 07:13:51 executing program 1: r0 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x3) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x1}, 0x8) shutdown(r0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x8000, 0x0) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000080)) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000100)=0x9, &(0x7f0000000140)=0x4) [ 273.948069] binder: release 16650:16655 transaction 721 out, still active [ 273.955086] binder: unexpected work type, 4, not freed [ 273.960504] binder: undelivered TRANSACTION_COMPLETE [ 273.975270] binder_alloc: binder_alloc_mmap_handler: 16650 20001000-20004000 already mapped failed -16 [ 274.003422] binder: BINDER_SET_CONTEXT_MGR already set [ 274.025227] binder: 16650:16655 ioctl 40046207 0 returned -16 [ 274.055994] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 274.066820] binder_alloc: 16650: binder_alloc_buf, no vma 07:13:51 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000007740)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=@bridge_newneigh={0x3c, 0x1c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@NDA_LLADDR={0xc, 0x2, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, @NDA_DST_IPV6={0x14, 0x1}]}, 0x3c}, 0x1}, 0x0) [ 274.072474] binder: 16650:16658 transaction failed 29189/-3, size 24-8 line 2967 [ 274.107721] binder: send failed reply for transaction 721, target dead [ 274.116418] binder: undelivered TRANSACTION_ERROR: 29189 07:13:51 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x5421, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000013) 07:13:51 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca, 0x4d}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c}) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a000000290104000000000000000000e9ffffffffffffff00000000000000000007002e2f66696c6530"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYBLOB=',wfdno=', @ANYBLOB="000053e98fe5fa55dd25b622a7fe3acf0196f82e5d8ebd8e0880d883ab842cf4ab8d5df87ea0a3a60192a3e36d931d0725796ccd3f3957bb63ae32c1d4db58375e6775f203070425af91178884774b66281cfb3baf9fd46519c6f80ae64de1a2042a40e16d4b2a17658d5884322f349b290ea236c32f6ae928fb31e517734fba05340f3c4384256738c46e63b45521647e27b05a406a3e9ef332f5a839c633a6c9b1c25799f8eecee8cf05ebd10c"]) umount2(&(0x7f0000000500)='./file0\x00', 0x0) 07:13:51 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:51 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x5000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:51 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000001280)='net/udp6\x00') setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@filter={'filter\x00', 0xe, 0x4, 0x5e8, [0x0, 0x200012c0, 0x20001568, 0x20001698], 0x0, &(0x7f0000000000), &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0100000009000000000000000001697036677265300000000000000000007665746831000000000000000000000073797a6b616c6c65723000000000000065716c00000000000000000000000000ffffffffffff00ff00ffffff4cb32edfb08a00ff00ffffff0000d00000003002000078020000636f6e6e6c6162656c0000000000000000000fa064000000000000000000000000000008000000000000008000000000000000766c616e00000000000000000000000000000000000000000000000000000000080000000000000001000600000802017265646972656374000000000000000000000000000000000000000000000000080000000000000000000000000000005345434d41524b000000000000000000000000000000000000000000000000000801000000000000010000000700000073797374656d5f753a6f626a6563745f723a66696c655f636f6e746578745f743a733000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a30000000000000000000000000fe01000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0100000005000000000000000000626f6e645f736c6176655f3000000000626f6e645f736c6176655f31000000006c6f0000000000000000000000000000627071300000000000000