0x5d) [ 380.828046][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.851584][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:18 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000e3, 0x0) 10:37:18 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x7fd) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000080)) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x30e00, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x0, 0x0) creat(&(0x7f0000000380)='./file0\x00', 0x18) socket$isdn_base(0x22, 0x3, 0x0) ioctl$VIDIOC_DQEVENT(r3, 0x80885659, &(0x7f0000000280)={0x0, @motion_det}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0000000000000000f05d7624fff2577a67bd02d298e9940dbfd5fd654baee0bd007b6c85b49eea479e"], 0x0, 0x0, 0x0}) write$P9_RSTATFS(r3, &(0x7f0000000200)={0x43, 0x9, 0x1, {0x3, 0x8, 0x4, 0x7, 0x3ff, 0x33, 0x9, 0x7}}, 0x43) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\vc\x00@'], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:18 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:18 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, 0xffffffffffffffff) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0xfffffdee, 0x0, &(0x7f0000000080)="86a4f0"}) 10:37:18 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000e4, 0x0) [ 381.193924][T18116] binder: 18115:18116 unknown command 1073767179 [ 381.228424][T18126] binder: 18119:18126 ERROR: BC_REGISTER_LOOPER called without request [ 381.230470][T18116] binder: 18115:18116 ioctl c0306201 20000140 returned -22 10:37:18 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000e5, 0x0) [ 381.276234][ T22] binder: release 18119:18126 transaction 733 out, still active [ 381.306023][ T22] binder: undelivered TRANSACTION_COMPLETE 10:37:19 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(0x0, 0x0, 0x5d) 10:37:19 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) [ 381.324001][T18132] binder_alloc: binder_alloc_mmap_handler: 18115 20001000-20004000 already mapped failed -16 10:37:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0xfffffdee, 0x0, &(0x7f0000000080)="86a4f0"}) [ 381.373867][ T22] binder: release 18119:18126 transaction 733 in, still active [ 381.401198][T18132] binder: 18115:18132 unknown command 1073767179 [ 381.411315][ T22] binder: send failed reply for transaction 733, target dead 10:37:19 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000e6, 0x0) 10:37:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 381.436239][T18132] binder: 18115:18132 ioctl c0306201 20000140 returned -22 [ 381.476280][T18144] binder: 18143:18144 ERROR: BC_REGISTER_LOOPER called without request [ 381.537060][ T22] binder: release 18143:18144 transaction 735 out, still active [ 381.581122][ T22] binder: undelivered TRANSACTION_COMPLETE [ 381.596419][T18151] binder: BINDER_SET_CONTEXT_MGR already set [ 381.629991][T18151] binder: 18150:18151 ioctl 40046207 0 returned -16 [ 381.643961][T18151] binder: 18150:18151 ERROR: BC_REGISTER_LOOPER called without request [ 381.645007][ T22] binder: release 18143:18144 transaction 735 in, still active 10:37:19 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040), 0x10) ftruncate(r1, 0x200004) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000000180)) sendfile(r0, r1, 0x0, 0x80003f000000) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000000), 0x1) socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus/file0\x00', 0xa800, 0x20) 10:37:19 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(0x0, 0x0, 0x5d) 10:37:19 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000e7, 0x0) [ 381.674205][ T22] binder: send failed reply for transaction 735, target dead [ 381.692094][ T22] binder: send failed reply for transaction 736 to 18150:18155 10:37:19 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0xfffffdee, 0x0, &(0x7f0000000080)="86a4f0"}) 10:37:19 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000e8, 0x0) [ 381.784880][T18166] binder: 18164:18166 ERROR: BC_REGISTER_LOOPER called without request [ 381.818320][ T22] binder: release 18164:18166 transaction 738 out, still active [ 381.833598][ T22] binder: undelivered TRANSACTION_COMPLETE 10:37:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:19 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(0x0, 0x0, 0x5d) [ 381.857029][ T22] binder: release 18164:18166 transaction 738 in, still active [ 381.887278][ T22] binder: send failed reply for transaction 738, target dead 10:37:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r0, 0xffffffffffffffff) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) 10:37:19 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000e9, 0x0) [ 381.971099][ T5] binder: release 18174:18175 transaction 740 out, still active [ 381.988417][ T5] binder: undelivered TRANSACTION_COMPLETE 10:37:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 382.055628][ T5] binder: send failed reply for transaction 740, target dead [ 382.143705][T18190] binder: 18189:18190 transaction failed 29189/-22, size 0-0 line 2995 [ 382.160844][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:20 executing program 4: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000080)=0x0) sched_setparam(r1, &(0x7f00000000c0)=0xffff) dup2(r0, r0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="46ae1ab9477290b166ab0334973f92150d7f38801d15515610a807907f17005e32"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:20 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000ea, 0x0) 10:37:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r0, 0xffffffffffffffff) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) 10:37:20 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000), 0x0, 0x5d) 10:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:20 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0xfffffffffffffc01, 0x101000) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 382.360388][T18197] binder_alloc: binder_alloc_mmap_handler: 18150 20001000-20004000 already mapped failed -16 [ 382.370833][T18197] binder_alloc: 18150: binder_alloc_buf, no vma [ 382.377116][T18197] binder: 18150:18197 transaction failed 29189/-3, size 0-0 line 3148 [ 382.385543][ T5] binder: undelivered TRANSACTION_COMPLETE [ 382.385843][T18155] binder: 18150:18155 ERROR: BC_REGISTER_LOOPER called without request 10:37:20 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000eb, 0x0) [ 382.448310][T18201] binder: 18200:18201 transaction failed 29189/-22, size 0-0 line 2995 10:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x800, 0x4000) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, &(0x7f00000000c0)={0x3, 0x0, [{}, {}, {}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:20 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000), 0x0, 0x5d) 10:37:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r0, 0xffffffffffffffff) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) [ 382.647032][T18225] binder: 18218:18225 transaction failed 29189/-22, size 0-0 line 2995 [ 382.667902][T18222] binder: 18221:18222 ERROR: BC_REGISTER_LOOPER called without request [ 382.690489][ T5] binder_release_work: 3 callbacks suppressed 10:37:20 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000ec, 0x0) [ 382.690496][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 382.741715][T18232] binder_alloc: binder_alloc_mmap_handler: 18221 20001000-20004000 already mapped failed -16 [ 382.767116][T18222] binder: BINDER_SET_CONTEXT_MGR already set 10:37:20 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000ed, 0x0) 10:37:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:20 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000), 0x0, 0x5d) [ 382.848496][T18222] binder: 18221:18222 ioctl 40046207 0 returned -16 [ 382.849155][T18238] binder_alloc: 18221: binder_alloc_buf, no vma [ 382.915431][T18242] binder: BINDER_SET_CONTEXT_MGR already set [ 382.937221][ T22] binder: release 18221:18222 transaction 747 out, still active [ 382.946297][T18242] binder: 18241:18242 ioctl 40046207 0 returned -16 [ 382.954657][ T22] binder: undelivered TRANSACTION_COMPLETE 10:37:20 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000ee, 0x0) [ 382.956915][T18238] binder: 18221:18238 transaction failed 29189/-3, size 0-0 line 3148 [ 382.965740][ T22] binder: send failed reply for transaction 747, target dead [ 382.980781][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.008846][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:20 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x80000000016) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r1, 0xab07, 0x1) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x100, 0x0) 10:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:20 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) 10:37:20 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000ef, 0x0) [ 383.123158][T18259] binder: 18256:18259 ERROR: BC_REGISTER_LOOPER called without request [ 383.156118][T18263] binder: BINDER_SET_CONTEXT_MGR already set [ 383.166608][T18263] binder: 18260:18263 ioctl 40046207 0 returned -16 10:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 383.205703][T18274] binder_alloc: binder_alloc_mmap_handler: 18256 20001000-20004000 already mapped failed -16 [ 383.226430][T18276] binder_alloc: 18256: binder_alloc_buf, no vma [ 383.240444][T18259] binder: BINDER_SET_CONTEXT_MGR already set 10:37:21 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x2) [ 383.282335][T18259] binder: 18256:18259 ioctl 40046207 0 returned -16 [ 383.282382][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.294325][T18272] binder_alloc: 18256: binder_alloc_buf, no vma 10:37:21 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:21 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) [ 383.342946][T18282] binder: BINDER_SET_CONTEXT_MGR already set [ 383.386762][ T5] binder: undelivered TRANSACTION_COMPLETE [ 383.392914][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.404070][T18282] binder: 18281:18282 ioctl 40046207 0 returned -16 [ 383.404352][T18289] binder_alloc: 18256: binder_alloc_buf, no vma 10:37:21 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x9) 10:37:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000900)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @multicast1}}, 0x24) syz_emit_ethernet(0x2a, &(0x7f0000359fd5)={@random="e187a48d30b3", @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 383.433300][ T5] binder: send failed reply for transaction 751, target dead [ 383.483641][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.583519][T18303] binder_alloc: binder_alloc_mmap_handler: 18299 20001000-20004000 already mapped failed -16 [ 383.602515][T18300] binder: BINDER_SET_CONTEXT_MGR already set [ 383.609130][T18303] binder_alloc: 18299: binder_alloc_buf, no vma [ 383.615530][T18300] binder: 18299:18300 ioctl 40046207 0 returned -16 [ 383.624500][ T22] binder: undelivered TRANSACTION_COMPLETE [ 383.631770][ T22] binder: send failed reply for transaction 756, target dead [ 383.642803][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:21 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x40, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:21 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x1e) 10:37:21 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) 10:37:21 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 384.087781][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 384.091110][T18320] binder_alloc: binder_alloc_mmap_handler: 18310 20001000-20004000 already mapped failed -16 [ 384.106139][T18319] binder: BINDER_SET_CONTEXT_MGR already set [ 384.118113][T18319] binder: 18310:18319 ioctl 40046207 0 returned -16 10:37:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:21 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x5e) [ 384.132783][T18320] binder_alloc: 18310: binder_alloc_buf, no vma [ 384.142594][ T22] binder: undelivered TRANSACTION_COMPLETE [ 384.150023][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 384.172209][ T22] binder: send failed reply for transaction 760, target dead 10:37:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xb) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:21 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:21 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 10:37:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:22 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x4) fstat(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@empty, @in6=@remote, 0x4e20, 0x5, 0x4e23, 0x7fff, 0x2, 0x80, 0x0, 0x0, 0x0, r2}, {0x20200, 0x5, 0x1, 0xe1c3, 0x20, 0x3, 0x5, 0x6}, {0x4, 0x18, 0x2, 0x9}, 0x100000000, 0x0, 0x0, 0x0, 0x1}, {{@in6=@mcast1, 0x4d3, 0x3c}, 0x0, @in6=@loopback, 0x3505, 0x2, 0x3, 0x3, 0xf82, 0x8, 0x4}}, 0xe8) ioctl$KVM_SET_XCRS(r0, 0x4188aea7, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000002000000580000000000000000000000000000001e070000000000000000000001000000"]) r3 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x42) ftruncate(r3, 0x200004) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, r3, 0xfffffffffffffffb, 0x2}, 0xa) sendfile(r0, r1, 0x0, 0x80003f000001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, &(0x7f00000000c0)={'bond0\x00', {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 384.251526][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 384.334225][T18340] binder_alloc: binder_alloc_mmap_handler: 18332 20001000-20004000 already mapped failed -16 10:37:22 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 10:37:22 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x900) [ 384.405197][T18334] binder: BINDER_SET_CONTEXT_MGR already set [ 384.448461][T18334] binder: 18332:18334 ioctl 40046207 0 returned -16 [ 384.463070][T18347] binder_alloc: 18332: binder_alloc_buf, no vma [ 384.472621][T18340] binder_alloc: 18332: binder_alloc_buf, no vma [ 384.479709][T18347] binder_transaction: 8 callbacks suppressed [ 384.479726][T18347] binder: 18346:18347 transaction failed 29189/-3, size 0-0 line 3148 10:37:22 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x101000) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000000c0)={0x5, 0x5, 0x8001, 0x2, 0x2, 0x6, 0x1}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind(r2, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) r3 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x200004) sendfile(r1, r3, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x800000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000180)={0x8, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 10:37:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) [ 384.496581][T18340] binder: 18332:18340 transaction failed 29189/-3, size 0-0 line 3148 [ 384.498802][ T5] binder_thread_release: 7 callbacks suppressed [ 384.498813][ T5] binder: release 18332:18334 transaction 764 out, still active 10:37:22 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 10:37:22 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x1e00) 10:37:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) epoll_create(0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 384.579879][ T5] binder: undelivered TRANSACTION_COMPLETE [ 384.585853][ T5] binder: release 18332:18334 transaction 764 in, still active 10:37:22 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 384.648106][ T5] binder: send failed reply for transaction 764, target dead 10:37:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, 0xffffffffffffffff) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 384.726358][T18374] binder_alloc: binder_alloc_mmap_handler: 18371 20001000-20004000 already mapped failed -16 10:37:22 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:22 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x5e00) [ 384.788020][T18373] binder: BINDER_SET_CONTEXT_MGR already set [ 384.814376][T18373] binder: 18371:18373 ioctl 40046207 0 returned -16 [ 384.845235][T18384] binder_alloc: 18371: binder_alloc_buf, no vma [ 384.874515][T18385] binder: 18383:18385 transaction failed 29189/-3, size 0-0 line 3148 [ 384.883463][T18384] binder: 18371:18384 transaction failed 29189/-3, size 0-0 line 3148 10:37:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, 0xffffffffffffffff) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:22 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x30020) [ 384.915538][ T22] binder: release 18371:18373 transaction 768 out, still active [ 384.945384][ T22] binder: undelivered TRANSACTION_COMPLETE [ 384.988014][ T22] binder: release 18371:18373 transaction 768 in, still active 10:37:22 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x400000000000a) r2 = fcntl$dupfd(r1, 0x406, r0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000000)={0x2, 0x5, 0x8, 0xfffffffffffffffd, 0x1ff, 0x6eb, 0x7, 0x1000, 0x0}, &(0x7f0000000040)=0x20) setsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f00000000c0)={r3, 0x4ee, 0x7f, 0xa9d}, 0x10) r4 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x200004) sendfile(r0, r4, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x6, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000100)=[@in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e24, 0x400, @remote}, @in6={0xa, 0x4e22, 0x3ff, @mcast1, 0x4}, @in6={0xa, 0x4e24, 0xd26, @dev={0xfe, 0x80, [], 0x26}, 0x3}, @in={0x2, 0x4e20, @rand_addr=0x5}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x25}}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}], 0xa4) 10:37:22 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000300)=""/185) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vfio/vfio\x00', 0x1, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xb8, r3, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x81}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @multicast1}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_1\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3c}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) 10:37:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, 0xffffffffffffffff) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x5d) 10:37:22 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0xf0ff7f) [ 385.295398][ T22] binder: release 18403:18404 transaction 772 out, still active [ 385.299236][T18409] binder: 18406:18409 ioctl 80084504 20000300 returned -22 [ 385.316176][ T22] binder: undelivered TRANSACTION_COMPLETE [ 385.325294][T18409] binder: BINDER_SET_CONTEXT_MGR already set 10:37:23 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x1000000) [ 385.342259][T18409] binder: 18406:18409 ioctl 40046207 0 returned -16 [ 385.356197][T18409] binder_thread_write: 8 callbacks suppressed [ 385.356206][T18409] binder: 18406:18409 ERROR: BC_REGISTER_LOOPER called without request 10:37:23 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000900)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @multicast1}}, 0x24) syz_emit_ethernet(0x2a, &(0x7f0000359fd5)={@random="e187a48d30b3", @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:23 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(0x0, 0x0, 0x5d) [ 385.398664][ T22] binder: release 18403:18404 transaction 772 in, still active [ 385.425684][ T22] binder_send_failed_reply: 1 