000002e56000000000000000000ffff00ffffffaaaaaaaaaaaaff0000ff00ff0000b0000000b00000000001000064657667726f7570000000000000000000000000000000000000000000000000180000000000000001000000080000000600000007000000ba670000000000000000000000000000000000000000000000000000000000280000000000000000d3a60d545e36581d4f9edae81243ed57553265d72f747136cb9809b3b02e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000feffffff020000001100000004000000000d69666230000000000000000000000000627071300000000000000000000000007465616d5f736c6176655f31000000007465716c300000000000000000000000aaaaaaaaaa19ff0000ffff00aaaaaaaaaaaaffffff000000000070000000a0000000d800000000000000000000000000000000000000000000000000000000000000000000000800000000000000feffffff00000000646e61740000000000000000000000000000000000000000000000000000000010000000000000000000000000000000feffffff000000000b000000000000000200726f7365300000000000000000000000696662300000000000000000000000007465616d5f736c6176655f300000000069703667726530000000000000000000ffffffffffff00ffffffffff17a79b7c9519ffff00ffffff0000a0000000d8000000080100006367726f7568db65b976e221900f4170000000000000000000000000000000000000000000000000000008000000000000000000000001000000646e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000feffffff0000000072656469726563740000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000009203d39c14ed75b5f5ee84c1662237c6e7da0c6ccdaf113eca6cabe82a058cf81d82fb53248f5e2ed361a5d290d84c6202573147216978885467840cc7faadb254df7b2b0c9b4e091ec32204ac6d6ec58d05b10393e9aea7a31645d56616b7fead836d3cbb7354769b0"]}, 0x6d9) r1 = add_key(&(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffa) r2 = getpgid(0x0) ptrace$poke(0xffffffffffffffff, r2, &(0x7f0000000140), 0x1) keyctl$invalidate(0x15, r1) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 07:13:51 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000240)={0xbf, @time={0x77359400}}) r1 = socket$inet6(0xa, 0x5, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4040534e, &(0x7f0000000140)) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) [ 274.716299] binder: release 16701:16702 transaction 726 out, still active [ 274.723338] binder: unexpected work type, 4, not freed [ 274.728790] binder: undelivered TRANSACTION_COMPLETE [ 274.736082] binder_alloc: binder_alloc_mmap_handler: 16701 20001000-20004000 already mapped failed -16 [ 274.747852] binder_alloc: 16701: binder_alloc_buf, no vma [ 274.749880] binder: BINDER_SET_CONTEXT_MGR already set [ 274.753520] binder: 16701:16710 transaction failed 29189/-3, size 24-8 line 2967 07:13:51 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'bond0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="03000000afdfbf630b2c18ff8b129dcf939bae1e7399e9e630cb9388b20029fdfc78f15e54c90b40c6765d05a4d7a6d5197dfc8bb4a094d86e65e95fd41e88789b891eeb5e32f201c9ce43f29a79eae7dff791d38d78bd31d2cdeebc82f634d4f9dc9d5b6d5a24dd634eca269747450aacbfc0da6eec7a6c0fba8a399a6645bc0e058c865dc7b77944ae924c3b3f9dff69628988a0e466cbc6c291adf7117e0c4bcf371513cea26b4bf9a9c9de7b4193c941eed86c35be2c0b0000000000000000000000"]}) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x3, 0x40000) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f00000000c0)={{0xffffffffffffffff, 0x3, 0xbd9, 0x3, 0x8}, 0x200000000000, 0x3ff}) [ 274.759668] 9pnet: Insufficient options for proto=fd [ 274.772478] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 274.779766] binder: 16701:16702 ioctl 40046207 0 returned -16 [ 274.787169] binder: undelivered TRANSACTION_ERROR: 29189 [ 274.798415] binder: send failed reply for transaction 726, target dead [ 274.799827] 9pnet: Insufficient options for proto=fd 07:13:53 executing program 1: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000040)={0x0, 0x2, 0x4}, 