callbacks suppressed [ 385.425693][ T22] binder: send failed reply for transaction 772, target dead [ 385.478289][ T22] binder: send failed reply for transaction 773 to 18406:18409 10:37:23 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:23 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x2000000) [ 385.551247][T18429] binder: 18428:18429 ERROR: BC_REGISTER_LOOPER called without request [ 385.612309][ T22] binder: release 18428:18429 transaction 775 out, still active [ 385.624041][ T22] binder: undelivered TRANSACTION_COMPLETE [ 385.658475][ T22] binder: release 18428:18429 transaction 775 in, still active [ 385.699335][ T22] binder: send failed reply for transaction 775, target dead 10:37:23 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) signalfd4(r0, &(0x7f0000000040)={0x8}, 0x8, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = fcntl$getown(r1, 0x9) perf_event_open(&(0x7f00000000c0)={0x7, 0x70, 0x4, 0x3, 0x4f5, 0x10001, 0x0, 0x5, 0x0, 0x4, 0x6, 0x3, 0x3, 0x2, 0x9, 0x2, 0x9, 0x81, 0x1, 0x6, 0x8, 0x819, 0xfffffffffffffffe, 0x1, 0x20, 0x2, 0x8, 0x7, 0x9, 0xc3, 0x100000001, 0x8, 0x4, 0x4, 0x6, 0x200, 0x5, 0xb8b, 0x0, 0x6, 0x0, @perf_bp={&(0x7f0000000000), 0x4}, 0x20, 0x40, 0x4, 0x4, 0xfffffffffffffff9, 0x7, 0x400}, r3, 0xc, 0xffffffffffffffff, 0x8) 10:37:23 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 386.074638][T18453] binder_alloc: binder_alloc_mmap_handler: 18406 20001000-20004000 already mapped failed -16 [ 386.085393][T18418] binder: 18406:18418 ioctl 80084504 20000300 returned -22 [ 386.093008][T18453] binder: 18406:18453 ERROR: BC_REGISTER_LOOPER called without request [ 386.103368][T18418] binder: 18406:18418 transaction failed 29189/-3, size 0-0 line 3148 10:37:23 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x9000000) 10:37:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:23 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(0x0, 0x0, 0x5d) 10:37:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x9, 0x4000) write$nbd(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="6744669801000000030004000400000012edbaba4a693e9a75eeaab6030000001d8511bfa5b4415d1f04e485b1f3b8091390a1b031360527659b094af0366b4de1a1100a31d825a2107a4647dec001aeffffffff0e975100006510839c60d5cc56"], 0x6e) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f00000000c0)=0xbd7, 0x4) r3 = shmget$private(0x0, 0x4000, 0xc, &(0x7f0000001000/0x4000)=nil) shmat(r3, &(0x7f0000001000/0x2000)=nil, 0x1000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="000000000000000078c4a76be1999834bb4e501ed9166b4429c6e60d73ead7cf3c8c3f8841fcbedcbfa70bf3b144034d35df5eed12a33a8c"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000100)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000280)={r4, 0x90}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000340)={0x1, 0x1, {0x11, 0x6, 0xa, 0xe, 0xa, 0x70a, 0x2, 0x32}}) 10:37:23 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000000)=0x7) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 386.147942][ T22] binder: undelivered TRANSACTION_COMPLETE [ 386.172145][T18456] binder: 18455:18456 transaction failed 29189/-3, size 0-0 line 3148 [ 386.196448][T18464] binder: BINDER_SET_CONTEXT_MGR already set [ 386.216814][T18464] binder: 18463:18464 ioctl 40046207 0 returned -16 [ 386.237348][T18464] binder: 18463:18464 transaction failed 29189/-3, size 0-0 line 3148 10:37:23 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x1e000000) 10:37:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x6800000000000000, &(0x7f0000000040)="f0"}) [ 386.260039][T18468] binder: 18466:18468 transaction failed 29201/-22, size -3470047207990311383--2540315781401441220 line 3148 10:37:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(0x0, 0x0, 0x5d) [ 386.315010][T18468] binder: 18466:18468 ERROR: BC_REGISTER_LOOPER called without request [ 386.405762][T18480] binder: BINDER_SET_CONTEXT_MGR already set [ 386.423283][T18480] binder: 18478:18480 ioctl 40046207 0 returned -16 [ 386.433296][T18482] binder: BINDER_SET_CONTEXT_MGR already set 10:37:24 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x20000140) [ 386.455477][T18482] binder: 18473:18482 ioctl 40046207 0 returned -16 [ 386.457707][ T5] binder: release 18478:18480 transaction 783 out, still active [ 386.464984][T18479] binder: BINDER_SET_CONTEXT_MGR already set [ 386.477375][T18479] binder: 18466:18479 ioctl 40046207 0 returned -16 [ 386.486263][T18468] binder: 18466:18468 transaction failed 29189/-3, size -3470047207990311383--2540315781401441220 line 3148 [ 386.499099][T18485] binder: 18473:18485 transaction failed 29189/-3, size 0-0 line 3148 [ 386.507784][T18484] binder: 18466:18484 ERROR: BC_REGISTER_LOOPER called without request [ 386.513320][ T5] binder: undelivered TRANSACTION_COMPLETE [ 386.522634][T18482] binder: 18473:18482 ERROR: BC_REGISTER_LOOPER called without request 10:37:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 386.550955][ T5] binder: release 18466:18468 transaction 783 in, still active [ 386.566841][ T5] binder: send failed reply for transaction 783, target dead 10:37:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)=@random={'os2.', '/dev/binder#\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffd06, 0x0, &(0x7f0000000200)=ANY=[], 0xfffffffffffffefe, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000), 0x0, 0x5d) 10:37:24 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x20000180) 10:37:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:24 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) prctl$PR_SET_FPEXC(0xc, 0x40000) close(r0) r1 = syz_open_dev$midi(&(0x7f0000000300)='/dev/midi#\x00', 0x0, 0x480) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000340)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f00000003c0)={0x7, 0x8, 0xfa00, {r2, 0x5}}, 0x10) socket$netlink(0x10, 0x3, 0x400000000000a) r3 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x200004) sendfile(r3, r3, 0x0, 0x80003f000000) getsockopt$inet6_int(r3, 0x29, 0x5b, &(0x7f0000000000), &(0x7f0000000040)=0x4) openat$dsp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/dsp\x00', 0x20000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_BT_SNDMTU(r3, 0x112, 0xc, &(0x7f00000000c0)=0xe37, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000200)={r0, r0, 0x5, 0xd6, &(0x7f0000000100)="e55c8d0894c6a11021bb32a513fd7718e9e3dfd9cbd4f36afddcda50e928277ea7c9051ba63c81e3cf7cbd96005f8382a323ba8262f667a5e800cfd916d9da2bfb99638fe19df517a1ec608af44ea2af043133fccbf0d78594aea505472701c628a69a6b910ce75c26c75aa067241cdc2e4feeca75e7dca54333925ebdaa15d02f26e5f75920332c89ebb54164929f1377c67870ac19dd2019d9892eb2f7239a25dd6467ed72476bf0fd0ff1797ba9bffdc0938eca8f745f39ee29e27ea5636c7c5c82157a25c3d78fe5ffb20073b7b517b768d79dab", 0x6, 0x5, 0x5, 0x4, 0x5, 0x3, 0x4, 'syz1\x00'}) [ 386.703293][T18498] binder: 18495:18498 ioctl c0306201 20000180 returned -14 [ 386.723808][T18498] binder: 18495:18498 ERROR: BC_REGISTER_LOOPER called without request [ 386.779359][T18502] binder: BINDER_SET_CONTEXT_MGR already set 10:37:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000), 0x0, 0x5d) 10:37:24 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x20000300) [ 386.821151][T18502] binder: 18501:18502 ioctl 40046207 0 returned -16 [ 386.856917][T18512] binder_alloc: binder_alloc_mmap_handler: 18495 20001000-20004000 already mapped failed -16 [ 386.890922][T18512] binder: BINDER_SET_CONTEXT_MGR already set [ 386.897860][T18498] binder: 18495:18498 ioctl c0306201 20000180 returned -14 [ 386.908647][T18514] binder: 18495:18514 ERROR: BC_REGISTER_LOOPER called without request [ 386.917400][T18512] binder: 18495:18512 ioctl 40046207 0 returned -16 [ 386.932725][ T22] binder: send failed reply for transaction 789, target dead 10:37:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x9, 0x4000) write$nbd(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="6744669801000000030004000400000012edbaba4a693e9a75eeaab6030000001d8511bfa5b4415d1f04e485b1f3b8091390a1b031360527659b094af0366b4de1a1100a31d825a2107a4647dec001aeffffffff0e975100006510839c60d5cc56"], 0x6e) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f00000000c0)=0xbd7, 0x4) r3 = shmget$private(0x0, 0x4000, 0xc, &(0x7f0000001000/0x4000)=nil) shmat(r3, &(0x7f0000001000/0x2000)=nil, 0x1000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="000000000000000078c4a76be1999834bb4e501ed9166b4429c6e60d73ead7cf3c8c3f8841fcbedcbfa70bf3b144034d35df5eed12a33a8c"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000100)={0x1, [0x0]}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000280)={r4, 0x90}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000340)={0x1, 0x1, {0x11, 0x6, 0xa, 0xe, 0xa, 0x70a, 0x2, 0x32}}) 10:37:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:24 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x20000340) 10:37:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b630100"], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x0, 0x2) bind$pptp(r2, &(0x7f00000000c0)={0x18, 0x2, {0x3, @multicast1}}, 0x1e) 10:37:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000), 0x0, 0x5d) [ 387.257334][T18531] binder: 18525:18531 unknown command 90891 [ 387.272083][T18531] binder: 18525:18531 ioctl c0306201 20000140 returned -22 10:37:25 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x20000380) 10:37:25 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 387.304093][T18535] binder_alloc: binder_alloc_mmap_handler: 18525 20001000-20004000 already mapped failed -16 [ 387.346252][T18537] binder: BINDER_SET_CONTEXT_MGR already set [ 387.361425][T18537] binder: 18534:18537 ioctl 40046207 0 returned -16 [ 387.369107][T18531] binder: BINDER_SET_CONTEXT_MGR already set [ 387.375431][T18531] binder: 18525:18531 ioctl 40046207 0 returned -16 10:37:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) [ 387.397700][T18535] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 387.397710][T18535] binder_alloc: 18525: binder_alloc_buf, no vma [ 387.418913][ T5] binder: send failed reply for transaction 791, target dead [ 387.434668][ T5] binder: send failed reply for transaction 792, target dead 10:37:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x5, 0x800) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000000c0)={0x0, @multicast2}, &(0x7f0000000100)=0xc) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x5) [ 387.464189][T18537] binder: 18534:18537 ERROR: BC_REGISTER_LOOPER called without request 10:37:25 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$nfc_llcp(r1, 0x0, &(0x7f0000000000), 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:25 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x20000480) 10:37:25 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000280)='/dev/usbmon#\x00', 0x9, 0x20000) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f00000002c0)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0xff, 0x100}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000001c0)={r3, @in6={{0xa, 0x4e20, 0x9, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x5}}, 0x1c, 0x5565, 0x5, 0x8, 0x50}, &(0x7f0000000100)=0x98) 10:37:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) 10:37:25 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x20000540) 10:37:25 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:25 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000440)='/dev/vhost-vsock\x00', 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$security_capability(r0, &(0x7f0000000480)='security.capability\x00', &(0x7f0000000540)=@v3={0x3000000, [{0xad, 0x8}, {0xa70, 0xffffffff}], r1}, 0x18, 0x1) r2 = socket$inet6(0xa, 0x400000000001, 0x0) close(r2) socket$netlink(0x10, 0x3, 0x400000000000a) r3 = open(&(0x7f0000000080)='./bus\x00', 0x80, 0x0) ftruncate(r3, 0x200006) sendfile(r2, r3, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x44200}, 0xc, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="200000003200100027bd7000ffdbdf30445934c663f473802325000000000c10b4969ad8e216553230c8694875ab6baff737fc9e3662c2e96e"], 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x1) accept$unix(r3, &(0x7f0000000240)=@abs, &(0x7f0000000300)=0x6e) ioctl$TCFLSH(r3, 0x540b, 0x20) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000400)={&(0x7f0000000040)='./bus\x00', r3}, 0x10) accept$alg(r3, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x117, 0x4}}, 0x20) ioctl$KVM_GET_DEVICE_ATTR(r3, 0x4018aee2, &(0x7f0000000380)={0x0, 0x263e1a7e, 0x0, &(0x7f0000000340)=0x100}) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000200)={0x1, 0x10, 0xfa00, {&(0x7f0000000140), r5}}, 0x18) [ 388.104457][ T22] binder_release_work: 15 callbacks suppressed [ 388.104462][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.167150][T18578] binder: 18571:18578 ERROR: BC_REGISTER_LOOPER called without request 10:37:25 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x40010020) 10:37:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 388.210127][T18586] binder: BINDER_SET_CONTEXT_MGR already set [ 388.216189][T18586] binder: 18571:18586 ioctl 40046207 0 returned -16 [ 388.218523][T18584] binder: BINDER_SET_CONTEXT_MGR already set 10:37:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{}], 0x1, 0x5d) [ 388.293019][T18587] binder_alloc: 18571: binder_alloc_buf, no vma [ 388.293988][ T22] binder_release_work: 3 callbacks suppressed [ 388.293993][ T22] binder: undelivered TRANSACTION_COMPLETE [ 388.305228][T18584] binder: 18583:18584 ioctl 40046207 0 returned -16 [ 388.307992][ T22] binder: send failed reply for transaction 798, target dead 10:37:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm-control\x00', 0x2, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = semget$private(0x0, 0x3, 0x200) semctl$IPC_RMID(r3, 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x20000, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000480)='/proc/self/net/pfkey\x00', 0x18000, 0x0) ioctl$IOC_PR_CLEAR(r4, 0x401070cd, &(0x7f00000000c0)={0x2}) write$binfmt_elf64(r1, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x356, 0x100000001, 0x1000, 0x6, 0x3, 0x7, 0x1, 0x9b, 0x40, 0x1c1, 0x8, 0x8, 0x38, 0x1, 0x6, 0x8, 0xab}, [{0x1, 0x7f, 0x3, 0x3, 0x5, 0x7, 0x9, 0x200}, {0x60000000, 0x1, 0xda4, 0x7, 0x101, 0x5, 0x1f, 0xa0a8}], "97914fd5f50654684971a8a28649944bfd607312970a4a97a6adf369eab80d197a1a3a677c3dd5aa6d919b00b9884e8fd0639b2e3e6709b79c0f37bac7c69b173279b67e7c1fb4b84b7aca374c49c7014e5432016c2954501de32fe633bd83f65ac8f6b2086010a7c4fc4c0a09cfbca0671b5865370e4c54fc14af6235536219b4d226e38e38ddebfd21321484e14ef56e60a61f44bb75b8166773d77951354f3349ff7daa", [[]]}, 0x255) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$TIOCCBRK(r4, 0x5428) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:26 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f00000000c0)={0x6, 0x1, 0x6, 'queue0\x00', 0x1}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x5) socket$inet6_udplite(0xa, 0x2, 0x88) sendfile(r2, r0, 0x0, 0xffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 388.376372][T18594] binder_alloc: 18571: binder_alloc_buf, no vma [ 388.382784][T18599] binder: 18596:18599 ioctl c0306201 0 returned -14 [ 388.390148][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:26 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x40030020) [ 388.463452][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:26 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 10:37:26 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x39a3122fa88b819c, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000000040)=0x29b, 0x8) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 388.526992][T18605] binder_alloc: 18604: binder_alloc_buf, no vma 10:37:26 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x40050020) [ 388.595771][T18620] binder: 18614:18620 ioctl c0306201 0 returned -14 10:37:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 10:37:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:26 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x57dcff7f) 10:37:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x0, 0x0) dup2(r1, r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) [ 388.829655][T18636] binder: 18635:18636 ioctl c0306201 0 returned -14 10:37:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x5) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:27 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x57ecff7f) 10:37:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10:37:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x300000000000000, &(0x7f0000000040)="f0"}) 10:37:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x100000000000000, &(0x7f0000000040)="f0"}) 10:37:27 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x50000, 0x0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x7) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r1, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 389.260977][T18617] binder: BINDER_SET_CONTEXT_MGR already set [ 389.267046][T18617] binder: 18604:18617 ioctl 40046207 0 returned -16 [ 389.268727][T18650] binder_alloc: 18604: binder_alloc_buf, no vma [ 389.274784][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 389.287033][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:27 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x5e000000) 10:37:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 389.436062][T18667] binder: send failed reply for transaction 805 to 18655:18667 [ 389.444584][T18664] binder: BINDER_SET_CONTEXT_MGR already set [ 389.453592][T18667] binder: 18655:18667 ioctl c0306201 20000140 returned -14 [ 389.456989][T18669] binder: BINDER_SET_CONTEXT_MGR already set 10:37:27 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x7fffdc57) [ 389.485298][T18664] binder: 18653:18664 ioctl 40046207 0 returned -16 [ 389.486352][T18669] binder: 18665:18669 ioctl 40046207 0 returned -16 [ 389.492252][ T22] binder: undelivered TRANSACTION_COMPLETE [ 389.520323][ T22] binder: undelivered TRANSACTION_ERROR: 29201 10:37:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x100000000000000, &(0x7f0000000040)="f0"}) [ 389.537107][ T5] binder_thread_release: 6 callbacks suppressed [ 389.537119][ T5] binder: release 18653:18672 transaction 806 out, still active [ 389.568162][T18673] binder_alloc: 18655: binder_alloc_buf, no vma [ 389.576022][T18673] binder_transaction: 9 callbacks suppressed 10:37:27 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 389.576040][T18673] binder: 18665:18673 transaction failed 29189/-3, size 0-0 line 3148 [ 389.593567][ T5] binder: undelivered TRANSACTION_COMPLETE [ 389.621191][ T5] binder: send failed reply for transaction 806, target dead 10:37:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 389.651092][T18669] binder_alloc: 18665: binder_alloc_buf, no vma [ 389.677969][T18669] binder: 18665:18669 transaction failed 29189/-3, size 0-0 line 3148 [ 389.688205][T18685] binder: BINDER_SET_CONTEXT_MGR already set [ 389.694221][T18685] binder: 18682:18685 ioctl 40046207 0 returned -16 10:37:27 executing program 4: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) open_by_handle_at(r2, &(0x7f0000000080)={0xb8, 0x5, "974f9601164417370d53f90f3eaaba35f1e4236abf712c1e8f05187cb270c54a89f81b11b1a5128de436fb4b64ae4be7ebefd1802e9cb6821e4c0b29b5b7364308d30cbea705c24a53beeca18231c18982135757aff048385e474286cddf62e6f23c4f39704e2f454411c872eda18ba1bcda64a1252c06914965c1db5bd66114cfce3d198281e45fe371767390c9dffcad8e6e558d76cad6d481d6c633172ea896ba7f16039d1dd5043cd7ad18ce4286"}, 0x200200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:27 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x7fffec57) 10:37:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x60000000, &(0x7f0000000040)="f0"}) [ 389.732765][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 389.751448][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 389.765904][T18691] binder: 18682:18691 transaction failed 29189/-22, size 0-0 line 2995 10:37:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) [ 389.882910][T18695] binder: send failed reply for transaction 812 to 18694:18695 [ 389.911192][T18695] binder: 18694:18695 ioctl c0306201 20000140 returned -14 [ 389.922672][T18700] binder: BINDER_SET_CONTEXT_MGR already set 10:37:27 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x7ffff000) 10:37:27 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x1) [ 389.946216][T18700] binder: 18699:18700 ioctl 40046207 0 returned -16 [ 389.947511][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 389.958723][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 389.980158][ T22] binder: undelivered TRANSACTION_COMPLETE [ 389.987331][ T22] binder: undelivered TRANSACTION_ERROR: 29201 10:37:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:37:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x60000000, &(0x7f0000000040)="f0"}) 10:37:27 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x80010020) [ 390.057302][ T22] binder: send failed reply for transaction 813 to 18699:18700 [ 390.132029][T18717] binder: send failed reply for transaction 815 to 18714:18717 [ 390.160653][T18717] binder: 18714:18717 ioctl c0306201 20000140 returned -14 [ 390.187506][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 390.193382][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 390.208707][ T22] binder: undelivered TRANSACTION_COMPLETE [ 390.215181][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 390.267510][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 390.273606][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:37:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000000, &(0x7f0000000040)="f0"}) 10:37:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:37:28 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x80030020) [ 390.546360][T18734] binder_thread_write: 10 callbacks suppressed [ 390.546371][T18734] binder: 18733:18734 ERROR: BC_REGISTER_LOOPER called without request [ 390.562586][T18734] binder: send failed reply for transaction 817 to 18733:18734 [ 390.575907][T18734] binder: 18733:18734 ioctl c0306201 20000140 returned -14 [ 390.610342][ T5] binder: undelivered TRANSACTION_COMPLETE 10:37:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x60000000, &(0x7f0000000040)="f0"}) 10:37:28 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x50000000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x12c, r3, 0x210, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0xf0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x71f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x434}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2f145a4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x15}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x322}]}]}, @TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x23f51042}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x401}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x8091}, 0x4000) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) 10:37:28 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x80040020) 10:37:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:37:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000000, &(0x7f0000000040)="f0"}) [ 390.768117][ T22] binder: undelivered TRANSACTION_COMPLETE [ 390.878657][T18745] binder: 18744:18745 ERROR: BC_REGISTER_LOOPER called without request [ 390.885829][T18749] binder: BINDER_SET_CONTEXT_MGR already set [ 390.886991][T18745] binder: send failed reply for transaction 819 to 18744:18745 [ 390.887024][T18745] binder: 18744:18745 ioctl c0306201 20000140 returned -14 10:37:28 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x7ffffffff000) 10:37:28 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) open_by_handle_at(r2, &(0x7f0000000080)={0xb8, 0x5, "974f9601164417370d53f90f3eaaba35f1e4236abf712c1e8f05187cb270c54a89f81b11b1a5128de436fb4b64ae4be7ebefd1802e9cb6821e4c0b29b5b7364308d30cbea705c24a53beeca18231c18982135757aff048385e474286cddf62e6f23c4f39704e2f454411c872eda18ba1bcda64a1252c06914965c1db5bd66114cfce3d198281e45fe371767390c9dffcad8e6e558d76cad6d481d6c633172ea896ba7f16039d1dd5043cd7ad18ce4286"}, 0x200200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 390.922802][T18749] binder: 18740:18749 ioctl 40046207 0 returned -16 [ 390.943636][T18749] binder: 18740:18749 ERROR: BC_REGISTER_LOOPER called without request [ 390.944077][T18754] binder: BINDER_SET_CONTEXT_MGR already set 10:37:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000000, &(0x7f0000000040)="f0"}) [ 391.007587][T18754] binder: 18751:18754 ioctl 40046207 0 returned -16 [ 391.016273][T18760] binder: 18751:18760 unknown command 0 [ 391.022050][ T5] binder: undelivered TRANSACTION_COMPLETE [ 391.046723][ T5] binder: send failed reply for transaction 820 to 18740:18753 10:37:28 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x3002000000000) [ 391.057593][ T5] binder: send failed reply for transaction 821 to 18751:18760 [ 391.112154][T18763] binder: 18761:18763 ERROR: BC_REGISTER_LOOPER called without request [ 391.127303][T18766] binder: BINDER_SET_CONTEXT_MGR already set [ 391.131134][T18760] binder: 18751:18760 ioctl c0306201 20000140 returned -22 [ 391.160920][T18766] binder: 18765:18766 ioctl 40046207 0 returned -16 [ 391.174091][T18760] binder_alloc: binder_alloc_mmap_handler: 18751 20001000-20004000 already mapped failed -16 [ 391.178981][T18766] binder: 18765:18766 ERROR: BC_REGISTER_LOOPER called without request [ 391.198121][ T22] binder: release 18761:18763 transaction 823 out, still active [ 391.208781][ T22] binder: undelivered TRANSACTION_COMPLETE [ 391.216076][T18754] binder: BINDER_SET_CONTEXT_MGR already set [ 391.244275][ T22] binder: undelivered TRANSACTION_COMPLETE [ 391.250706][T18760] binder: 18751:18760 unknown command 0 10:37:28 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0xf0ff7f00000000) 10:37:28 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) open_by_handle_at(r2, &(0x7f0000000080)={0xb8, 0x5, "974f9601164417370d53f90f3eaaba35f1e4236abf712c1e8f05187cb270c54a89f81b11b1a5128de436fb4b64ae4be7ebefd1802e9cb6821e4c0b29b5b7364308d30cbea705c24a53beeca18231c18982135757aff048385e474286cddf62e6f23c4f39704e2f454411c872eda18ba1bcda64a1252c06914965c1db5bd66114cfce3d198281e45fe371767390c9dffcad8e6e558d76cad6d481d6c633172ea896ba7f16039d1dd5043cd7ad18ce4286"}, 0x200200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 391.264046][ T22] binder: release 18751:18760 transaction 825 out, still active [ 391.287071][T18760] binder: 18751:18760 ioctl c0306201 20000140 returned -22 [ 391.308398][ T22] binder: release 18761:18763 transaction 823 in, still active [ 391.336100][T18754] binder: 18751:18754 ioctl 40046207 0 returned -16 [ 391.359081][ T22] binder: send failed reply for transaction 823, target dead [ 391.364730][T18776] binder: 18774:18776 ERROR: BC_REGISTER_LOOPER called without request 10:37:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="cf000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000080)="f0"}) [ 391.387536][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 391.393392][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 391.409700][ T22] binder: send failed reply for transaction 824 to 18765:18769 [ 391.432097][ T22] binder: send failed reply for transaction 825, target dead [ 391.447052][ T22] binder: release 18774:18776 transaction 827 out, still active [ 391.476335][T18783] binder: BINDER_SET_CONTEXT_MGR already set [ 391.483006][T18783] binder: 18782:18783 ioctl 40046207 0 returned -16 [ 391.491378][T18783] binder: 18782:18783 unknown command 207 [ 391.495486][ T5] binder: release 18774:18776 transaction 827 in, still active [ 391.497289][T18783] binder: 18782:18783 ioctl c0306201 20000180 returned -22 [ 391.509236][ T5] binder: send failed reply for transaction 827, target dead [ 391.519855][T18783] binder: 18782:18783 ERROR: BC_REGISTER_LOOPER called without request [ 391.520994][T18784] binder_alloc: binder_alloc_mmap_handler: 18782 20001000-20004000 already mapped failed -16 [ 391.540322][T18784] binder: 18782:18784 unknown command 207 [ 391.546206][T18784] binder: 18782:18784 ioctl c0306201 20000180 returned -22 [ 391.554979][T18783] binder: 18782:18783 ERROR: BC_REGISTER_LOOPER called without request 10:37:29 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f00000000c0)={0x0, 0x2, 0xb5, &(0x7f0000000040)=0x9}) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 10:37:29 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x400000000000a) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000000)=0x401, 0x2) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x9) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FICLONE(r1, 0x40049409, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 10:37:29 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0xf0ffffff7f0000) 10:37:29 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) open_by_handle_at(r2, &(0x7f0000000080)={0xb8, 0x5, "974f9601164417370d53f90f3eaaba35f1e4236abf712c1e8f05187cb270c54a89f81b11b1a5128de436fb4b64ae4be7ebefd1802e9cb6821e4c0b29b5b7364308d30cbea705c24a53beeca18231c18982135757aff048385e474286cddf62e6f23c4f39704e2f454411c872eda18ba1bcda64a1252c06914965c1db5bd66114cfce3d198281e45fe371767390c9dffcad8e6e558d76cad6d481d6c633172ea896ba7f16039d1dd5043cd7ad18ce4286"}, 0x200200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) arch_prctl$ARCH_GET_CPUID(0x1011) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x8083, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f00000001c0)={0x8, 0x3, {0xffffffffffffffff, 0x2, 0x6, 0x3, 0x4}}) prctl$PR_SET_TSC(0x1a, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="00000000e147b841bbeb7719bf5dfc728c88920330cedb29316bb73f58565cc852543ca8fad8a3caf78f666b7d123cd6ec1bde8e4aecf249961185b2835d3684e314f760fae8e74fbe86ec70e40a060083ee04f7e7ec54a576b48a8e1c32d1a67a2f8af195e06015a853f6a597ed71d697b5e3a2835934815dcaf7c241a247a046311a65e4"], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 391.730954][T18792] binder: 18787:18792 unknown command 0 [ 391.753769][T18792] binder: 18787:18792 ioctl c0306201 20000140 returned -22 [ 391.764579][T18793] binder: 18790:18793 ERROR: BC_REGISTER_LOOPER called without request 10:37:29 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f00000000c0)=""/195) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:29 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x100000000000000) [ 391.788120][T18798] binder_alloc: binder_alloc_mmap_handler: 18787 20001000-20004000 already mapped failed -16 [ 391.840114][T18798] binder_alloc: 18787: binder_alloc_buf, no vma [ 391.858275][ T5] binder: release 18790:18793 transaction 832 out, still active [ 391.864675][T18792] binder: BINDER_SET_CONTEXT_MGR already set [ 391.904175][T18798] binder: 18787:18798 transaction failed 29189/-3, size 0-0 line 3148 10:37:29 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:29 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) open_by_handle_at(r2, &(0x7f0000000080)={0xb8, 0x5, "974f9601164417370d53f90f3eaaba35f1e4236abf712c1e8f05187cb270c54a89f81b11b1a5128de436fb4b64ae4be7ebefd1802e9cb6821e4c0b29b5b7364308d30cbea705c24a53beeca18231c18982135757aff048385e474286cddf62e6f23c4f39704e2f454411c872eda18ba1bcda64a1252c06914965c1db5bd66114cfce3d198281e45fe371767390c9dffcad8e6e558d76cad6d481d6c633172ea896ba7f16039d1dd5043cd7ad18ce4286"}, 0x200200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 391.944991][T18792] binder: 18787:18792 ioctl 40046207 0 returned -16 [ 391.945019][ T5] binder: send failed reply for transaction 830 to 18787:18792 [ 391.984652][ T5] binder: release 18790:18793 transaction 832 in, still active [ 392.009847][ T5] binder: send failed reply for transaction 832, target dead 10:37:29 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x200000000000000) 10:37:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x40) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) read(r1, &(0x7f0000000080)=""/81, 0x51) creat(&(0x7f0000000240)='./file0\x00', 0x10c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="b83871fb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x400, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x3) ioctl$CAPI_SET_FLAGS(r2, 0x80044324, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000200)={0x100, 0x64737664, 0x2, @stepwise={0x0, 0x7dda, 0x0, 0x2, 0x6, 0x7}}) 10:37:29 executing program 1: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f00000000c0)={0x0, 0x2, 0xb5, &(0x7f0000000040)=0x9}) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 392.129428][T18817] binder: 18816:18817 ERROR: BC_REGISTER_LOOPER called without request [ 392.206674][ T22] binder: release 18816:18817 transaction 835 out, still active 10:37:29 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x900000000000000) 10:37:30 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) open_by_handle_at(r2, &(0x7f0000000080)={0xb8, 0x5, "974f9601164417370d53f90f3eaaba35f1e4236abf712c1e8f05187cb270c54a89f81b11b1a5128de436fb4b64ae4be7ebefd1802e9cb6821e4c0b29b5b7364308d30cbea705c24a53beeca18231c18982135757aff048385e474286cddf62e6f23c4f39704e2f454411c872eda18ba1bcda64a1252c06914965c1db5bd66114cfce3d198281e45fe371767390c9dffcad8e6e558d76cad6d481d6c633172ea896ba7f16039d1dd5043cd7ad18ce4286"}, 0x200200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 392.285346][T18827] binder: BINDER_SET_CONTEXT_MGR already set [ 392.351904][ T22] binder: release 18816:18817 transaction 835 in, still active [ 392.361033][T18827] binder: 18826:18827 ioctl 40046207 0 returned -16 [ 392.376945][ T22] binder: send failed reply for transaction 835, target dead [ 392.422562][T18832] binder: 18826:18832 unknown command -76465992 [ 392.454917][T18832] binder: 18826:18832 ioctl c0306201 20000180 returned -22 10:37:30 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x1e00000000000000) 10:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:30 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000000)) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x80000000) 10:37:30 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 392.650639][ T5] binder: send failed reply for transaction 837, target dead 10:37:30 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x4001002000000000) 10:37:30 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000), 0x4) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 392.747203][T18849] binder: BINDER_SET_CONTEXT_MGR already set [ 392.774694][T18849] binder: 18842:18849 ioctl 40046207 0 returned -16 10:37:30 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 392.839453][ T5] binder: send failed reply for transaction 839, target dead [ 392.851427][ T5] binder: send failed reply for transaction 840 to 18842:18853 10:37:30 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x4003002000000000) [ 392.930681][T18862] binder: 18861:18862 transaction failed 29189/-22, size 0-0 line 2995 [ 393.036542][T18832] binder_alloc: binder_alloc_mmap_handler: 18826 20001000-20004000 already mapped failed -16 [ 393.067526][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 393.067568][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 393.084116][T18870] binder: 18826:18870 unknown command -76465992 [ 393.103748][T18870] binder: 18826:18870 ioctl c0306201 20000180 returned -22 10:37:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x80000, 0x0) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfe, 0x2201081}, 0xc) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:30 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x4005002000000000) 10:37:30 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:31 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x57dcff7f00000000) [ 393.303531][T18876] binder: 18874:18876 transaction failed 29189/-22, size 0-0 line 2995 [ 393.331254][T18879] binder: 18877:18879 got transaction to context manager from process owning it [ 393.390945][ T22] binder_release_work: 10 callbacks suppressed [ 393.390954][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.410892][T18879] binder: 18877:18879 transaction failed 29201/-22, size 0-0 line 2986 10:37:31 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$packet(0x11, 0x2000000000003, 0x300) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 393.489486][T18882] binder_alloc: binder_alloc_mmap_handler: 18877 20001000-20004000 already mapped failed -16 [ 393.547730][ T5] binder_release_work: 9 callbacks suppressed [ 393.547737][ T5] binder: undelivered TRANSACTION_COMPLETE [ 393.572700][T18882] binder: BINDER_SET_CONTEXT_MGR already set [ 393.583261][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:31 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f00000000c0)={0x2, {{0xa, 0x4e24, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1}}}, 0x88) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:31 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x57ecff7f00000000) 10:37:31 executing program 5: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x5}, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 393.598581][T18889] binder_alloc: 18877: binder_alloc_buf, no vma [ 393.631579][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 393.639271][T18891] binder: 18877:18891 transaction failed 29189/-22, size 0-0 line 2995 [ 393.650785][T18889] binder: 18885:18889 transaction failed 29189/-3, size 0-0 line 3148 [ 393.665289][T18882] binder: 18877:18882 ioctl 40046207 0 returned -16 [ 393.689503][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x400, 0x0) connect$bt_sco(r2, &(0x7f00000000c0)={0x1f, {0x5, 0x7f, 0x6, 0xf49, 0x1, 0x5}}, 0x8) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:31 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x5e00000000000000) 10:37:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 393.709812][ T22] binder: undelivered TRANSACTION_COMPLETE [ 393.727980][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:31 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 393.770785][ T22] binder: send failed reply for transaction 849, target dead [ 393.799406][T18903] binder: 18898:18903 transaction failed 29189/-22, size 0-0 line 2995 [ 393.859781][ T5] binder: undelivered TRANSACTION_COMPLETE 10:37:31 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 393.900050][T18912] binder: BINDER_SET_CONTEXT_MGR already set [ 393.916431][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.924651][T18912] binder: 18909:18912 ioctl 40046207 0 returned -16 [ 393.934323][ T22] binder: send failed