0x10) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$bt_l2cap(r1, &(0x7f00000005c0), &(0x7f0000000600)=0xe, 0x80800) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000ac0)={'ip6_vti0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000b40)={'bpq0\x00', r3}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000000c0)={r4, 0x1, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x10) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000980)='bcsf0\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000540)={0x0, 0x1}, 0x8) syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') r5 = socket$inet6(0xa, 0x805, 0x0) sendto$inet6(r5, &(0x7f0000000000)="c6", 0x1, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x5}, 0x1c) connect$inet6(r5, &(0x7f00006f7000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x1}, 0x1c) sendto$inet6(r5, &(0x7f0000000240)="93", 0x1, 0x0, &(0x7f0000001240)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x1}, 0x1c) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r6, 0x6, 0x8, &(0x7f0000000100), &(0x7f00000000c0)=0x1) 07:13:53 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xe800, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="eb3c906d6b660800666174000204010a0200027400f8000000000283224ea4224b5494fab2", 0x25}], 0x0, &(0x7f0000000100)) 07:13:53 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000007c0)={0x8, 0x2000000000000000, &(0x7f0000000600)=[@increfs={0x40046304, 0x1}], 0x0, 0x0, &(0x7f0000000780)}) 07:13:53 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34400, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f00000002c0)) getsockname(0xffffffffffffff9c, &(0x7f0000000040)=@pppol2tpin6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @local}}}, &(0x7f00000000c0)=0x80) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100)={0x0, 0x80000001}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000200)={r2, 0x53, "3bf61864596ab7424728a975f16e7d7915f431db02beed048c0378869c8ba58238409c04b2018b1edf18c36b161624d721a93db7252b40cc32acff41917c7a399059865346e12df7e776099d05545a4b5da4c4"}, &(0x7f0000000280)=0x5b) [ 276.731103] binder: release 16747:16753 transaction 731 out, still active [ 276.738161] binder: unexpected work type, 4, not freed [ 276.743462] binder: undelivered TRANSACTION_COMPLETE [ 276.764007] FAT-fs (loop7): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) [ 276.787158] binder_alloc: binder_alloc_mmap_handler: 16747 20001000-20004000 already mapped failed -16 [ 276.827688] binder: BINDER_SET_CONTEXT_MGR already set [ 276.839624] binder_alloc: 16747: binder_alloc_buf, no vma [ 276.845378] binder: 16747:16761 transaction failed 29189/-3, size 24-8 line 2967 [ 276.860720] binder: 16747:16753 ioctl 40046207 0 returned -16 [ 276.894512] binder: undelivered TRANSACTION_ERROR: 29189 [ 276.905309] binder: send failed reply for transaction 731, target dead [ 431.072288] INFO: task syz-executor3:16716 blocked for more than 140 seconds. [ 431.079673] Not tainted 4.18.0-rc4-next-20180713+ #7 [ 431.085301] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 431.093264] syz-executor3 D24168 16716 4484 0x00000004 [ 431.098902] Call Trace: [ 431.101496] __schedule+0x87c/0x1ed0 [ 431.105220] ? user_path_at_empty+0x40/0x50 [ 431.109552] ? do_mount+0x180/0x1fb0 [ 431.113268] ? __sched_text_start+0x8/0x8 [ 431.117434] ? lock_downgrade+0x8f0/0x8f0 [ 431.121582] ? lock_acquire+0x1e4/0x540 [ 431.125555] ? fs_reclaim_acquire+0x20/0x20 [ 431.129876] ? lock_downgrade+0x8f0/0x8f0 [ 431.134025] ? trace_hardirqs_on+0x10/0x10 [ 431.138260] ? lock_release+0xa30/0xa30 [ 431.142240] ? check_same_owner+0x340/0x340 [ 431.146567] ? kasan_unpoison_shadow+0x35/0x50 [ 431.151150] schedule+0xfb/0x450 [ 431.154558] ? __mutex_lock+0xbf0/0x1680 [ 431.158614] ? __schedule+0x1ed0/0x1ed0 [ 431.162587] ? kasan_check_read+0x11/0x20 [ 431.166724] ? do_raw_spin_unlock+0xa7/0x2f0 [ 431.171127] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 431.175712] ? __ww_mutex_add_waiter.part.15+0x120/0x120 [ 431.181159] ? mutex_destroy+0x200/0x200 [ 431.185252] ? do_raw_spin_lock+0xc1/0x200 [ 431.189484] schedule_preempt_disabled+0x10/0x20 [ 431.194241] __mutex_lock+0xbf5/0x1680 [ 431.198128] ? lock_acquire+0x1e4/0x540 [ 431.202114] ? d_alloc+0x28b/0x380 [ 431.205654] ? fuse_lock_inode+0xaf/0xe0 [ 431.209707] ? mutex_trylock+0x2b0/0x2b0 [ 431.213771] ? d_alloc_parallel+0x8ea/0x1ea0 [ 431.218180] ? lock_downgrade+0x8f0/0x8f0 [ 431.222325] ? d_alloc+0x290/0x380 [ 431.225883] ? trace_hardirqs_on_caller+0x501/0x5c0 [ 431.230898] ? __d_alloc+0xd50/0xd50 [ 431.234615] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 431.240159] ? lock_downgrade+0x8f0/0x8f0 [ 431.244317] ? d_alloc_cursor+0xe0/0xe0 [ 431.248297] ? plist_add+0x5f0/0x790 [ 431.252027] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 431.257562] ? __follow_mount_rcu.isra.36.part.37+0x175/0x890 [ 431.263446] ? plist_check_head+0x150/0x150 [ 431.267767] mutex_lock_nested+0x16/0x20 [ 431.271834] ? mutex_lock_nested+0x16/0x20 [ 431.276077] fuse_lock_inode+0xaf/0xe0 [ 431.279960] fuse_lookup+0x8f/0x4c0 [ 431.283596] ? fuse_lookup_name+0x830/0x830 [ 431.287916] ? lock_acquire+0x1e4/0x540 [ 431.291887] ? __lockdep_init_map+0x105/0x590 [ 431.296371] ? __lockdep_init_map+0x105/0x590 [ 431.300918] ? lockdep_init_map+0x9/0x10 [ 431.304976] ? __init_waitqueue_head+0x9e/0x150 [ 431.309641] ? init_wait_entry+0x1c0/0x1c0 [ 431.313869] __lookup_slow+0x2b5/0x540 [ 431.317754] ? vfs_unlink+0x510/0x510 [ 431.321555] ? down_read+0xb5/0x1d0 [ 431.325177] ? lookup_slow+0x49/0x80 [ 431.328888] ? __down_interruptible+0x700/0x700 [ 431.333553] ? lookup_fast+0x470/0x12a0 [ 431.337533] ? __follow_mount_rcu.isra.36.part.37+0x890/0x890 [ 431.343431] lookup_slow+0x57/0x80 [ 431.346975] walk_component+0x94a/0x2630 [ 431.351051] ? inode_permission+0xb2/0x560 [ 431.355303] ? path_init+0x2340/0x2340 [ 431.359209] ? walk_component+0x2630/0x2630 [ 431.363573] ? save_stack+0xa9/0xd0 [ 431.367201] ? save_stack+0x43/0xd0 [ 431.370828] ? kmem_cache_alloc+0x12e/0x760 [ 431.375147] ? getname_flags+0xd0/0x5a0 [ 431.379112] ? user_path_at_empty+0x2d/0x50 [ 431.383436] ? do_mount+0x180/0x1fb0 [ 431.387145] path_lookupat.isra.45+0x202/0xbf0 [ 431.391733] ? path_parentat.isra.43+0x160/0x160 [ 431.396507] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 431.401710] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 431.406730] ? __check_object_size+0xa3/0x5d7 [ 431.411230] ? usercopy_warn+0x120/0x120 [ 431.415307] ? lock_release+0xa30/0xa30 [ 431.419286] filename_lookup+0x264/0x510 [ 431.423361] ? filename_parentat.isra.58+0x570/0x570 [ 431.428468] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 431.434010] ? mpi_free.cold.1+0x19/0x19 [ 431.438079] ? kasan_check_read+0x11/0x20 [ 431.442233] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 431.447776] ? getname_flags+0x26e/0x5a0 [ 431.451839] user_path_at_empty+0x40/0x50 [ 431.455992] do_mount+0x180/0x1fb0 [ 431.459544] ? check_same_owner+0x340/0x340 [ 431.463970] ? copy_mount_string+0x40/0x40 [ 431.468209] ? retint_kernel+0x10/0x10 [ 431.472100] ? copy_mount_options+0x1e3/0x380 [ 431.476602] ? audit_kill_trees+0x450/0x450 [ 431.480926] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 431.486466] ? copy_mount_options+0x285/0x380 [ 431.490965] ksys_mount+0x12d/0x140 [ 431.494598] __x64_sys_mount+0xbe/0x150 [ 431.498576] do_syscall_64+0x1b9/0x820 [ 431.502464] ? syscall_return_slowpath+0x5e0/0x5e0 [ 431.507394] ? syscall_return_slowpath+0x31d/0x5e0 [ 431.512326] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 431.517350] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 