reply for transaction 852, target dead 10:37:31 executing program 5: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$packet(0x11, 0x2000000000003, 0x300) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:31 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x8001002000000000) [ 394.008035][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:31 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:31 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x8003002000000000) [ 394.103795][ T22] binder: undelivered TRANSACTION_COMPLETE [ 394.121385][ T22] binder: send failed reply for transaction 856, target dead 10:37:31 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:31 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:31 executing program 5: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socket$packet(0x11, 0x2000000000003, 0x300) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 394.247570][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 394.338137][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:32 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x8004002000000000) 10:37:32 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:32 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x3f00, &(0x7f0000000040)="f0"}) 10:37:32 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x2, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r1, 0xc0e85667, &(0x7f0000000080)={0x0, 0x106, "7c4f682ac5fbb949efb9efb6132556972c11b381b8c1aa33e8c222cd4a1b252c", 0x0, 0xffff, 0x2, 0xa2e9, 0x455, 0x80000001, 0x1f, 0x41d, [0xfffffffffffffffe, 0x2, 0x80000001, 0x1]}) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141046, 0x0) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000180), 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 394.676693][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 394.682971][ T5] binder_thread_release: 8 callbacks suppressed [ 394.682981][ T5] binder: release 18909:18951 transaction 860 out, still active [ 394.697075][ T5] binder: undelivered TRANSACTION_COMPLETE [ 394.732007][ T5] binder: release 18909:18950 transaction 860 in, still active 10:37:32 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0xffffffff00000000) 10:37:32 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 394.775385][T18962] binder: send failed reply for transaction 862 to 18953:18962 [ 394.793657][T18965] binder: BINDER_SET_CONTEXT_MGR already set [ 394.801469][T18962] binder: 18953:18962 ioctl c0306201 20000140 returned -14 [ 394.813335][T18965] binder: 18964:18965 ioctl 40046207 0 returned -16 10:37:32 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x40, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@local, 0x4, 0x1, 0x3, 0x6, 0x2540}, &(0x7f0000000180)=0x20) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f00000000c0)) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x180) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x204000, 0x0) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000040)={0x7, 0xfffffffffffffeff, 0x2}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 394.840965][ T22] binder: release 18952:18957 transaction 863 out, still active [ 394.869304][ T22] binder: undelivered TRANSACTION_COMPLETE [ 394.871975][T18965] binder: 18964:18965 unknown command 0 10:37:32 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x3f00, &(0x7f0000000040)="f0"}) [ 394.901352][ T22] binder: undelivered TRANSACTION_COMPLETE [ 394.960545][ T5] binder: send failed reply for transaction 864 to 18964:18969 10:37:32 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 395.016718][T18965] binder: 18964:18965 ioctl c0306201 20000140 returned -22 [ 395.037908][T18982] binder_transaction: 4 callbacks suppressed [ 395.037924][T18982] binder: 18979:18982 transaction failed 29189/-22, size 0-0 line 2995 [ 395.045954][T18983] binder: send failed reply for transaction 867 to 18980:18983 [ 395.096415][T18969] binder_alloc: binder_alloc_mmap_handler: 18964 20001000-20004000 already mapped failed -16 [ 395.115941][T18988] binder: BINDER_SET_CONTEXT_MGR already set [ 395.116047][T18983] binder: 18980:18983 ioctl c0306201 20000140 returned -14 [ 395.129386][T18965] binder: BINDER_SET_CONTEXT_MGR already set [ 395.136166][T18988] binder: 18986:18988 ioctl 40046207 0 returned -16 [ 395.149588][T18965] binder: 18964:18965 ioctl 40046207 0 returned -16 [ 395.156601][ T5] binder: undelivered TRANSACTION_COMPLETE [ 395.169362][ T5] binder: release 18964:18969 transaction 868 out, still active [ 395.197264][ T5] binder: undelivered TRANSACTION_COMPLETE 10:37:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="00040000000016d3e5bfc7d7a1beafbd71c8592397abd21915d1d437054498fc1b8a9755e872171c77ec1b70265effbe0cc679b1211fb69a3f50a69c4c464b24dccc48cacfd92281bc66aec2199db8abb52d8b28e57fc6be51926e9463d05f222ae92f1dd022d09a6f0bc52eb259eb34d93fb372cade758faa49129742f671fd25e05f0e197e28ab469984951ba0d03759"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x802) 10:37:32 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0xffffffffffffffff) 10:37:32 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x3f00, &(0x7f0000000040)="f0"}) 10:37:32 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 395.221691][ T5] binder: undelivered TRANSACTION_COMPLETE 10:37:33 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') getpeername(r0, &(0x7f0000000080)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000007c0)=0xfffffe3d) bind$can_raw(r0, &(0x7f00000006c0)={0x1d, r1}, 0x10) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 395.339943][T18996] binder: 18992:18996 transaction failed 29189/-22, size 0-0 line 2995 [ 395.364559][T19002] binder: 18997:19002 transaction failed 29201/-22, size -245371390489472747-2024212899720301083 line 3148 [ 395.379603][T19003] binder: BINDER_SET_CONTEXT_MGR already set [ 395.385631][T19003] binder: 18999:19003 ioctl 40046207 0 returned -16 [ 395.392872][T19004] binder: BINDER_SET_CONTEXT_MGR already set [ 395.403570][T19004] binder: 19001:19004 ioctl 40046207 0 returned -16 [ 395.421675][T19006] binder_alloc: binder_alloc_mmap_handler: 18997 20001000-20004000 already mapped failed -16 [ 395.429044][T19003] binder_alloc: 18997: binder_alloc_buf, no vma 10:37:33 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 395.438764][T19003] binder: 18999:19003 transaction failed 29189/-3, size 0-0 line 3148 [ 395.461456][T19006] binder_alloc: 18997: binder_alloc_buf, no vma [ 395.473572][T19002] binder: BINDER_SET_CONTEXT_MGR already set [ 395.481159][T19002] binder: 18997:19002 ioctl 40046207 0 returned -16 10:37:33 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x8004) [ 395.494252][T19006] binder: 18997:19006 transaction failed 29189/-3, size -245371390489472747-2024212899720301083 line 3148 10:37:33 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x19a, &(0x7f0000000d00)=[{&(0x7f00000015c0)=""/4096, 0xfffffffffffffe6f}], 0x1}, 0x1}], 0x1, 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') recvmsg$kcm(r0, &(0x7f0000000900)={&(0x7f0000000040)=@ethernet={0x0, @local}, 0x80, &(0x7f00000007c0)=[{&(0x7f00000000c0)=""/40, 0x28}, {&(0x7f0000000100)=""/12, 0xc}, {&(0x7f00000006c0)=""/219, 0xdb}], 0x3, &(0x7f0000000800)=""/245, 0xf5}, 0x20) recvmmsg(r0, &(0x7f0000000c40)=[{{&(0x7f0000000940)=@rc, 0x80, &(0x7f0000000bc0)=[{&(0x7f00000009c0)=""/248, 0xf8}, {&(0x7f0000000ac0)=""/188, 0xbc}, {&(0x7f0000000b80)=""/8, 0x8}], 0x3, &(0x7f0000000c00)=""/14, 0xe}, 0x1}], 0x1, 0x0, &(0x7f0000000cc0)={0x0, 0x989680}) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 395.555036][T19014] binder_thread_write: 19 callbacks suppressed [ 395.555048][T19014] binder: 18997:19014 ERROR: BC_REGISTER_LOOPER called without request [ 395.589659][T19016] binder: 19013:19016 transaction failed 29189/-22, size 0-0 line 2995 10:37:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="ff7f0000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:33 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:33 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x4100, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000006c0)='IPVS\x00') sendto$inet(r0, &(0x7f00000000c0)="fbbda0069a30335e84ddb448023c9ee5792114b90df2638f35f84783bc44cce2784dd0fdfef686b1cdd220fb802b3c9a9950b7d814679156a119c514ab47f1fe73eac1a21a94d4e4e78c4001d63f0dc68b7f457b189dc93e93b35cb70ba2922582b447349363611f1e0ee7bab21fadf150b93826145dd1f58d49358976", 0x7d, 0x4004800, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/protocols\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 395.767002][T19028] binder: 19023:19028 ERROR: BC_REGISTER_LOOPER called without request [ 395.786417][T19028] binder: send failed reply for transaction 876 to 19023:19028 10:37:33 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 395.817642][T19028] binder: 19023:19028 ioctl c0306201 20000140 returned -14 [ 395.827658][ T5] binder: release 19029:19031 transaction 877 out, still active [ 395.838475][T19033] binder: BINDER_SET_CONTEXT_MGR already set [ 395.844489][T19033] binder: 19032:19033 ioctl 40046207 0 returned -16 10:37:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 395.888500][T19038] binder: 19032:19038 unknown command 32767 [ 395.907528][T19038] binder: 19032:19038 ioctl c0306201 20000180 returned -22 10:37:33 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000000)={0x2, r1}) [ 395.937092][T19033] binder: 19032:19033 ERROR: BC_REGISTER_LOOPER called without request [ 395.955944][T19041] binder: 19040:19041 transaction failed 29189/-22, size 0-0 line 2995 [ 395.988943][T19044] binder: 19043:19044 ERROR: BC_REGISTER_LOOPER called without request [ 396.031080][T19044] binder: send failed reply for transaction 880 to 19043:19044 [ 396.072049][T19044] binder: 19043:19044 ioctl c0306201 20000140 returned -14 10:37:33 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:33 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:33 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:33 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$getown(r2, 0x9) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@empty, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@loopback}}, &(0x7f0000000000)=0xe8) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000040)={0x4, 0xd37c, r4, 0x0, r5, 0x0, 0x4, 0x48}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 396.262266][T19057] binder: 19055:19057 ERROR: BC_REGISTER_LOOPER called without request [ 396.281539][T19063] binder: BINDER_SET_CONTEXT_MGR already set [ 396.290971][T19063] binder: 19061:19063 ioctl 40046207 0 returned -16 [ 396.296986][T19057] binder: send failed reply for transaction 882 to 19055:19057 10:37:34 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x3a902) r2 = shmget(0x3, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) shmctl$IPC_INFO(r2, 0x3, &(0x7f0000000040)=""/14) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f00000006c0)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193, 0x3ae}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$TIOCNXCL(r0, 0x540d) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000100)={0x1, 0x9, 0x80, 0x1, 0x4}) ioctl$TIOCGETD(r1, 0x5424, &(0x7f00000000c0)) [ 396.303254][T19063] binder: 19061:19063 ERROR: BC_REGISTER_LOOPER called without request [ 396.308477][T19057] binder: 19055:19057 ioctl c0306201 20000140 returned -14 [ 396.323649][ T22] binder: release 19056:19062 transaction 883 out, still active [ 396.415710][ T5] binder_send_failed_reply: 4 callbacks suppressed [ 396.415718][ T5] binder: send failed reply for transaction 883, target dead 10:37:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000080)=[@acquire={0x40046305, 0x4}], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:34 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:34 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:34 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x8}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000006c0)={r1, 0xf8, "c508cbabb433fd896de230b3a861c2d9680925e34f5b33e24dba986032839f68f2c737938508da971c3a1e9235be977a6ddff72521168e1ab1f39a03d7d3fb7abc97882f30732ed19482e83ad742ec49515c513c15c9fd3453fa5964a888650dd48bf5215509f638a9e812087159c29692b988a95684530b96785e90b15f0135c2234ea25879d074558f38e00b4b4f12c516c6997d3ef7b7a849c4fa988d74441279663a6658639f8338f4090da25bcc18088ea4b094d4dd9d70da664214d0253bd844495bcfb9b9c12ae5e36ccb9298439e6a1731915ec93e86ae4fdd10b534bafd4a420d7afecd6ea363a2bea4b6650bf0d3d3d50ed4b5"}, &(0x7f00000000c0)=0x100) 10:37:34 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x1, &(0x7f0000000000)=0x0) r4 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x8) io_cancel(r3, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x8, 0x0, r4, &(0x7f00000000c0)="c5abdbd4e839d691d97a11b73433f7cac1a9b39648ad361ff4cd42f7339ed1759a16a21a7cfe523a3977d52abff1f6e88f2637958f3799004b191da9fcbf54a010e72db4d9ca12e17fcd96279f69ac0cd0cc1ac0acd2290f231e7f26c166a961652a65d0f12e969030fc0f99bf52234ca3bc07c4f84c13ec657ee38d9ea52509c5", 0x81, 0x4, 0x0, 0x2, r1}, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 396.608508][T19074] binder_alloc: binder_alloc_mmap_handler: 19032 20001000-20004000 already mapped failed -16 [ 396.619445][T19074] binder: 19032:19074 unknown command 32767 [ 396.625346][T19074] binder: 19032:19074 ioctl c0306201 20000180 returned -22 [ 396.632795][T19038] binder: 19032:19038 ERROR: BC_REGISTER_LOOPER called without request 10:37:34 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) [ 396.720864][T19083] binder: 19076:19083 ERROR: BC_REGISTER_LOOPER called without request [ 396.741411][T19083] binder: send failed reply for transaction 886 to 19078:19084 [ 396.756114][T19086] binder: BINDER_SET_CONTEXT_MGR already set [ 396.756700][T19083] binder: 19076:19083 ioctl c0306201 20000140 returned -14 [ 396.781201][T19086] binder: 19085:19086 ioctl 40046207 0 returned -16 [ 396.790218][T19086] binder: 19085:19086 Acquire 1 refcount change on invalid ref 4 ret -22 [ 396.822715][ T5] binder: send failed reply for transaction 887 to 19085:19086 10:37:34 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:34 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:34 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:34 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0xfffffffffffffd51, &(0x7f0000000c80)=[{&(0x7f00000025c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193, 0xffffffffffffff7b}, {&(0x7f0000000480)=""/192, 0x136}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:34 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) write$binfmt_elf32(r0, &(0x7f0000000040)={{0x7f, 0x45, 0x4c, 0x46, 0x3ff, 0x4, 0xb68, 0x1d78, 0x5, 0x2, 0x6, 0x800, 0xc, 0x38, 0xf5, 0xdab, 0x30e66529, 0x20, 0x2, 0x3, 0x3ff}, [{0x60000000, 0x5, 0x80000001, 0x142, 0x0, 0x4, 0x8787, 0x8}, {0x6474e551, 0x81, 0x1, 0x0, 0x100000000, 0x10001, 0x6, 0xf524}], "5ec9ee873bb920908d84637558e8033e47024b5fcee8f80da95f357ad11a1d12a523aeb521f05d70be31c11756fdda0cbfe402619ec3f357074669f202e5f4"}, 0xb7) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 397.148502][T19103] binder: 19096:19103 ERROR: BC_REGISTER_LOOPER called without request [ 397.158555][T19101] binder: 19095:19101 transaction failed 29189/-22, size 0-0 line 2995 10:37:34 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 397.298757][T19111] binder: 19109:19111 ERROR: BC_REGISTER_LOOPER called without request 10:37:35 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:35 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x4, 0x2, 0x1, 0xfffffffffffffff8}]}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x400000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:35 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x20000, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:35 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:35 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 397.526408][T19117] binder_alloc: binder_alloc_mmap_handler: 19085 20001000-20004000 already mapped failed -16 [ 397.536816][T19117] binder_alloc: 19085: binder_alloc_buf, no vma [ 397.544763][T19117] binder: 19085:19117 transaction failed 29189/-3, size 0-0 line 3148 [ 397.554493][T19116] binder: 19085:19116 Acquire 1 refcount change on invalid ref 4 ret -22 10:37:35 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:35 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:35 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:35 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = getpgrp(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000000)='fd\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 397.697748][T19130] binder: 19127:19130 got transaction to context manager from process owning it [ 397.721148][T19130] binder: 19127:19130 transaction failed 29201/-22, size 0-0 line 2986 [ 397.786705][T19141] binder: BINDER_SET_CONTEXT_MGR already set 10:37:35 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 397.827721][T19141] binder: 19127:19141 ioctl 40046207 0 returned -16 10:37:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f00000000c0)={'team0\x00', {0x2, 0x4e20, @multicast2}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01c023896c27ec6af61d6b2e47"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:35 executing program 0: r0 = socket$caif_seqpacket(0x25, 0x5, 0x2) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000001c0)="b765b27b147125b8aac96b4c01126b9ff387325d07edf29dc3621095954692e6a9237e7dfe78984d0f83c0944827d967358a87a391649816b5bd99cf6fd492a95d65c4508aca875ed22e6f4394a59af36820952001b799ba4708b2e05a5cab9ab4ebc0118423f394ca3733cbe2b9ff9ebcad20cdc4efea0b3a23bb55cb01708eb379d8e264e97d1cac9c2f813367f267db14a2c681a8642743bea2bd9a2b523a8ce890123f5a392bf654c516e6c1941a07cfc655ebfd4a5e60ad35702a67055cfdcc26f27c0f0738b8f5269cfbff994aeeb3483b367097ad47f6a31c462e7103c03dd0eab43de0518146b11bd0978b83b8f662d019bd51417d5653a238f8081b") socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:35 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x81, 0x2, 0x5, 0x3, 0x3}, &(0x7f00000000c0)=0x14) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000100)={r1, 0x3, 0x30}, 0xc) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') sendmmsg$inet_sctp(r0, &(0x7f0000000ac0)=[{&(0x7f00000006c0)=@in6={0xa, 0x4e23, 0xfffffffffffeffff, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xffffffffffffff01}, 0x1c, &(0x7f0000000940)=[{&(0x7f0000000700)="e67f0717552f7e9f45cae8d17ad1cdfc76abdb25523b4fd8c180c6f08110d962c75f41bfe4ea3d6904cf03d891960cd27920ee12ea5d629ef66490e529368eb1d5252589b999a740fde40674fa50f60d9c866d567893a9280d6ea75c876feaaf8b176754b39dac829094c0127dd5777d61eeade094f3d616cc54e3d19dcdfe01222aba67ca6e4cc252dfae0f8caf87f980c80bfbcfa2e5a8bec34ec90b166ae40afd97ae3da71c5465c12f74739cd77f95648ecd", 0xb4}, {&(0x7f00000007c0)="ce44", 0x2}, {&(0x7f0000000800)="42ed", 0x2}, {&(0x7f00000025c0)="c8c2f0a13050e20caba1d0cb11dbac3362fafd315b8227f8e71b19f98e046023bb1342bfb904a87041c32555d4da098e8a498be2ca09f7738c42966632c955bf71905cac6e5b17e5e1a75d71aaf2c35782f02df9fda0f54237fd62a77e077d5e4cbbb6a1cabb5ded0fb0d62756bccd131152b4e60ff748df83c7a487c707b037d6106f6de01d567b80ef3068a85bea694a21db37e488e2f0ee538cf2e4018b23285c6aae99ade02a02582ac1a524d08a1195f92f7e1e43915f18b5c484368fddcf28766e554dcacd4a3b058f28664ae16189845551aa06e3e26d337201086ffcbf100d472e71cda1cb6dadfe85e785011da2ba5cf2c90cb2d68060358af2d459a12373d0ee2cc5c29bf2196b35f0046756e37b59f329d743cfe72eb3b208880d4ac0d403949fd91fa77de70987ebb5071fd46a2da12fb192cc0fb16097380e3e72279a7934e3b20ca2f5c663dd760519aa06e5e3e1b263756270ba52c491a399834e91c60a76a5eece64071f6acb8f89125ee15a1a768f645cc3896fc3383c4cb97d9a300372ad3b670a309ff8930a0d23dd55741be273c1b89b2d30ec5d416a7162760bb684cdacd8bfce5ec0e07736fe4daea6fe726e61f1f3d93b9b08ec2fcbd079e36ce823139538aa4bd057afb0cce113d3d1f3432f5e2f643c1ed93b7007eb431dfd92a7ebe9576783690fa5f66a1588a1f0567e3c4928f51de934739c69715658097459a072e9fe36ad0853c30781b866a605f81aa56c8fe66a36122f21beaee9a6b67bb7f2df73de3aab895119468f76e83d5d9d6e7189fd746cf6b29fcd111249f69473c140834d3717ce73cc40b5277b02289edfa538b4824f95cddb9aa81534c3be0e16333bcb2d70c50594807fec49316e8c0ae85e9524cbef4b9d541d9a5ec2e6d12881195e49ccc7c696455f643afbe53a7dfd7063684e527c9e7f8ac3d032c75568160dd723afb5c45a9e5b73ababc605a93b674d663d3fc3f2b5ee79615b5f7e11c71a30f7681cfe817fb689dab5c7a6da39c07253818e86c03b4ef4f0276fc41f8e970d9708428691e22227a6df82953e754a4c84f432cd52d5c4224ed181819474e99a42b9be843162a0d4764d06b9b927ad826c3de522eb7ef00eb371d24255abfcb84db51774b9a6130093ad995e24255274e7a9a84861278dbde8b5de290a1b700ee5f96e13555a2a03db56a86bf322760d400c7170974010a35441c5c490f8116da587b7ecb157f49b3f0b068ef644e6edd3b67e0fc56883138b2351160af2f1e581d9d20f1f0882bfc90f55b3e0d9e1b197580b3aee31bf9448ed07882f44604dd96d67fd8283636b7633a72ac52368d168c6483812eb6565e9519a956ab15ad219f5c75222d40f08f0f0c0bb429a36dd6933b5d67b1bb0bafb88f02eb10bd9b9065d8fb16416b069d664e8275f4cbe836ad972b4e807edd8ac748c5b550dd40a2dfb2b311a017bc294bd3272746eaf84a32ee88a55ab460dbc9a609cf164737ed91ceeb204ff52c101f7a13072bae71a9189251f5ffcc411923b9882b58ca8bb848ca0135deac87e1466f22852003859435996d785abb2337835f71a54f158231694cf78f250a7b7a94c5b6a3020de7ba3b7b7d9aa5f409a51bac2f86e6a2321995c08975655df6c50e9c0bf8793ef6651778c72dd311acbb55e8317f3632719c865ccd87aa3593b96708be72d68f8e39d6e3b43972a99972e3542be5d01ee96422ecbdcb992d7ae9658dea47dc8477f9e084164a73f6e6dcbd7c2e83d5bf980aa31fa4c1bdb7feab5e1c26e2b216e410759d92d31eeda809c9eb9513d6d23e1331f9dcc52447b9984727a3597bd5a3a476dbf1de6097adc1ef33c433a8e9ea6edbf2d6a0a0c3420c383403bd6b1d6c7ff67a3afee53f343e871bcc0bf0ac77f23d40fb70182246bf015d0d7f8ffd82cafb659f2e8220c174f96e8869c3b9a7a1302dec83a257f29817feeb1420274c561fcb6bbf7e25e5a297c8fb1152dd82b30bb2c707fbe5fd447ea18e71ec0de0bcb42a569bfe313c7222f13cbdaf7a2d55fbf8ae1cc0734f6225dc976396971682539d663188b47ad7d5c341cdf3ed59d6b545aed9a8cc5d8a335c4380344eec24cc13e91453da663d1e76ee8966fadc8587118616c29ff387d208aa3c21f0c90d9b56be87ddb6fc8d7bd6af2b28c6f48af6e565cb1955950b444c97f74a53e8ca87b57b0b8b7aa65ea1e08e5e7f18f73300ebfe1f2f5126acddfaf7ede716c08daa395a986bbc630a8b3b2f147af6adc248e1907c59ebdc9a7d1991c0c7e8e31589588f8bfef5bd0df7c7026e4cc0a0528dae774f363e4a0d581085df54bc03ea9fc8d337380333cc3e21bdf15b6804de14faebbba49a45f52caac026bfd476ab456da8b6d43cff20fe06dce73c67b62976b5502548862272e145865cb1351e62ef596108c7e3bad2b19781e68928d88fcf4b2c8b3bf42f0fad8c6653cbdba7955232d054ddb271792652e32a22665881e545994e625a9f74c92a7f67b86d5ff40e4e3f59287f4b49701387d07ea38d4f6a68de68cd616063863a4985aab700cb7ebb2ee864a2d8886f6022680633b81ba735810428f6640bdc8c385ad2e712e7c717366216063dd418fc7edd9d8f11639d5efb18506a67c126b22de13b6f07135febc4bf69f1f59686022d7893060c150f662da3c3a89df435ab207e33f075272e8f8cd7d6d40039411c543eb94f2aefdd7669740a8a1f6bf041df191ec7d80b585ff9c0ead8c8cd10e8a6c0c337d6b3ec40ddc0e92aebf07e0b765ce4cf32b19f15d3d25609fb1be179bf4a1668e64e80cbed0360ca8bd2c19cabb20dc57ee84b3afa9ab121a6c6d898adc9315e9eb348193adc3acaf6f02ab4d4cf2813131cac4be1878faedcb26605e82ed1e5b35becbc6affdc77d1612607771e778525e0dcc0aa572d38493626d7f83d72f49dc6112d84d7a4c22d0be4a2f056a6f258842f8059e4de8f337282bb15af55bf7c99f94d3e08f2199e1fecb328a0ce668cbcba5be6d8cf4ce7e397c5dd56b82fea0e08c5a6de050f0d39e31e0977dc8bc083da8a61a92e69f74fe4b3f9af973b2376031caeac38fd80de24390a4b4589ccd519380ec5306d949aa71f665a0fcc9a20fcf8dc43bcb77345e6a2a97ea9a64d500c6bccccc69638e3c78069b32d8511c06016551a009007533c674904062a538607640315169486c9f48f9e071a12a393e326e6af34f716c361a8bf6dadb7f9e410f0d01f0929fbf4f6f7ac0136de4c99c1fc612a0da221cdf7ec529953f04892b55db532e3974a9308b7fe00474004e52c095be65b5c47e6c29d3bc4191a99fff8f172628a164b536ed7cd22cd0f744dd9c8debc3f7df3fcacf222de0ca5a37ae8289656784d530e23649397445ba5f71598c4a43a2fb07e1de14b781db8fb68b937ae1b80dd876c9a15860fab949777c95b9e8aaf8275d3dc1d1edc86ba12fa9d498eb4b276d199daa316a7ca66ed6a3414405f2f983ebb4cd50091b916effa1cb1a83645a25e0958141b3c74b5bb5cc62a1f9075549a6e8ee80e9db392ac404fecfe3bee00d9586f80960243310a20fc70e80daf2600870bd398bccef21e0be3dcf7d1780dc437bc18698295746bd634fec1b949f51a69f06d5480c0799febbfa5ceb73408ce0337b73679024a4ec96e926115fd7f6a1c3fb469fbd5b628502026a40d07f213107f60566d12b7cde21933cdad2d811666183396e545e01c1089cb405e5b0c206a028510f4b3cff19027432862ce49be8915aa830b2c7a3c82c7cfffe1ec7365e756162ebe7cbb7f0c864e0f42ddadd97c0f9a6c3cf20418c6f813407d09d305089ee1bc648c03440c37cb4270de5096be5d0343e50e5713a7b61aed0fac077bc6711a3bb8c1a314f8bfc39fad3552dc3117518be7b8453985e727d33e0a7c947f228887a5d8e708bf6cee9927396eeefd8179dbeb8c10162368fb46187b33c0b7a6722da87969130af4b020a488fb53aada55971328e2d4684201cb885f72d8e1fa6a207215e239fff204bfdf574b5bfa6a70bb4c9355c0563d61b777ba84395e9bcdbb840e794a1b7706d5d9042ec584b93eddf4251c9beee2e942c6c729760d6db444ddc38279ee1cfaf55e007cca2856551e74f4fc52b6eddc761c0a08ecb73103aaca4b316f688c13a64b3e245a287481da37c906ab77fdf8a0996919014843dcbd393c7651f28fc6df7feb0ddfa20ab1bfc91a3f8e3c34de21babe315eba12e0aa9830a44e39308acf173f5c8599b7bc924971cd0bce205ddf108accbf6646ad51377c5fbcf2e185a272c07040708c41551e5febd1a5f8eba35bae0b08c9a098119642797a4a37a95a65a0a9ff0d9ca703e6bf69532fbcace67646e6f4abcef5921bc8e44f9a92519230ece9e167da0907d404c22289ece040add03093cb7b00830e7dad86ccc7156f569dcb1b3522248a8a761c853de87ed85de6d856719d12b1637880e2d0eda4a28ccbe193667ab2450547537e2983dbb22956ce7001df8cce20cf33c5c1494ef2738b64151c6bab0f707073818f9f2020ae4d5134d998cafefcff96e8c4abcb95de1a7f8f197beab1f3195896dbbdd0253a8c1b67d2272bb673891bcfb57f6d40e0046cba7454a5fbd7027d370609206cab9aa533dbafd67b0ef4e0d9820c3f90acbe6438cef0b2da534b9526b51621f2bc45c588df5248b5e121a3f819714b6c71bc34c965cce47d1fed6611206514b8f67d2c606027c86fd589d45202e35c4a2bc913281bfd5aed5a50f27a26b2759f9cad815913f051aed0cb1d719f6886177a1ccf3e253546ec1f1e93c0efc80d2dda9a5e72c1a75fdd03e3892789fe091361493a7330d73435ea565cf934d2a93d020fa4c38dc0ab245ae77153603e43ab1964b2b8ea829ad961869f99f322f0c6ad07b4b2b0ea272f1df9ca8f0896750924cd02d5fe1866cf14099b85cbbdfe926cf7807ceccdb0b885859346a3d6a33e25a75633be274590ab7febc2bd91f5794af8e123fb880f60471871e5b319af7baadff4cda86d7a1e3415a068c78abcc8f9c5cfac8c9bbdec16c99d87b67be5a1edba157783911201c020afd02ce792f61aa30aeeec56778cbdc43baf51ab243bf852f2c6282cca01d19295928250b26cc4e888897eb94e9259ba1df56bac64e8601cfdf1e55555700ebc9cb37a8b1bd1b5852588decd46ed3e8888ddf8991272de74896c1f68bb368c6d36b8e426e48f5a584dd64226694ffede95e78b9664ea29ebe11c9d86c88f391d19fb30408ee18b4a087e33fb0599570f1d5c51089257546812f9e4d564a1953a8f0877776ec2fffd13747310d9da47a4fc6c7370508b5e4e8af6f79f12c60fe8f3ccca7f98cc94e42758034af5665fef45ad1bfc846904af1dfd9f96878fe0baa9f184e34a4db90c14ce66736c770ddafe650493108ad37944d928675da1056f50793596a1103df921e79eaf47959aebe0555f9a38830a876d8f4382424e9f3afb31a88217dfc69d86de65fe97c906c26c17aeb1f16f2b3911578a2183a1ddfed0c31b9daf213e3595cd542e0b3691a2a4a634b5e79d8dea5e8b55c34a66da94a9b9331d5218f00ae4f993d7d890c060cf49ac306100487d7059c39d13c3a0f148cca9f1260197bb44f50cff35994a469eb963b658090e4a782db38ae714a7eadffd146e367cf1b2ead49144a278852e5208f6809ad00c2a70544ba746b420949e213f1cad628af30218b792c36dbd713c540b1e2aa231479d11eaae1466fcff7938d00cc3216", 0x1000}, {&(0x7f0000000840)="ee7b6c5a589bb49a287f9fc6f1abbd202e6dd4280709960ca12f3257", 0x1c}, {&(0x7f0000000880)="631a6e91fe32698b6045fe8c4c6c7842ce01ed44ff30576be9de74513837bebbb590752e289670120be5b47fdc2afbb6b3f3be01cdbeeb72b33926b7afb3", 0x3e}, {&(0x7f00000008c0)="df3381daa7b7b76974ef13f8ceb43ad295e663fdb574182d19dc7bc024098d93ad1cd40082b0633fb6457494a6bf2c11d165de9aa33560341aa6e9d35e8c106ef03122f7d8dbef6a4791ee9962e85ad3a5a527f3455d70a093", 0x59}], 0x7, &(0x7f00000009c0)=[@authinfo={0x18, 0x84, 0x6, {0x400000008000000}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @remote}}, @sndinfo={0x20, 0x84, 0x2, {0x8, 0x205, 0x7ff, 0x3, r1}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x1}}, @sndinfo={0x20, 0x84, 0x2, {0x0, 0x4, 0xfff, 0x100000001, r1}}, @sndrcv={0x30, 0x84, 0x1, {0xedd, 0x200, 0x7, 0x9, 0x9, 0x1, 0xf, 0x38000000, r1}}, @dstaddrv6={0x20, 0x84, 0x8, @rand_addr="3e8a559bafeec302b144aafd24b23ca9"}], 0xe0, 0x4004040}], 0x1, 0x1) preadv(r2, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:35 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 398.023483][T19158] binder: BINDER_SET_CONTEXT_MGR already set [ 398.051282][T19158] binder: 19155:19158 ioctl 40046207 0 returned -16 [ 398.072100][T19164] binder_alloc: 19146: binder_alloc_buf, no vma 10:37:35 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}]}, 0x2}], 0xc4, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x585040) [ 398.102160][T19158] binder: 19155:19158 unknown command -1994145791 [ 398.127253][T19158] binder: 19155:19158 ioctl c0306201 20000140 returned -22 10:37:35 executing program 0: socket$caif_seqpacket(0x25, 0x5, 0x2) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 398.156264][T19168] binder_alloc: binder_alloc_mmap_handler: 19155 20001000-20004000 already mapped failed -16 10:37:35 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x8001, 0x200101) ioctl$VIDIOC_G_FMT(r2, 0xc0d05604, &(0x7f00000001c0)={0x2, @sdr={0x20343059, 0xffff}}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1163486f5b8242408a084c58015beea440", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000040)="f8"}) 10:37:35 executing program 3: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x1000000000080, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[0x1, 0x9]}) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 398.208672][T19158] binder: BINDER_SET_CONTEXT_MGR already set [ 398.223048][T19174] binder_alloc: 19146: binder_alloc_buf, no vma [ 398.229712][T19158] binder: 19155:19158 ioctl 40046207 0 returned -16 [ 398.237695][T19164] binder_alloc: 19146: binder_alloc_buf, no vma [ 398.360759][T19184] binder: BINDER_SET_CONTEXT_MGR already set [ 398.383857][T19184] binder: 19180:19184 ioctl 40046207 0 returned -16 [ 398.405815][T19184] binder: 19180:19184 unknown command 1867014929 [ 398.415883][T19184] binder: 19180:19184 ioctl c0306201 20000180 returned -22 [ 398.424618][T19184] binder: 19180:19184 unknown command 0 [ 398.431263][T19184] binder: 19180:19184 ioctl c0306201 20000140 returned -22 [ 398.440571][T19189] binder_alloc: binder_alloc_mmap_handler: 19180 20001000-20004000 already mapped failed -16 [ 398.453809][T19184] binder: BINDER_SET_CONTEXT_MGR already set [ 398.458501][T19189] binder: 19180:19189 unknown command 1867014929 [ 398.462992][T19184] binder: 19180:19184 ioctl 40046207 0 returned -16 [ 398.466163][T19189] binder: 19180:19189 ioctl c0306201 20000180 returned -22 10:37:36 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:36 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)) 10:37:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:36 executing program 1: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:36 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000080)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x20013, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x80080, 0x0) ioctl$PPPIOCSPASS(r2, 0x40107447, &(0x7f00000001c0)={0xa, &(0x7f00000000c0)=[{0x4, 0xe35, 0x7, 0x8}, {0x1ff, 0x800, 0x55, 0x9}, {0xd2, 0x55, 0xfffffffffffffffd, 0x4}, {0x2, 0x3, 0x1, 0x400}, {0x86, 0x8, 0x1, 0x5}, {0x8, 0x2a97, 0x6, 0x7}, {0x7f31, 0x0, 0x2, 0x6}, {0xffffffffffff515b, 0x1, 0x2, 0xff}, {0x0, 0x9, 0x41a, 0x3f}, {0x401, 0x1, 0xe6, 0x10ab1336}]}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'teql0\x00', 0x0}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x7) pipe(&(0x7f0000000480)) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000440)={0x557, 0x101, 0x40, 0x5, 0x6}, 0x14) r4 = syz_open_dev$ndb(&(0x7f0000000280)='/dev/nbd#\x00', 0x0, 0x40200) sendmsg$can_bcm(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x1d, r3}, 0x10, &(0x7f00000003c0)={&(0x7f0000000340)={0x7, 0x140, 0x101, {0x0, 0x2710}, {0x77359400}, {0x4, 0x43, 0x101000000000000, 0x50}, 0x1, @can={{0x0, 0x7, 0x35200, 0x3ff}, 0x6, 0x2, 0x0, 0x0, "e09d0502cc03db88"}}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) epoll_pwait(r4, &(0x7f00000004c0)=[{}, {}, {}], 0x3, 0x5, &(0x7f0000000500)={0x6b}, 0x8) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, &(0x7f00000002c0)=0x1) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000240)={r3, 0x7f, 0x10000, 0xf9, 0x3, 0x3cde, 0x1}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 398.783928][ T22] binder_release_work: 21 callbacks suppressed [ 398.783937][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 398.819504][T19201] binder: 19197:19201 ioctl 40046205 7 returned -22 [ 398.828144][T19207] binder: BINDER_SET_CONTEXT_MGR already set 10:37:36 executing program 1: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 398.840041][T19207] binder: 19203:19207 ioctl 40046207 0 returned -16 10:37:36 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dsp\x00', 0x100, 0x0) ioctl$VIDIOC_G_AUDIO(r0, 0x80345621, &(0x7f00000006c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f00000007c0)={"1ba31b4c6c906dc828bec6a74d83eb38e34f0e7d60976de16027094275c91188e509e9e8ae6914810c6de4f7b479f5b8403c76d9d1ed19468c101b5345c8e8db38aaf9e04a06290c770af0518d7b417a73f22ec3058a25abb6ae725340fbbcfd04494e2a6d901a2fd5a201899014175e58e277f59c6a235172f7fafbd72e053c4a3246b4ed6cb43220d27287a15a787d3100d7e9702a344a81bb93e313f78e2f5c0f371a52b5b68edb1779830e05269dc2af67b2e6dbec11780f66a3d8c48fe325e432f32abc3d0f38b10bbb010a192f6bff213d6c4196987a6f67f0c06371d700c450473d4142fcdbb6f1e097f334d22c56fbb1a1121b3cb6273b429b2201f1e9d97298cd0c0f96ea5a116959ac97068218531b9ff13079f0d30c390079ebadd45e8f7bf2475867db5928290a2341d7522ea9e44772057192db715bae141db25d5762b7526a284fb0d1d6a100455324edd816c7a70de92e5eb2146af3e34c9fbe1a2a16ffc65fd388c248645102a1140543d4a4c51d7edd3286e7ab86b5c75308ff9d5979c508b8006be52730183e3096648ba121dab5514e4958e4320f2b3b7a9c2f3cd0b8c6742ad6c92514b1b6d9f13a114ef1b3896b4b6577362f837f94c38014121b81bd6edc4b51249609290dabfea8a3f1a9e95180f2947ac1cb02f44fa4bcfdc45ce31faa84dba7c6864b91fa214851c3fa877212611082ef079c08be1e18cc101fdd0ecd597d4f6d3f91a0af485d6faacc735bc30bb8e62254fcef3eeb2608a1c97b6ebeeabc95bc6d321e0f823ae9631c7e6931c8abbeed3bbb4fd982f6d9c34eb97c07531dbf51127494b6e5d55715faafad98663d257a93666fc70925835814d611ec255a61eddf1c30eecd988aad6ca7bffb9204be2d628a871def2b830eda9e8b4b167d9b257c6d07907ed96f46930c95c81cbf2aef18f377db8f45d6a74be72c5b3e9be55f748a9f2da96035c6f5647d239c2a0a20d0aebb2240647ede0be25e0d4cee074b46e1d7763b76b07c3fd23066d74629539c467340f1b29510a5dc0923f27a35d43a4933f5278e2c28f8a664da3d68ef9f55b5a7a1323b9a077a8862898ce41e8715a55fb725d1ffa8fd30551d33fc5514fd23b784e23b882ce7dbab0ccec7baf13c8367ee5f2992493862f6dd26da7cf92e4432e25fca782aa6195a2022a943b1220de8a5d43498ecdf8a70a34295b8e152045e6d297ea36424909a07aacf97d1119ae9871b24c475898ec6e5f95e5adbd88df08e7e498bd205d4821823bb0ee16f3addb5c7d373f5134c3167bc722caf432fca5ef3362bd96fe2bd679fbebf70433ce150f157ece4907945df70a98fc9ac1349ba58c05ffb25c9ec3f6b007b0dc2e4b3fef7e42a9c5de914e4f4f875bc1299e9d71494ef7685f7d39c4bff764192cdddd7cc93d470c5f72a537cd6ad440075c4"}) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r1, 0xc0945662, &(0x7f0000000040)={0x7, 0x0, [], {0x0, @reserved}}) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000700)=0x6, 0x4) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x4f5}, {&(0x7f0000000100)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219, 0x250}], 0x10000000000000f0, 0x0) [ 398.880729][T19209] binder_alloc: binder_alloc_mmap_handler: 19197 20ffc000-20ffe000 already mapped failed -16 10:37:36 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:36 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 398.968174][T19214] binder_alloc: 19197: binder_alloc_buf, no vma [ 398.976601][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 398.977538][T19201] binder: BINDER_SET_CONTEXT_MGR already set 10:37:36 executing program 1: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:36 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x482240, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r0, &(0x7f0000000700)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000100)={0x2c, r1, 0x0, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xae}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfff}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r2, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 399.019586][T19220] binder: 19197:19220 ioctl 40046205 7 returned -22 [ 399.054516][T19201] binder: 19197:19201 ioctl 40046207 0 returned -16 10:37:37 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x300042}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r3, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x8010) 10:37:37 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x88080, 0x0) getsockname$tipc(r2, &(0x7f00000000c0), &(0x7f0000000100)=0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:37 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$unix(0x1, 0x7, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') 10:37:37 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 399.385711][T19242] binder: BINDER_SET_CONTEXT_MGR already set [ 399.393481][T19245] binder: BINDER_SET_CONTEXT_MGR already set [ 399.414735][T19242] binder: 19241:19242 ioctl 40046207 0 returned -16 10:37:37 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 399.437743][T19245] binder: 19244:19245 ioctl 40046207 0 returned -16 [ 399.446366][T19251] binder_alloc: 19223: binder_alloc_buf, no vma 10:37:37 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f00000000c0), 0x4) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000100)=0x6, 0x1) connect$caif(r0, &(0x7f0000000080)=@rfm={0x25, 0x9, "3f24d7e5b0344b4b26891d7b23a5c538"}, 0x18) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000040)=0x5) 10:37:37 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 399.606912][T19263] binder: BINDER_SET_CONTEXT_MGR already set [ 399.627305][T19263] binder: 19260:19263 ioctl 40046207 0 returned -16 10:37:37 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f00000006c0)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000040)=""/219, 0xdb}], 0x8, 0x0) keyctl$session_to_parent(0x12) 10:37:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:37 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:37 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:37 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:37 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 399.977658][T19277] binder_alloc: 19272: binder_alloc_buf, no vma [ 400.007509][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.176595][T19251] binder_alloc: binder_alloc_mmap_handler: 19241 20001000-20004000 