431.522212] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 431.527412] RIP: 0033:0x455ab9 [ 431.530591] Code: e0 1f 48 89 04 24 e8 b6 6f fd ff e8 81 6a fd ff e8 5c 68 fd ff 48 8d 05 92 9a 48 00 48 89 04 24 48 c7 44 24 08 1d 00 00 00 e8 <13> 5e fd ff 0f 0b e8 8c 44 00 00 e9 07 f0 ff ff cc cc cc cc cc cc [ 431.549746] RSP: 002b:00007f3afd959c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 431.557467] RAX: ffffffffffffffda RBX: 00007f3afd95a6d4 RCX: 0000000000455ab9 [ 431.564730] RDX: 0000000020000080 RSI: 0000000020000000 RDI: 0000000000000000 [ 431.571991] RBP: 000000000072bff0 R08: 0000000020000700 R09: 0000000000000000 [ 431.579256] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 431.586629] R13: 00000000004c025d R14: 00000000004cfef8 R15: 0000000000000002 [ 431.593900] INFO: lockdep is turned off. [ 431.597949] NMI backtrace for cpu 1 [ 431.601570] CPU: 1 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4-next-20180713+ #7 [ 431.610116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 431.619444] Call Trace: [ 431.622012] dump_stack+0x1c9/0x2b4 [ 431.625615] ? dump_stack_print_info.cold.2+0x52/0x52 [ 431.630784] ? vprintk_default+0x28/0x30 [ 431.634832] ? lapic_can_unplug_cpu.cold.28+0x3f/0x3f [ 431.640013] nmi_cpu_backtrace.cold.3+0x48/0x88 [ 431.644672] ? lapic_can_unplug_cpu.cold.28+0x3f/0x3f [ 431.649844] nmi_trigger_cpumask_backtrace+0x151/0x192 [ 431.655111] arch_trigger_cpumask_backtrace+0x14/0x20 [ 431.660291] watchdog+0xb81/0x10f0 [ 431.663822] ? reset_hung_task_detector+0xd0/0xd0 [ 431.668655] ? find_held_lock+0x36/0x1c0 [ 431.672738] ? kasan_check_read+0x11/0x20 [ 431.676866] ? do_raw_spin_unlock+0xa7/0x2f0 [ 431.681266] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 431.686346] ? __kthread_parkme+0x58/0x1b0 [ 431.690562] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 431.695559] ? trace_hardirqs_on+0xd/0x10 [ 431.699686] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 431.705201] ? __kthread_parkme+0x106/0x1b0 [ 431.709497] kthread+0x345/0x410 [ 431.712841] ? reset_hung_task_detector+0xd0/0xd0 [ 431.717655] ? kthread_bind+0x40/0x40 [ 431.721431] ret_from_fork+0x3a/0x50 [ 431.725152] Sending NMI from CPU 1 to CPUs 0: [ 431.729673] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10 [ 431.730644] Kernel panic - not syncing: hung_task: blocked tasks [ 431.743348] CPU: 1 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4-next-20180713+ #7 [ 431.751294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 431.760623] Call Trace: [ 431.763190] dump_stack+0x1c9/0x2b4 [ 431.766793] ? dump_stack_print_info.cold.2+0x52/0x52 [ 431.771966] ? printk_safe_log_store+0x2f0/0x2f0 [ 431.776702] panic+0x238/0x4e7 [ 431.779872] ? add_taint.cold.5+0x16/0x16 [ 431.784004] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 431.789521] ? nmi_trigger_cpumask_backtrace+0x13a/0x192 [ 431.794952] ? printk_safe_flush+0xd7/0x130 [ 431.799252] watchdog+0xb92/0x10f0 [ 431.802776] ? reset_hung_task_detector+0xd0/0xd0 [ 431.807603] ? find_held_lock+0x36/0x1c0 [ 431.811657] ? kasan_check_read+0x11/0x20 [ 431.815779] ? do_raw_spin_unlock+0xa7/0x2f0 [ 431.820167] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 431.825245] ? __kthread_parkme+0x58/0x1b0 [ 431.829466] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 431.834459] ? trace_hardirqs_on+0xd/0x10 [ 431.838582] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 431.844096] ? __kthread_parkme+0x106/0x1b0 [ 431.848393] kthread+0x345/0x410 [ 431.851734] ? reset_hung_task_detector+0xd0/0xd0 [ 431.856548] ? kthread_bind+0x40/0x40 [ 431.860328] ret_from_fork+0x3a/0x50 [ 431.864459] Dumping ftrace buffer: [ 431.867976] (ftrace buffer empty) [ 431.871659] Kernel Offset: disabled [ 431.875261] Rebooting in 86400 seconds..