already mapped failed -16 [ 400.198321][T19251] binder: BINDER_SET_CONTEXT_MGR already set [ 400.206572][T19251] binder: 19241:19251 ioctl 40046207 0 returned -16 [ 400.215109][T19288] binder_alloc: 19272: binder_alloc_buf, no vma 10:37:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x4, 0x810, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:37 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000006c0)={{{@in6=@ipv4={[], [], @multicast1}, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@initdev}}, &(0x7f0000000080)=0xe8) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000000c0)={r1, 0x1, 0x6, @broadcast}, 0x10) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x200000, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='maps\x00') preadv(r2, &(0x7f00000007c0)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000840)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) 10:37:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:37 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:37 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$binfmt_elf32(r1, &(0x7f00000000c0)={{0x7f, 0x45, 0x4c, 0x46, 0x1000, 0x10001, 0x2, 0x3f, 0x9, 0x0, 0x7, 0xfffffffffffff20c, 0x2e5, 0x38, 0x31a, 0x7, 0x5, 0x20, 0x2, 0x6, 0x3, 0x7}, [{0x2, 0x7, 0x100, 0x910, 0x5336, 0x8, 0x3, 0x4}], "a079c9857bb9e6783e453a24c30da8cbfe334be2c388b70cd69542eaa76d10e14b7743873914ef08005407570ec2f3a25739f3a90901a8c4a657d2e10fd6adb4", [[]]}, 0x198) [ 400.222201][T19288] binder_transaction: 7 callbacks suppressed [ 400.222219][T19288] binder: 19241:19288 transaction failed 29189/-3, size 0-0 line 3148 [ 400.238127][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.257522][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.320590][T19293] binder_alloc: 19272: binder_alloc_buf, no vma [ 400.347739][T19293] binder: 19292:19293 transaction failed 29189/-3, size 0-0 line 3148 10:37:38 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:38 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000040)=""/60, 0xfd7a}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192, 0x138}, {&(0x7f0000000540)=""/219}], 0x10000000000003e2, 0x0) [ 400.375212][T19301] binder: BINDER_SET_CONTEXT_MGR already set [ 400.402767][T19301] binder: 19298:19301 ioctl 40046207 0 returned -16 [ 400.402775][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.414817][T19301] binder_alloc: 19272: binder_alloc_buf, no vma 10:37:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:38 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 400.485810][T19301] binder: 19298:19301 transaction failed 29189/-3, size 0-0 line 3148 [ 400.557314][T19312] binder_alloc: 19272: binder_alloc_buf, no vma [ 400.568271][T19308] binder: BINDER_SET_CONTEXT_MGR already set [ 400.600099][T19308] binder: 19298:19308 ioctl 40046207 0 returned -16 [ 400.609926][T19312] binder: 19309:19312 transaction failed 29189/-3, size 0-0 line 3148 [ 400.627570][T19313] binder_alloc: 19272: binder_alloc_buf, no vma [ 400.634709][T19301] binder_thread_write: 11 callbacks suppressed [ 400.634720][T19301] binder: 19298:19301 ERROR: BC_REGISTER_LOOPER called without request [ 400.657506][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.658181][T19313] binder: 19298:19313 transaction failed 29189/-3, size 0-0 line 3148 [ 400.704799][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.716491][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:38 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:38 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x5, 0x200) 10:37:38 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lookup_dcookie(0x101, &(0x7f0000000080)=""/93, 0x5d) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 400.863708][T19327] binder: 19326:19327 transaction failed 29189/-22, size 0-0 line 2995 [ 400.884511][T19331] binder: 19324:19331 ERROR: BC_REGISTER_LOOPER called without request [ 400.894549][T19332] binder: BINDER_SET_CONTEXT_MGR already set 10:37:38 executing program 5: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:38 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 400.916548][T19334] binder_alloc: binder_alloc_mmap_handler: 19324 20001000-20004000 already mapped failed -16 [ 400.946611][T19332] binder: 19329:19332 ioctl 40046207 0 returned -16 [ 400.946753][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:38 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') pwritev(r0, &(0x7f0000000980)=[{&(0x7f0000000080)="82440f2ed7af70b6232526f23c964aedbf3a1f0f3aea388f818760c993ad6efcd66a8060ddb574a025fee83b520b9e1775fec9769d7006516c50f09e8f3f6021f4791d", 0x43}, {&(0x7f00000025c0)="4b6440835fae1be632cc155a9ac40986cb989dd2c2127e2be235185afa2e8f554f1e36acfc6ee0bb4631020f48cc71cebb2243d4e71a2cc521f46db6343945f43a2427321de35dd83dfd838818543c335bc93872d924c61b1e3994f74c5ef9bd755366ccd7ad5f48c32560cf14f2bc124aefcfdca37bb4f13357598cae29c53fb0aff5c079e459d5e30bebdfa41c0d85da49a6232d6cf701766043439b95eb309a57fc638d422d21cd094c9303aecbb3436bec66bfcd8d53e1f5248d238adafb5763a5e955291c35d008f7280fa7564788f00bc9e6b7e528654cc695e943d6c8dc2fdd3228efe45bba65984933e70c8406e3a670c3cae49da95c2bd6ab6a0d5f2097a5f1d56c62ce633706a4ad68e902e768e0632824e76ebde5d000cf10730a416eff080b94a8ed10be372facdd9c5bf735e3b5f0269dbe548f33a439c3bf7609a5566f3777371eef3b1ed566b814c77756e4178e93d2ed0d47a6f0a5ba8f5b8a4e1ca1603b5be8e9bedc0227a6884e06e2e4d4318631ad97d47648164650f54139e2f193ac8a0f751277fde12bdef2934782daa7108f897b9456ac4767b2e092f9a6f53c048bbbd29d873dde731bd1c52b8a464635af23daba6abe23c867d4ae580ea5070ef93b438dd81666e0d41de3766e31afcbcf1d52fa808d0a636d67920c7d2f37613a14989c3cfe932ab0d5b8c40351bd47782d68fa3e958674795f45b172cf65cb5daff62fc1146beff783ac3fcb3c0b12c97812e67c16d385185ab90a8e065665bb315c7d20f00f0afbab9ac2f55fd19f4217e9e629b78f8a9310fc1c33cbf043323bd6c98efc1ad733c5c875f5470dc6b6983fe4b53b734316602cb7d943c5a97905b922a140b5af415af32720dfb4df663e1d0218d731b7fbd86c3d8fe042114177de99e3bf1487140c18850eca0bc072ab03e2c8ac36261f1916ba799fbd05e9cc87fe1d6e01839a0da9cb6b801a031fa9f46694d39cd83091242cf761f3a67e72493b897fb0dfdab1c47e35b220bc002d929d1a863f2b2085ccd837e71508a1b3283dd924aa18e847b0392fab9c2e63b174dbe0d7947e5a4a2db5289193eb684536b48e42445227bdcb3118319cf21e3ea51bbce49f45ea4ee65129216528489981090f8cbd29cda04ac5d474bd3b8d217e22120a34e6d2d7db77f41e4fb6fbfd7c822f5d9e9b0f9af3a28df695d5e1dc98029f39672837535c6e67cbb36f951ad0468963a35c46fdc90c1b0167ad1837eb8a23715028b982c9f22f2c745ccc77fd5431c5b5ce13f20d4ff38007e0d09607123e1d82d4fe1db16ef4454143df61e721b82f644bee976ffad2083390f2f6132defc32990de245cc66cccbb75eb0968d169bc7924263774080029e725531546c0839fc500d51ceba66fc85fabcb753f0a9afbb21e1db3cc4fb2def8a4921c487fea208b5cf87b41572e6caf27ea354efc19be4aaf4f2076b7fc6ec6420f4200a172b10aab27d615dad61f40962d62cc7d3122c57462cec55482d8ed34459a94019719ef2b9160adc8f40bd5f85025bdba21a534e4bb8b9bdec8b165c7e463f8ba18b6d118fb544b6671f2c1f285d70b59160a295eabe49328aa72de7de8a7014c5c5ce8bcb6ff075712726623df75b40c7b327b4bd45344be5201ccb674b65e260bc05048de0f0f411ae4c43a1ba65f960f59f4b699c793a7b6020bf8dc1f459d5c2b727aab1a4e483d98b2ad96ac19b56da4726bebd24b7da521ab22b4080b81a89b7475fc927404e9433a299c32ae2a7f9827da0deda1f9707a88d157ce5807b6d122d237346e46ee70e4e171191a65eeeba42669a246acd7496fced1df9ce3cfb5977b41734c6e18ef1544b5587d89202291e55ceb544a8cf7dc40c3c0ffe604714ee5f92fa7fd3c98e18ee86ed86d254131d7724199dd73903a39a9c4019d92b5238f2fe940c3705b9dce0d1b1786fd5c09f9d5c68664980de4e0302af2c83db65014ad9236bc4a0f9a271769b010d91a86b65d01c4dccbd0aef4445d97c616af194e23afcb39dda1b8c8b3f0398d83aa5c5fe2d2b19c38b0b9a616b4a8ffd076812b09f635fa736971a112ac65ce000088b87775266a49a545cae482373c26becd2ceeb4c57aaa197d789ab15d3c475d6987680ae26785f1230abfa445ed47026c26f8bf5c963eb2be68323ef010371b1d1169a62e404e2201d7d884460929187c824ac668b37993be5ad739b006a049d9bdb2b57c4c9700156959fc180129e62366014892c413eca2a7b503cb99e2b68f6c98c67e5adb343c73aa31eec38eb19d2952b398c84923b7246ff8c01a5cdd6473b0a6a03c32369eac110dbd8a37070731cfeba05c84d8a41242fda824ea022ab3e273e7b9953744e0c2ab6a4829c84517160ac9b8e7a1c8fe190117b86c4b94d5d9bf8e93eb43689c2babab514455c257b42e38238ef9a33e7d220dbf0af9d52c0f9d1fe06d51e7594814f9c22ae8bd3fb87fcc39dcb0c8243f988eb26fa20aa1803373177c76d0f12ff8d768fc97a64897774bfd4c492b3fb11f3a54463cb806ed8b6712984aaa9a8778db4d3caa95c92bb7ee6cd800cf9883f23ab4ae9b84685596430ed425b57363e3bb58a114bed65026ba6690d229b19b0826979951c13154a341023e9cbdf9760e0a826b0488c7a0060c6dcac016ad8dc597dcae33d707cc98607011b9f288030bdc90d0f358a6e6fc15b92c487b53048f97deadc8ed641d24352d54601968d242e3ac9539e823e28970235176c52d4e9a19908a5a9fb858b0e73d4922da72c31b9faa6d90dbc4be1a83feef881175b84332a8ad4e4e971e3a92d03173dad36970ea4b755a0d82be455969ef0879fec3f924d2ddb09f1a417d5b97098aa40c81d75fa56288f02d514b6c51b8343e84e268865b1359f7891a491483ad05ef42f3591e0bcbc768c2fd2386da7c0aebbd46ed47dc4dc5630d3e522138121ecbb31abb2f61737bc7721c1a11ed27529d5024c01f02b60a9c26e0328e3f57b3dde955e0f66e9a0677b9f0b03980b5fd04f038661e429d8816f16dcf465b8fcc97ee32d4cec0f52bb522ce344cda03d013c9c2b3127cdaa9b10a5c6349acba41b1d5501c90c1c5d02feeacafe84919f708ce6b9edcc56325a680ea61e34c578dea6f5e3c5da7422784f26cf178316000464a6b8436fc87d2038b6b5e56b5358e34228375cd69b0b5801d82bf9716a9d5851dd11295d54e9f0ef0f6a5feeea034e93baa2d414d9a23c8b5240a364339d289be0e9990ccf0f75dc9ece0df579421d16a308db9cbb0d5b1abb7536ca27d50446d6401182904a0f4775f1d03f42c636333d140af72c40b041b8d0a8bfee9da420b4ca96d9e037d1c47a690328d64f843cc48fc291c995c52339e2b30da8983f38e0890353cab530d654458c3d2ca5f978b6814b35bec335141a95c3b1f5c5f651be06c897d5b79930bb8114220ffb94377ad7d0cb3919980013116c9d97fe4f34dde76b42a1286018491eeb227e5d6f07edd762047caecec4787f6cfae0c6e3b7834f5190cda192f508bcd618aea52894a55471406f0df79ea87801883feb0e138b21a547a329d199d41b8eceb76c23d585fb4bf2a0e36c3f07966c95065666138d5c3becba83adb20650c487f6514454cd9ae43fe5ccbbb1ce36fdecedfa69789ad62366619fe6dcfe54a249d165724aede4e4c8e841223b3bdb986f3fda562262cf5138d2364254598e8a295898de7c4e3ac4ed027f3aa6e9312e2eac1a37c2634ce583c7591e56d7cb2aedde079c5e7e8279b000413150a88cb3240dcb61cdd78b0f001204f408f94cb954d3d27127fd60fcefcf823ecb025caff6a729c096837cc7fc2be2dc06034c056218d5ccd492ed4e54e30893ff235cb6e6724eac729e4fbb8bdd0e0de5a16ce525f7ba45c6d4c03b50e38903cfd85d7a7655bfe1c4bfe67c4efb0a1ead54dd12cd2c5b086325442dc194b628cc64d290206e27e91a9f63b792350b5b6ad525db321dd4fd5bf75336b00f32c2c4812de3da97fac5eb0d00faacad15f57267b3a25145d13c91aff7bcce71c9a1cf08e7d60cd739b74f5c073249a2e92021959bca72727e6e00c546e42adb0eb194950ce2cdb67124bf65d73783fc785bd974e726a760c920eacb4ee990812263c9dc0e9552c2e25e62ae80051a0a1f98b74278cbf5ea440eaee1e2822b50c246acd9a20c97e2880335f2844aed179156a924158576463b669516460e9191e11615e8b659bdfa481ebd6d9641090a23dee834af89e38c7bb762f3e9856a4f0212287b652edaebee0bf3ddad5801188cb9cf50fc8f7a61e9f75c9c80a1b558830a31cec17abacb6b8fd64a9096cee9f4de61db40051e8ddd3fd6e1f1682430f3cfc3ea4220bbf8f19c70ab58e3f461a237cb715736928fb08f7b4f8e5169aaa4a4adea693be23c53e4c7b3554f6ff8436385ea97b68d790b0f4d4a9809e32d1f1837c80220c0d8e881eb6d0133aeae88b0b7f56994d92efad5e25a4a072d50b82a1a0062d41491da31cbc0eea55b3077ff622e7e4866b8353d3c579358fd5b2c4ac492dae7fbc04066717e331b54519316a03b63cb5530b1044160b7714d6c42483fea423431908dfdc9e1fbc9d5faa047fde113a427c586a68d3fd756415a4b748774f7d387aefe499efe02f9a77f431b1b6534b9f2bd5d15f954da8d27834747cc2bf0f336a432707ad9648cdda824890d8dc4239390884022c388e589d77de401be9236875d2a4fde26ad8d45223ed96120cf6818664ec86140e6a9d77d75620028fbcd8c5261854f51bbcd4c63c952098b0d36683d34b71a0be116d426110fc8588ab824b56215aea0f23a3efe8889fd5d93344ea5d634893e93b142d1715d41e5e9442cd3e4d5d2e354f6b443562a91cdb2c419e5de7bd1c37dbd1714d246f859f48b2f907f84894399dd0bd68b5de0605d5d6a7a3e413bc8526df6530337bbbd2e2171d655706a18a84b6db5b81bbd2700f9a4fac168b918cb9c5af86e7a13fc7666771a13f9551d44e16060e2f2c6f040fdcdcbbd9d2b71702e5a69b5fff4cd71dc9c8ac083088d9fc7a4c8e9f07be1a17749620ad796c0d8061ecebe4a71c3d7821ddbaf45adc90481ffadb66628b14875c303049d43c7ac17cc57445744d64f9a44067232a61ea8e7c2643734c30ca8663f7649ce21c0037115df6dfb10caf5b7f1d3cd1af1aaa2aff0c8f482eb186d9935f1f539079019266b22be4c644f7e5f3d303256efd2228812e5094cce991c7bd3ed6360156144bea158f7f4050af995007dda962f3702eda56a785821901072042aafbcdf215d8d0a1afeb315e2912e36430c19ae3cfbf11c7f13cb3d254207406cac37dab42fc59c15efc22c2ffb158b8f2c9d29a7be26ccd2f7c0989244dd2ebc475040e876324c9cabb785a1e83cbe0e323f0b6e8cd47ffd80662b6888d70d5d8f01f3cffedd23e70119dace15d307c75fd4b9929abdf0cf06ac2b85780f4794822c75851f45ec3b123deb2084c024b14c938b46b143871f626fcc79804257a11c6b9770abd07b09abf350b3ffdf0a61f6c497964ce1194a587b88e4ee89488a23ffde7a802c877ebcf6418d5ef4e66041c36fa51d5e48aa0c2f7d23b796c57bf8a397c68c0a0588571965ca66a8de4562a2c1d12e81126aaaf17f124161d24524e4a2004dd703c67a40b0ac48353766404e6dc15b8c7b82a4fc10a926dfd40c87855831fe4ed28dcc65a116696edb35428f2b3faad418e230718feef414fb69fb0e50a754d53b9f19e02a8d1d6", 0x1000}, {&(0x7f00000006c0)="0c0a3eac57218c7ea9c17e30f52b6fc5f6df75dcc733773254c135989faad52dde92a9c0b6c92dc02ce30dbb7cacdd92018ed852ef5a66f392aa891ebef195b9dd749ba768fb6cf3de93e2c1e529be24e68050b650bbd3d0f672d4e462ccd183424f937484099550a17d4f22b393115398d957f9c6bafd784ca3f50670c64f7cfc1b8d30c8fca3de4e5b78a0311f7eb0d858b1bbce9a59d0140f5bccdfb9d37aeaec240be4e6e3ccd1a160e20962f18039472c54244508065cbcc74da4345af50268f44b04ea0084965692e458e272caf47ee76e7c6bf29df093b9f085400065367677", 0xe3}, {&(0x7f0000000100)="3ebda9afebd923d4c4e9557e06fee4c2d00d", 0x12}, {&(0x7f00000007c0)="973f482c5f02a3563850a4fb3f74b803b0f219f2d5b0ff1f167cf9d078b008ea9113595b305fdaaf35ee8f25b3e62715550da67598aa8ad4a61a77272ae3efe3bf14349fa6659b0ababebc89e2fc1bcfd7f1a9b50bbdecfbffcb31c6276c38b2668dc50ce1149d691efe4f94da33acfa615538a5c1a27f4f8146c37aa7ed4d5fac5330080f9f310302d9d3ab683b04fa75faea0f7144556d828f8caec7bc0064c5a27c3448e88dc4c6f33f917fccdca860f15acb9a3461f6e1129581a301dde15ed3b0815ecab2ac", 0xc8}, {&(0x7f00000008c0)="eb8fbeea0bb0e12dd699f3ea11f6147cd6cfe8ae2b8132bfe78f01eed0bc53060bb594c2ce335cdd008b9fb2df374df998b05305565666072bee157391ef100b6d7f25557cdfb5639b7baa22a834a98c0c9f4a7f7c8703697df7bb8d14d7dd35232039bb9b578e5421d485e3f99323176ceb0df78eac43c1fb9d8b5e8581e7a89b2e42e1de240fcad3508b6f11580e78ae28e5a5eda61fcb8dc215fc98532058af6fe9ea69a791fc8a03c18a7931517582e99b68459a0b2a65", 0xb9}], 0x6, 0x0) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000040)={0x2, 0x5, 0xd, 0x12, 0x2, 0x80, 0x0, 0x168}) 10:37:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 401.007332][T19336] binder: 19329:19336 ERROR: BC_REGISTER_LOOPER called without request 10:37:38 executing program 5: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 401.058960][T19344] binder: BINDER_SET_CONTEXT_MGR already set [ 401.065564][T19344] binder: 19324:19344 ioctl 40046207 0 returned -16 [ 401.094750][T19346] binder_alloc: 19324: binder_alloc_buf, no vma [ 401.113665][T19334] binder: 19324:19334 ERROR: BC_REGISTER_LOOPER called without request 10:37:38 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 401.155715][ T5] binder: release 19324:19331 transaction 911 out, still active [ 401.156613][T19346] binder: 19343:19346 transaction failed 29189/-3, size 0-0 line 3148 [ 401.164689][T19331] binder_alloc: 19324: binder_alloc_buf, no vma [ 401.195719][ T5] binder_release_work: 7 callbacks suppressed [ 401.195755][ T5] binder: undelivered TRANSACTION_COMPLETE 10:37:38 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/sockstat6\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) r1 = getpgid(0xffffffffffffffff) syz_open_procfs(r1, &(0x7f0000000040)='net/raw\x00') [ 401.246657][ T5] binder: release 19324:19331 transaction 911 in, still active [ 401.257259][T19331] binder: 19324:19331 transaction failed 29189/-3, size 0-0 line 3148 [ 401.282686][ T5] binder: send failed reply for transaction 911, target dead 10:37:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:39 executing program 5: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 401.319029][T19357] binder: 19355:19357 ERROR: BC_REGISTER_LOOPER called without request 10:37:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f00000000c0)={0x8001, 0x24, [0x800, 0x9, 0x3, 0x400, 0x6, 0x0, 0x8, 0x9, 0x401]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:39 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) [ 401.454664][T19369] binder: 19366:19369 transaction failed 29189/-3, size 0-0 line 3148 [ 401.493477][T19371] binder: BINDER_SET_CONTEXT_MGR already set 10:37:39 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 401.511936][T19371] binder: 19368:19371 ioctl 40046207 0 returned -16 10:37:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 401.559730][T19371] binder: 19368:19371 transaction failed 29189/-3, size 0-0 line 3148 [ 401.606942][T19375] binder: 19368:19375 ERROR: BC_REGISTER_LOOPER called without request [ 401.644352][T19381] binder: BINDER_SET_CONTEXT_MGR already set 10:37:39 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = socket$netlink(0x10, 0x3, 0x400000000000a) getsockopt$inet6_dccp_int(r0, 0x21, 0xb, &(0x7f0000000000), &(0x7f0000000040)=0x31b) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x10001) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = shmat(0xffffffffffffffff, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmdt(r4) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 10:37:39 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000000040)=0x7, 0x4) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x2, 0x2}}, 0x10) [ 401.662755][T19381] binder: 19376:19381 ioctl 40046207 0 returned -16 [ 401.666388][T19375] binder_alloc: binder_alloc_mmap_handler: 19368 20001000-20004000 already mapped failed -16 [ 401.673089][T19381] binder: 19376:19381 ERROR: BC_REGISTER_LOOPER called without request 10:37:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 401.715319][T19371] binder: BINDER_SET_CONTEXT_MGR already set [ 401.743619][T19371] binder: 19368:19371 ioctl 40046207 0 returned -16 10:37:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000000c0)=0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x196, 0x0, &(0x7f0000000100), 0xfffffffffffffe41, 0x0, &(0x7f0000000040)="f0"}) [ 401.921096][T19397] binder: 19396:19397 ioctl 40086607 200000c0 returned -22 [ 401.932100][T19397] binder: BINDER_SET_CONTEXT_MGR already set [ 401.939325][T19397] binder: 19396:19397 ioctl 40046207 0 returned -16 [ 401.948039][T19397] binder: 19396:19397 unknown command 0 [ 401.953749][T19397] binder: 19396:19397 ioctl c0306201 20000080 returned -22 [ 401.963228][T19399] binder_alloc: binder_alloc_mmap_handler: 19396 20001000-20004000 already mapped failed -16 [ 401.974461][T19397] binder: 19396:19397 ioctl 40086607 200000c0 returned -22 [ 401.974465][T19399] binder: BINDER_SET_CONTEXT_MGR already set [ 401.974494][T19399] binder: 19396:19399 ioctl 40046207 0 returned -16 [ 401.996891][T19399] binder: 19396:19399 unknown command 0 [ 402.003208][T19399] binder: 19396:19399 ioctl c0306201 20000080 returned -22 10:37:39 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:39 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) gettid() fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/ipv6_route\x00') preadv(r1, &(0x7f0000000640), 0x0, 0x0) 10:37:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:39 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) r2 = semget(0x1, 0x7, 0x80) semctl$IPC_INFO(r2, 0x3, 0x3, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 10:37:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 402.167374][T19410] binder: 19404:19410 got transaction to context manager from process owning it [ 402.182499][T19412] binder: BINDER_SET_CONTEXT_MGR already set [ 402.189174][T19412] binder: 19406:19412 ioctl 40046207 0 returned -16 [ 402.196674][T19410] binder: 19404:19410 ERROR: BC_REGISTER_LOOPER called without request 10:37:39 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000006c0)="ab21988fb9584afd909aa662d4169bf9d0b28007ab511c915d6a44b8b6ff860b791d6d3c2ad5f3e2a862fd09b722e0e855dfbf11a03ec13412154df1d05f78d37c7c00ed2ceade71c068c077296810b0bd534181c2100e28f35a7e719e67966ebb1d0ff8d628a5a83243afe622c458e29c14621d9b61dae1dfc9064423ebc50d054e0efc42b5b83257426416a14334ec021643d285808e39481d3f654fd37180fd54c5faf4a34b3b24844660cc6d3d2d29ec6687a2ee282103aa65a07f18258f27f1d8d5f9584dac789edee82ca3fd6d508009b8c98c4c6ea5d0599ed4c7473312bc103ab65216e23d2e6f20a8cfb5479d844d", 0xf3, 0xfffffffffffffffb) r1 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x1, 0x1) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f00000007c0)={0x8, 0x9, [{0x40, 0x0, 0x8461}, {0x4, 0x0, 0x8}, {0xabc5}, {0x8000, 0x0, 0xffffffff00000001}, {0x80000000}, {0x3, 0x0, 0x8}, {0x5, 0x0, 0xaafb}, {0x80000001, 0x0, 0x100}]}) keyctl$update(0x2, r0, &(0x7f00000000c0), 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r2, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 402.209291][T19412] binder: 19406:19412 ERROR: BC_REGISTER_LOOPER called without request [ 402.221697][T19413] binder_alloc: binder_alloc_mmap_handler: 19404 20001000-20004000 already mapped failed -16 [ 402.233909][T19410] binder: BINDER_SET_CONTEXT_MGR already set [ 402.240972][T19410] binder: 19404:19410 ioctl 40046207 0 returned -16 10:37:40 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x8000, 0x0) ioctl$IMGETVERSION(r2, 0x80044942, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:40 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) ptrace$poke(0x5, r0, &(0x7f0000000100), 0x9) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000000)='maps\x00') ioctl$TCSETA(r2, 0x5406, &(0x7f00000006c0)={0xb2e, 0x40, 0x81, 0x0, 0x11, 0x1000, 0x1, 0x0, 0x7, 0x80000000}) readahead(r2, 0x5, 0x100) preadv(r2, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:40 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video36\x00', 0x2, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000740)=0x10000) [ 402.488615][ T5] binder: release 19422:19427 transaction 927 out, still active [ 402.499817][T19425] binder: 19424:19425 ERROR: BC_REGISTER_LOOPER called without request [ 402.505988][ T5] binder: undelivered TRANSACTION_COMPLETE [ 402.516558][T19431] binder: BINDER_SET_CONTEXT_MGR already set [ 402.523506][T19431] binder: 19428:19431 ioctl 40046207 0 returned -16 10:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 402.546449][T19432] binder_alloc: binder_alloc_mmap_handler: 19424 20001000-20004000 already mapped failed -16 [ 402.573498][T19425] binder: BINDER_SET_CONTEXT_MGR already set [ 402.585456][T19425] binder: 19424:19425 ioctl 40046207 0 returned -16 [ 402.594031][ T5] binder: release 19424:19425 transaction 928 out, still active [ 402.606536][ T5] binder: undelivered TRANSACTION_COMPLETE [ 402.643222][ T5] binder: release 19424:19425 transaction 927 in, still active [ 402.677972][ T5] binder: send failed reply for transaction 927, target dead [ 402.700138][ T5] binder: send failed reply for transaction 928, target dead 10:37:40 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:40 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) sendto$inet6(r0, &(0x7f00000000c0)="0cb04834b6d0a41f0410edc7aa320e975e5ffeecf51dee0d428ae5718635df73af03074c075fa3d417cbc844c0a4c19e3ea533c05e0dfa677fd5302fac934e1569e50d3bda3f7af196674844b5c8e17242eef43a173ef17513b3523cbe05aa05c3783435fc128eb334b72832e482f5efd24a48400990f4dfb6a892ac59a4048a62ec3d4c1164d05e6b6995804dcb37838884781b16bbfb170ef1677ad092c0bcb2d4bee95ac71f63e41c19295caa7672b3ce874a9bd265b65dca5cd076034dc10eda53b4c92d0ac8b8109ec79687b83700e95f50a9b574842e6975287b79d9e58a587cf3d54f6e5d95662071ca269408f9fa248f7bf453a7d0ec97bffce65954357eae494f3a4e6a5420b01e5ad1a30e0f69403913382f98334cce5f9078872811ef30c89f539fe688c74c99786b7680ec78888306eed8e21952f08b526870bfd28988f6481619d1fdc1c0d89cbc75998cac6d4650ca487a459ebf5706a86a38ac3597fe3cbf0298cce69462126bb9077851aa88403708075ab4bba64e0a0a20d1cac81cc9266ee4b1e39375042bbf83da94501b5b0336afe8f9f654f80a5b663110a93f572156fab3e300ca1b353d0bb0d3e5101639edb90b607cb01ec6981109fb4150059f56751b10100213ffe1846ece319ed8e54618968a94b2380db48567956da8ece9b06536f7f1a3c0901cd0c715a5c2ec7e0bad814e8d5ad1948fcb45d2b5b5c6e47294c4f2c88d0ae9ffec4289aef1d5c7b47e80c549a85026eb0befc343ce7d2cf4046271547dc843d503792010392d52fc3bfbad49cea220619e4d191bd911a1541db7862c7efc6ce008d8c7813ce3e0f14427b9c612296b338149d4e02317f5e94c8a33656989143fc997aa228d1c2acd4422b1571b98f2de690b7f9eb2e8e40c20d322f87b4b10a848c6048b272ac48eedbae2133f0952402868e7d02b5bd5f4cd16303eab1cd97d9e55264bc07e499769ad061fbfd0c53a0083e408e122a4ed22703392613214b66b5c513b4be0f97e0d1daebc6aa6178a4470ab1a4203a843b1812b0ae17e6f913d09dfb08364e801be579e72c136804ccfa485feff890be2efc99a78ea0447074399cd1c51872c9bcf5e21c23e9058ab0ec6953d781edf8f6d8e1e8ce030095decf54e14ec83f2b1236ed89ad0f7a228605bf514e6899baf91a11c1e14f436285b9872a896ce6548250a4e46286455c115878610d076314b4665d7d820e3cc7a43ea8a0ef45c468e1d995993f6e1113d51b9c873c1e1bc10560c6f4bd0860e72cbe29303a4a1c0c62572c4ae4ae3bbcf7ad24efbd43e43958caf7abaaffc7eeccdd5d62e20f5a3503a6bd5884454871229d4ed24878080e2644f4268322a89cdb3522d6c49192bac48d62cdae16b3c348736256e05714fde30f1b123c095659a64d9c1c675453a582cab787f02ecdad6c24db31f08a5bae2b5a158688df6738bfca28995143977c5ed50464b97b09d59103edb1d21f0dda2b6df6f24d53d72dd19dcf734165d65f826f723d1c4eee58ec58162f700d63357e71b5f7b5a601472ef7500b70064954831e02f77efa884026e2d4e276f7b40f90d17d2dc50126442039f3577e6972bafcb0baf802946cfd869072d588c21514af08eedd65b39b715b671c902a014ddf70c03563dedf0e8adc0e5fd6d1446f5de7eac9e43aab7c4c4a741538bdeb43088bd46758ce41b30ff36a2b6fa4515dfefdb6dd03f12599450a9d4f67b41b14dc50516a75d012409f3d833f0e0552e254b806bcfa825f11385fb8bc14c98c9003d981204f02d13d68e034ca9ec224b39076f5de9249cdc69782ce998739d513d248fbbc117385231730fe1ab6bb8b926993620e3a77dab6608b5617a26fe1b6febc0659cd9caecc8b64dc5f73938bfa1167a5102054f347f2298a431e65be8d7f2ae858d21b1dbace316747300410c478412cc59197b37afc79b3c4a9fae9c1610572fd9106ca9be730899ddae96c627993ee9978fb032a4bccdb71b1adb7ed274b9c829bdcefd611770ac85af8b3bc36f9929216a3224194346328e933b798f1be8cdf2c7a80078d94b2d52240110ff76ee951e9670b09573eac0b1aa568ba4fc893400c6202396e5097247b85cfdc2a4d2746278e41097d5d56c36958115f54bbe45191a8ce1c18e574a87968bdc5f8cec13ccb4edabffa463da7bc9e2c59b737244e52d7823ee934d1a0e1ff41e34a274d224f441c21fe5c53d4ef584e3666e6f63fac412bae0ed3fdad080984df99fdc71895d6f30872c8f0e8c6c7e7217cdc2f2d104f12a0b426f4bc4398c16ca8d9406ee1a182467a986a00a8839b8d134d55817f0ca1990bf0677596b908c3ecdf0c753ae4edf86d84f00cdf30bfbbe4d9161ba5c7e96c0693d30ae1cf00fd5ba901844841ee26f508c716486142084f550c9a01112b72688719459fd0e7b729d32bba943da0c427b7981a539bc2dc0cb829e1647dc3f89fe7a18183dcba8d6948b770b5bffd7384d57d374e7cc3af4cea728b24f69ccbd57bad3d94adc77f373f75c88c4d150a568d0aad5654bbb651cd262a0b0cf1dab354619d4c0dfc2b577e14384f7870d74986743954fd141e339b81b2f25194bb6f718b61da323aa2fe7d93e0b20b6263fdc7900276849998a92b2e062b67046bf8b7939fbaeb8b879862aab166de05ba2382b08bf618bca3a5a48551d276c4998768a310bc34160510854b8ff959c31214521819e5786ff77fe328ca11e9b1695d49d463a06b3ac12389f93660a90fdb8580e6f170a04c801843f1d3af65fcac686c50072a5925ba596c1a9e31c48c27fc2c4bb34079a248ccacc0ccc16ec987f4b15562f3cffe3c6feb4192ec77981fb56b69632f4bb9d1c8f5db535d95961efa9f9dc83002390aa8ef8c992e573820f038a486614c46b92dc40e92430c54a2af19622ced7764b3253b1f1f91061659196f6f7c42a4c83be3eabe109a41b1df37e0aaefcf24c93e5b6ad1a941435b1208b634f4c9eb818f5ed2cf359980177b497260097b244a82577a57e944f626fea2365f403de73542ceccb10d98f91ceeef0523928b37fc06cae2d6c4a5fea8c2f5eb3d82690a7a8cfc16b4f7d12507d1f6120f10137a5809e5370bbe9104f234325e329b3b978cb7ad52a719757349c4028a4d2a9a320cf55958b2e37521bc6734c26cf88ac5e64907beed89aad35d882853a1e26c494d8f17c9120ba1bf57370cf4be34a3b38bd31575f6f76ac5d3aeb398765b223049157ada8a23953bcc8b17b1b5e639820a785fa5798daa59c9a0b8198e44674903609c598e92cfe3d07c6a3733c5c8a043616b4f1c738d64feb640bae0e358fd223184ab5b63d097c546b4a527e96c82d41628dde606afde0f309da5e3c9a2815ac8bed4ab4b82ae8a7e08441fc66e26da9c4f8da452f646d0da5313c39b5e3a028cb0d2f4f07619d06665534e789f9f463f925ca5d9263aba0834815d07b4a3ad68fa900767033388f599862475a4bd02f125034d2715a560eaebd5fded86c71f251a58141df78b2d7d46c306334356e5a2a9deba956a49cb43cfe7e3192ca0cb06ce433ee6e37de571ea407d876adc40bd72308323e56318b470e1685e9fde74af6d1ebc57a07aa1593f9a99e6fb7eb061697cae299981e824e777c8d03f5f4c63d46a43ab523681b5ccf3ccdece0991c00d5d164ff1997bc53dbfaa3785b6ecb34cbce208eb2574b411ba1e103f02defb376ffea90966b6bfd6427d57eb959d7cf5a567145de80f0f79323c5505e94a889cbd66ee57d75129976a710d3dc2da0fd76e9d35691caffa39b29016402665f6776ee39f4237e9085710430dad58dda1aa73f5e71c815cc2ce797616f346230c4bc9d590e72abed267f99f9f99ef4f6a6b8cfc922d3c9413114b162bd4bc09dde1db55ad17147a1c726a65916b4f5da09570a36094030cb12efd6a5c13973dc71d734b101beb4feb83e9509101b2d625f47def2438d7975b12a38ca3f61c962202142821dafa3eb3d37cc52429087409ca1c60235b45f92cf75460439625984412c1f3fe8eafceaa196ed639280b98b9892f58b7ff48c088c9ebe44deb019a023943b44ccebec4285c98054040881859c5c18393d4c5f1ce719c28a6e9f60ded227f33117e1788b718f77693ae1949d6d21b5036d22853bb60cb2049bd8134354ef3d22a9a67c2f0a52aa5e9137257fa91c2d2c437077e9dad7ef9af90716ef67f807aa5c52bb1ea68b24318a85e1ee1d0e715584f7198b72687b00db6748b9ee81feff2e90e16f726e4d67455d748baa0e6dbdbc6e77adf7fc0e2f520b18eeffd4b49d9ab4e1b41328c052effc100385724ea4e5394e0d961a85f054e04b40b3931a504c9a9c273210091036b0541a07a16221fbd08777576e9a0188b0eab1de884a1ca6d1689c904da7d9cf4612c569751b8d77c7421b8ea96f6410568b90afa1c434e2b180d317a324a742c6fb0f710e5ab54b77007f3c2e68f00bef0e971d673eb1d15bcfae9464a6c68062659e257762a8547ffdd55bae5d6449d3fd95733e85b41c05dfd816b1b02b5f0aa3480e230fccd401f1be4aac34ad4ebf27d8f5a906bdc2aedc754e02ad6e5352dfe64abe694c89dc43b2b1ca5175901f2d6ab9f47d56d3f90ab3021a794fdc0807462fd8545491f88f850a9b70b269acbcdc01994761e03afefc1efb2ce805e0e532963f322665af800e9baa8a2f86522cd4bf22cc5d169127748d30137f8f48d7f1f8835d3c2416dbce3be373c65cf64e3338bcfc339342714f9efec7b0b57d8bf409e9be545dd79c7b8c66f369134222849d9d261c4b2bc5fa5924b27f7f3eb9ebd88e9308c15b2631fd4f6d63090b281b30b3917765ef623eb70981aa809230ab39e369746631ed9e23db68e029d9e7a7cb44b74a93506a9f6c4911efe4035f952769ca05a9a80e6b77d4f68edb78aac6dc4a68dcb7c0447788cb0038b6d044c4340ee2440a22cbc48e118c1b0db431b20d3eef802e0168b54229338b5624bd9b8b6ef7eb785935c1c0b51e1527f04c5c356dfafefa0d279ad7b5f901ea8e2c66f82fc58ad25724d9d40e9526f01cd04d2a9de98e7820cd2799bfdc14b5684049e231785154301c99dd0930efe6d701c672f7828bcc05864d3c894bb823d182f841a57ab8a10af0694bac2e1abbcd6c8ac8be8659083f8cb0a34cb8e2652345a7f7eb420c5699395c15df150660ca7e6d7ff2dee0a25e835841065fa4145d2630bc93d58c48ec67baad510a095b6b440e3384001045cecd7eebcbb438263c9f501ce6d12e12d56bf948dbad214670930e36ec9eacb62a7c250e9c7c3955d6881bd536ffb353b84081a5f0bb0c28c468622b73c0b4a0d9d05f2834d80c7e7352562a70e744002cd7c363a08d7d5f53ba30d9112314f057314b7270e07d1fca385b7f4539ceffeccc72460b6348c011672110ffec8838aecd73db817de978d0021a0c94ea726bbcd37ff2eb346c33e3d2f93d60874b4b5ee31eb457590df8ee1d319ec74b14845b8a90e8ac3cb465e0ad849288075bf2a0070f64789533faa1ff02c9fbe4eb08894d275b2e7c3f3491f805cac348589d7d0ec78c295fa44f37bc77f0dc2f02f77d2cbf3cb4ccbb9b62905fedb8c768cfba3b05b87402c087e65f4df7f2d85de7e14a59e4de34c87b48c03cee43031d59d8d0c51efb5b2d60ff5b6c9ccaf46008dd5b79747c0085457df1b8cf66ae65a3b5f7f78a279b3b9e596fa24695e726e58e77f43a911401e6661a1d9be1bb7b956acc430c748f", 0x1000, 0x80, &(0x7f0000000000)={0xa, 0x4e22, 0x323, @dev={0xfe, 0x80, [], 0x23}, 0x3}, 0x1c) socket$netlink(0x10, 0x3, 0x7) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getpgrp(0xffffffffffffffff) prctl$PR_SET_PTRACER(0x59616d61, r3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = dup(r1) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=0xc) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @empty}}, 0x0, @in=@multicast2}}, &(0x7f00000003c0)=0xe8) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='fuse\x00', 0x1a0c88c, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x800}}, {@max_read={'max_read', 0x3d, 0x9}}, {@blksize={'blksize', 0x3d, 0x200}}, {@default_permissions='default_permissions'}], [{@uid_eq={'uid', 0x3d, r5}}, {@audit='audit'}, {@appraise_type='appraise_type=imasig'}, {@obj_role={'obj_role', 0x3d, 'ppp0('}}]}}) 10:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:40 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x6, 0x4) 10:37:40 executing program 3: r0 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x4, 0x20200) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000100)=0x50, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r1 = socket$bt_cmtp(0x1f, 0x3, 0x5) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000040)=0x2, &(0x7f0000000080)=0x4) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') getsockopt$inet6_dccp_buf(r0, 0x21, 0xc, &(0x7f00000006c0)=""/48, &(0x7f0000000700)=0x30) preadv(r2, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 403.058278][T19455] binder_alloc: binder_alloc_mmap_handler: 19445 20001000-20004000 already mapped failed -16 [ 403.063920][ T5] binder: release 19449:19456 transaction 933 out, still active [ 403.077354][ T5] binder: undelivered TRANSACTION_COMPLETE [ 403.097334][T19450] binder: BINDER_SET_CONTEXT_MGR already set [ 403.141978][T19450] binder: 19445:19450 ioctl 40046207 0 returned -16 [ 403.194188][ T22] binder: release 19445:19450 transaction 932 out, still active [ 403.222187][ T22] binder: undelivered TRANSACTION_COMPLETE [ 403.241157][ T22] binder: release 19445:19450 transaction 932 in, still active [ 403.249820][ T22] binder: send failed reply for transaction 932, target dead [ 403.249903][ T22] binder: send failed reply for transaction 933, target dead 10:37:41 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:41 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:41 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x204401, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:41 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:41 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000004c0)=[{&(0x7f0000000200)="122346f520c54a042ada148c640bd4fa6d2523acaa25ca7ae9faa5315caf59a3e9691ada35e2f4f93d91d386c2062cd44b35a2096e20b4412d4c835542d0ad6536f9d94498e8c33d66a8b84382ecd4451febbbbdf1e03163baa7ff976aba0c2d67651aa623f64b6f7e4403fa067c014fbd580b2761fe17ed469c2351ba85a4a28a008b077f9c9064bf92d6363cacf7f262412e74b58388c3421fc467fdb9bc6691671154f9746fdb4c2c8ddce84ce2d82d77d54e35b8c68c3d95480cc12afbe0561c591390f4e3909c77310cb727963421220c7285000860d145441e2e1dc8f3e837cad59c5dc8b1cf2e8f", 0xeb}, {&(0x7f0000000300)="0315e31c7b0ef6339bfdedc6d82b4d1382bcca0e51660789bba5ca2a14786b0d2bd7a27fe3d2f36f097569b36896c2e7e9a145b5c7581e933d5d73d4ba18ce3d8fe47ba8d615958689847756b0692aa9a9259fbd764a7e8cef399e551a659090dccedf283e15bc3edaf9ac0ea9f6a7ef805964b0c00dea6b7dc1805d876d6de5108d12ca0579d06241d94a636e311551ba98bff80e3917cd8babf9272d24da5e877f19c0b0a5cbc4d58c1a3b49bba36b6a63a135fd", 0xb5}, {&(0x7f00000000c0)="67af43a6655ea27b1e6b3914164548a8db62e43ab03904d5894667d7c923a4d727d27708f3f5443e03ed8e0e208298485957fbd476", 0x35}, {&(0x7f00000003c0)="df336f989a3988750e80ae7915100f76f5350e619d6f3041d4a3e1e311c9ac70640759f857657bd8e6ad2a912736420097615c4f80246e0a191dba876b47cc554dcdd3565db6355aacd030219a94e4c3ad1a498adccb947c716ca688e83c9d65eb06936cc00e0b20ec7376c713710e2d615a47369da5c0a26b8822b0d7369eaa7ceff1261e5eda074304d3c19b0d017be9ed7f885d6a33b5e667bb268ee41cc688faf72da53a5bc45b7e6a1de93038422605cd61017d5acc0fb8f87c7d6ff488c3bd78f205488d8f023b34d27ecba877b08a4f5df3ee500298", 0xd9}, {&(0x7f0000000100)}], 0x5, 0x8) r1 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x2) r2 = syz_open_dev$binder(0x0, 0x0, 0x400802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0000000000000003"], 0x0, 0x0, 0x0}) flock(r2, 0x200000000a) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:41 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x112e}], 0x1}}], 0x0, 0x40000042, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x8, 0x1aaa, 0x3, 0xa0b3, 0x2, 0x280000000000}) openat$pfkey(0xffffffffffffff9c, &(0x7f00000006c0)='/proc/self/net/pfkey\x00', 0x40001, 0x0) 10:37:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x101, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0xaf3f23bc2ddf881f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {r3, 0x0, 0x0, @in6={0xa, 0x4e23, 0x3, @empty, 0xfffffffffffffffc}}}, 0x90) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000280)={'yam0\x00', 0x1}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="009737f8ef000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b840000226f638a6eefdfc8e3b63eba7d167440c8b1adb79552146079295c2e409b36b0e4f1a17acf220e7bb741a61ed9394ef2618490e92c69989ca42e7c4836b236284244c9821f6fd4f811cde37cacb73c575df4eb1d2fa347e07bfd71070000003f5c21acaa03a2cd423bc1e449d2d51a8714dae168c6c244ab80094905ad0d12e20d00d156a2e6b708c2876788af4addc825ba29d1153b0f6bdd5acdc4197edeb0abb52a3dbb50d6cd8b01000000bd151a4a09709ee53fadad17f8ad67be949bbf340b0268fa4e9dbfe164f4b5c753328eae1ec72a6d77710edd8423bf7cf705d1848de937169bb365fd3fbf02015b80a8c3d0a0d5b1"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:41 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:41 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:37:41 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) getpid() getpid() r0 = getpgid(0x0) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='net/rpc\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 403.530475][T19493] binder: BINDER_SET_CONTEXT_MGR already set [ 403.577564][T19493] binder: 19489:19493 ioctl 40046207 0 returned -16 [ 403.596290][T19493] binder: 19489:19493 unknown command 33803 10:37:41 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:41 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 403.620989][T19493] binder: 19489:19493 ioctl c0306201 20000140 returned -22 [ 403.654381][T19498] binder_alloc: binder_alloc_mmap_handler: 19489 20001000-20004000 already mapped failed -16 [ 403.704947][T19503] binder: BINDER_SET_CONTEXT_MGR already set [ 403.742797][T19503] binder: 19502:19503 ioctl 40046207 0 returned -16 [ 403.742816][T19493] binder: BINDER_SET_CONTEXT_MGR already set [ 403.767914][T19493] binder: 19489:19493 ioctl 40046207 0 returned -16 10:37:41 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:41 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000800)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000040)=""/209, 0xd1}, {&(0x7f00000006c0)=""/153, 0x99}], 0x2}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f00000007c0)={0x200}, 0x1) 10:37:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x3, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="00000000000000006a608534611cf2457ce9bd0aae479902bd1d7ef59891975575cc8b2e6c7ab4adce52d03c21a10666ba7f1374f86fdeb8e124b2ddc20db23e7063db4d5cad58bf99e88c95413c3caffc5fe96c2375d1275de54980b87dc047c90415e2caca6c5b70e5eacaa1a416519d98799f93"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:41 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:41 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0xa) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:42 executing program 3: r0 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x488000) recvmmsg(r0, &(0x7f0000009e40), 0x0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800102}, 0xc, &(0x7f0000000080)={&(0x7f0000000700)={0x78, r1, 0x300, 0x70bd27, 0x6, {}, [@TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffffffffc78}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_NET={0x48, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1f}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3800000000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x80000001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1d94}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7ff}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000}]}]}, 0x78}}, 0x10) r2 = getpgrp(0xffffffffffffffff) r3 = syz_open_procfs(r2, &(0x7f00000006c0)='oom_\xf3*j\x00') ioctl$GIO_SCRNMAP(r3, 0x4b40, &(0x7f0000000140)=""/50) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) [ 404.308996][ T22] binder_release_work: 19 callbacks suppressed [ 404.309004][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 404.332387][T19529] binder: BINDER_SET_CONTEXT_MGR already set [ 404.333219][T19525] binder: 19518:19525 ioctl c0306201 0 returned -14 [ 404.345594][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x0}) r3 = mmap$binder(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x4, 0x1010, r1, 0x0) r4 = mmap$binder(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x4, 0xa0813, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x90, 0x0, &(0x7f0000000240)=[@reply={0x40406301, {0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x58, 0x10, &(0x7f00000001c0)=[@flat={0x77622a85, 0x1, r2, 0x4}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0), 0x1, 0x3, 0x37}, @flat={0x77682a85, 0x10b, r3, 0x2}], &(0x7f0000000100)=[0x70, 0x78]}}, @acquire={0x40046305, 0x1}, @clear_death={0x400c630f, 0x4, 0x4}, @free_buffer={0x40086303, r4}, @release, @request_death={0x400c630e, 0x0, 0x2}, @clear_death={0x400c630f, 0x0, 0x2}], 0xc6, 0x0, &(0x7f0000000300)="46772498c743dfb6bed3ba997d137711a59a70f67f6ae4781d41c7012b31d20e99cad1f107bb2034f5f638b0f2c23451e8b574711c1f0b861371a598f5176eb4f9167ac762f7b960f8e48d893648b92ba436c4f56fe18a1570f0c0de37e2891efdb9d6bf03d941ce67da2722d2806d210ee7471d38bcefe6330341b648f3a44bdbcddfc6f843dcc25534087ca5f25ff8200d0d63ae5cca395331c8334aa9c72833d87a4f27a877b5c351537255fb6bd74dd378cd24ea704b9db1041033db534905df87398bb5"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b63ed00"], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 404.354444][T19529] binder: 19521:19529 ioctl 40046207 0 returned -16 10:37:42 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:42 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:42 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$tipc(0x1e, 0x7, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000040), &(0x7f0000000080)=0x40) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 404.509524][T19540] binder: 19537:19540 got reply transaction with no transaction stack [ 404.529105][T19544] binder: BINDER_SET_CONTEXT_MGR already set [ 404.579660][T19544] binder: 19542:19544 ioctl 40046207 0 returned -16 [ 404.580372][T19540] binder: 19537:19540 unknown command 15557387 [ 404.592923][T19548] binder: BINDER_SET_CONTEXT_MGR already set [ 404.602485][T19548] binder: 19543:19548 ioctl 40046207 0 returned -16 [ 404.614290][T19540] binder: 19537:19540 ioctl c0306201 20000140 returned -22 [ 404.626316][T19550] binder: 19546:19550 ioctl c0306201 0 returned -14 [ 404.642283][T19547] binder_alloc: binder_alloc_mmap_handler: 19537 20001000-20004000 already mapped failed -16 10:37:42 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 404.673306][T19540] binder: BINDER_SET_CONTEXT_MGR already set [ 404.700768][T19540] binder: 19537:19540 ioctl 40046207 0 returned -16 [ 404.701003][T19556] binder_alloc_new_buf_locked: 13 callbacks suppressed [ 404.701011][T19556] binder_alloc: 19537: binder_alloc_buf, no vma 10:37:42 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:42 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0xffffffffffffff9f, 0x400) write$UHID_CREATE2(r0, &(0x7f00000006c0)={0xb, 'syz1\x00', 'syz0\x00', 'syz0\x00', 0xdf, 0xa5, 0xdf5d, 0x5, 0x80000001, 0x5, "401ff279c6f9f772cff8075352d9b129252c6e968249e0002770a293e832f4f49930e5f0cbff35abdc5c9008d603887a3ada42bb67ddfa639157d5652fad394b229c02caa5b7facc51d8f705f00e71767db36b5c213245eb5ae41b1f0aa3f64ce9340317a5ec6e443fbe7cc5ab6220843681f07be8ff106c38ea279f5f4b60f97419bfea487b105bf3ab7a006ef9d8c2816a16e4b3509b01ee74f288e89fd4351548db9be64f51d6edf0f72e375fa130ff89ad83c614876aa8158a4e87c6c82492b8df94844ad730951024289a5df8c26cb3397c794883a7b301046db34ac3"}, 0x1f7) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 404.736096][T19547] binder: 19537:19547 got reply transaction with no transaction stack [ 404.759857][T19558] binder: BINDER_SET_CONTEXT_MGR already set [ 404.779330][T19558] binder: 19557:19558 ioctl 40046207 0 returned -16 [ 404.806157][T19558] binder: 19557:19558 ioctl c0306201 0 returned -14 [ 404.837611][ T5] binder: release 19537:19547 transaction 945 out, still active [ 404.857837][ T5] binder: undelivered TRANSACTION_COMPLETE [ 404.875872][T19569] binder: BINDER_SET_CONTEXT_MGR already set [ 404.895289][T19569] binder: 19562:19569 ioctl 40046207 0 returned -16 10:37:42 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000040)) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:42 executing program 3: openat$cgroup_int(0xffffffffffffffff, &(0x7f00000006c0)='memory.high\x00', 0x2, 0x0) syz_open_dev$vcsn(&(0x7f0000000700)='/dev/vcs#\x00', 0xffffffffffffff01, 0x94fafd83d66d482a) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000740)={0xffffffffffffffff}) syz_open_dev$usb(&(0x7f0000000780)='/dev/bus/usb/00#/00#\x00', 0x2ad, 0x200) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/full\x00', 0x80000, 0x0) r2 = socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000800)) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000840)={0x0, 0x4, 0x7, 0x8}) r3 = fcntl$dupfd(r0, 0x408, r2) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r3, 0x40485404, &(0x7f0000000040)={{0x3, 0x3, 0x6, 0x1}, 0x80, 0x8}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0x7, &(0x7f0000000100)={0x1, 0x3, 0x3ff, 0x8001}, 0x10) write$USERIO_CMD_SET_PORT_TYPE(r4, &(0x7f00000000c0)={0x1, 0x2}, 0x2) preadv(r4, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000"], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 404.902437][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 404.902483][ T5] binder: send failed reply for transaction 945, target dead [ 404.908609][T19565] binder: 19563:19565 ioctl c0306201 0 returned -14 10:37:42 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:42 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:42 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000080)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000040)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x1, 0x0) [ 405.020016][T19580] binder: 19576:19580 unknown command 1 [ 405.042794][T19582] binder: 19578:19582 ioctl c0306201 0 returned -14 [ 405.047901][T19580] binder: 19576:19580 ioctl c0306201 20000140 returned -22 10:37:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 405.089429][T19584] binder_alloc: binder_alloc_mmap_handler: 19576 20001000-20004000 already mapped failed -16 10:37:42 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') openat$cgroup_ro(r0, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 405.172520][T19580] binder: BINDER_SET_CONTEXT_MGR already set [ 405.198205][T19593] binder: 19589:19593 ioctl c0306201 0 returned -14 [ 405.200390][T19580] binder: 19576:19580 ioctl 40046207 0 returned -16 [ 405.205534][T19595] binder_alloc: 19576: binder_alloc_buf, no vma 10:37:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 405.260110][ T5] binder: release 19576:19580 transaction 949 out, still active [ 405.284381][ T5] binder: undelivered TRANSACTION_COMPLETE [ 405.319355][T19595] binder_transaction: 20 callbacks suppressed [ 405.319372][T19595] binder: 19576:19595 transaction failed 29189/-3, size 0-0 line 3148 [ 405.324402][ T5] binder: send failed reply for transaction 949, target dead [ 405.386069][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:43 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:43 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10:37:43 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x10000, 0x0) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f0000000080)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:43 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, &(0x7f0000000180)={0x1, '\\'}, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f00000001c0)=""/100, &(0x7f0000000240)=0x64) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) r3 = getuid() r4 = getegid() fchownat(r2, &(0x7f00000000c0)='./file0\x00', r3, r4, 0x0) 10:37:43 executing program 2: r0 = semget(0x2, 0x0, 0xa8) fstat(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000040)='./bus\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f0000000300)=0xe8) lstat(&(0x7f0000000340)='./bus\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000400)={{0x3, r1, r2, r3, r4, 0x194, 0x6}, 0x254d, 0x3, 0x40}) r5 = socket$inet6(0xa, 0x400000000001, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x400000000000a) r6 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x200000200004) sendfile(r5, r6, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x8, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f0000000480)={&(0x7f0000fff000/0x1000)=nil, 0x1000}, &(0x7f00000004c0)=0x10) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r6, 0x84, 0x1a, &(0x7f00000006c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="e00000004c88808b555d9be4175553e5fbbf8a26f519e054a3d21ca476147a6f193bbe8f5ffc6dd97fedfa126f4656dd4b45b3b9cb432aca10359a829cf6ba87ec58920eb316853cd2d039a1ed5b0dc263097ace88ff471b895f8df63a23f069536aea9bed1c23ddf62be4c69bd8633e7b7189edd8c45ac10f04d750f4b4565db78f7da214ea4b72524d8fbc7774cb9b66130dc2b08d1028184b55b9dd06306095fea48d0f400df142f4b74483fec2a47a088a69a521c781107be7f6d53d8169eac39859ab53b3994e4522e6d18337b4cdfa0a3f2aa0c65031e035f2c64e24ad97f6178d734870c98af6fdc948a7366693d8d74e86bf33df1b11ad9db0abc75580ed2035bc01a9984ef45496c4ac7f6317df55456ee6757b8356ec839dcd6b544fb896eead4d75291bd183245f55856b07bffdfe8f0e12a7efb12c7e274b53a1f2e3c5d01f8b8520df5394fabf3d1cd9d246d102d67c8181d314c20fa809e3ad4e2e3cdee0df4101a12eb48f048ea30573b6ebd5ca6340fcda076cb51137dfd54218e0e4955a56"], &(0x7f0000000600)=0xe8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r6, 0x84, 0x79, &(0x7f0000000640)={r8, 0x0, 0x7fffffff}, 0x8) setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f0000000000), 0x4) [ 405.711239][T19612] binder_thread_write: 10 callbacks suppressed [ 405.711249][T19612] binder: 19610:19612 ERROR: BC_REGISTER_LOOPER called without request 10:37:43 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f00000000c0)=""/241) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x5, 0x400) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) [ 405.756298][T19622] binder: BINDER_SET_CONTEXT_MGR already set [ 405.766767][T19621] binder: 19618:19621 ERROR: BC_REGISTER_LOOPER called without request [ 405.792019][T19622] binder: 19611:19622 ioctl 40046207 0 returned -16 10:37:43 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x200000, 0x0) ioctl$PPPIOCGFLAGS1(r0, 0x8004745a, &(0x7f00000000c0)) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000040)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) write$UHID_CREATE2(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="0b00000073797a310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000053001f09ff00000009000000020000001f000000c92e0ff6eb2aaef33a92a344435cb45441584b99a8c61ca9ee61543cd8c744ab57af9874ced4d2eda68bf7630a023577fbbd497f8f1d87dfb9129065f9f3569350507c71fb09d0ad83fe65b9ccecd1a52070f4"], 0x16b) 10:37:43 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:43 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:37:43 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000040)=[{{0x0, 0x1af, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x280, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0xfffffd86}, {&(0x7f00000007c0)=""/110, 0x6e}, {&(0x7f0000000940)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000080)=""/192, 0xc0}, {&(0x7f0000000840)=""/219, 0xdb}], 0x8, 0x4) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000540)={@isdn={0x22, 0xd3a, 0x81, 0x0, 0x3ff}, {&(0x7f0000000480)=""/130, 0x5588dcb438851512}, &(0x7f0000000280), 0x5c}, 0xa0) syz_open_dev$mouse(&(0x7f00000002c0)='/dev/input/mouse#\x00', 0x0, 0x10000) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000a40)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000f80)=ANY=[@ANYBLOB="bc020000", @ANYRES16=r1, @ANYBLOB="100425bd7000fcdbdf25140000001000020008000200060000000400040068000100100001007564703a73797a30000000001000010069623a767863616e3100000044000400200001000a004e2100000001fe880000000000000000000000000101ffffff7f200002000a004e2400000002fe8000000000000000000000000000aa000100004c0004000c0007000800020000100000240007000800020009000000080002000400000008000200240d000008000100110000000c00010073797a30000000000c00070008000200210000005c0104000c00070008000300050000001400010062726f6164636173742d6c696e6b000014000700080001000e00000008000200080000004cb3000700080001001b00000008000400540800000800010018000000080002000100000008000100a100000008000400ff7f0000080001000e000000080003001d8b000008000200760f000014000700080003000500000008000200080000001400010062726f6164636173742d6c696e6b00004c000700080003000000000008000400fd000000080001000700000008000300ff0f0000080001000800000008000400090000000800010000000000080003000000010008000400080000001400010062726f6164636173742d6c696e6b00000c00010073797a31000000004400070008000300b6000000080004004b00000008000400000800000800030000000000080004003e5600000800040007000000086f7981251feab208000100200000002c00090008000100b08400000800010009000000080001000008000008000200060000000800010005000000380007000800012072ffffff0c000400010000000000000008000100060000000c00040000000c000300000000000000000024000600080001002cda000008000100b998000004000200080001000000000004000200ce308714b2"], 0x2bc}, 0x1, 0x0, 0x0, 0x8800}, 0x4040000) [ 406.000051][T19642] binder: BINDER_SET_CONTEXT_MGR already set [ 406.015999][T19645] binder: 19640:19645 ERROR: BC_REGISTER_LOOPER called without request [ 406.031552][T19642] binder: 19637:19642 ioctl 40046207 0 returned -16 10:37:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x400000000005, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:37:43 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:43 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 406.215010][T19657] binder: BINDER_SET_CONTEXT_MGR already set [ 406.235007][T19657] binder: 19655:19657 ioctl 40046207 0 returned -16 [ 406.295328][T19661] binder: 19660:19661 ERROR: BC_REGISTER_LOOPER called without request 10:37:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000080)={r0, 0x0, 0x401, 0x5, 0x3800000000}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fstatfs(r1, &(0x7f00000001c0)=""/4096) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='H@\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:44 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2005000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001a0400032dbd70040000c2a1d862afbd1bcc987603f9a80bdf6ef3a1e4d18eaa44de859411bc96ed821817b049ca100d46f7acc6ce22b04865413df0d9b64943eda723b5fd4e3a60836a4d9befee3d42d0726315c294c7d0878a9ba99b7619178725606fddd32c89f0fd392e"], 0x14}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000004) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000740)={0x0, @in6={{0xa, 0x4e20, 0x86b2, @remote, 0x3}}}, &(0x7f0000000180)=0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000001c0)={0x9, 0x2, 0x6, 0x8, r1}, 0x10) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f00000006c0)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) 10:37:44 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:44 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:44 executing program 2: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000300)={{0x4, 0x6, 0xcf, 0x0, 'syz0\x00', 0x1000}, 0x0, [0x4, 0x7ff, 0xd7, 0x0, 0x101, 0x4, 0x2f8, 0x8a85, 0x4, 0xb9d, 0x3, 0x2, 0x65, 0x0, 0xfffffffffffffff8, 0xf733ed, 0x4, 0x628, 0x6, 0x200, 0x8, 0x6, 0x6, 0x0, 0x1, 0x401, 0x6, 0x9, 0xd860, 0x7f, 0x2, 0x5, 0x5, 0x81, 0xff, 0x7, 0xfffffffffffffffb, 0x40, 0xb6d, 0xffffffffffffff81, 0x2, 0x1, 0x100000000, 0xffffffffffff6c77, 0x101, 0x3, 0x5, 0x3d5a, 0x7fff, 0xae, 0x7, 0x7, 0x1, 0x2, 0x7, 0x6, 0xffff, 0x3b5, 0x1, 0x6, 0xc0, 0x0, 0x0, 0x3, 0x7, 0x3, 0x0, 0x6, 0xbcca, 0x300000000000000, 0x3, 0x3ff, 0x6, 0x4, 0x0, 0x1, 0xfffffffffffffffd, 0x1, 0xafcb, 0x0, 0x8, 0x4, 0x0, 0x2, 0x24b5, 0x4, 0x1, 0x2, 0x5b13, 0x0, 0xffff, 0x81, 0x514d9881, 0x4, 0x9, 0x2, 0x6, 0xddd, 0x3, 0xffffffffffffffc1, 0x7, 0xdd, 0x9, 0x1, 0x400000000, 0x4, 0x4, 0x9, 0x2, 0x81, 0x7f, 0x80000001, 0x4dd4, 0x9, 0x8001, 0x4, 0x6, 0x6, 0xa3, 0x11, 0x3123, 0x0, 0x80000000, 0x5, 0x1c, 0x9ef1, 0xba, 0xea1], {0x0, 0x989680}}) r1 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$VIDIOC_RESERVED(r0, 0x5601, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r1, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 406.489444][T19624] binder: BINDER_SET_CONTEXT_MGR already set [ 406.489902][T19665] binder: 19610:19665 ERROR: BC_REGISTER_LOOPER called without request [ 406.495483][T19624] binder: 19610:19624 ioctl 40046207 0 returned -16 10:37:44 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000bc0)='maps\x00') recvmsg$kcm(r0, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f00000006c0)=""/209, 0xd1}, {&(0x7f00000000c0)=""/11, 0xb}, {&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f00000007c0)=""/170, 0xaa}, {&(0x7f0000000880)=""/255, 0xff}, {&(0x7f0000000980)=""/166, 0xa6}, {&(0x7f00000035c0)=""/4096, 0x1000}, {&(0x7f0000000100)=""/58, 0x3a}], 0x8, &(0x7f0000000ac0)=""/150, 0x96}, 0x40010060) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 406.573153][T19673] binder: 19670:19673 ERROR: BC_REGISTER_LOOPER called without request 10:37:44 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x0}) r3 = mmap$binder(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x4, 0x1010, r1, 0x0) r4 = mmap$binder(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x4, 0xa0813, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x90, 0x0, &(0x7f0000000240)=[@reply={0x40406301, {0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x58, 0x10, &(0x7f00000001c0)=[@flat={0x77622a85, 0x1, r2, 0x4}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0), 0x1, 0x3, 0x37}, @flat={0x77682a85, 0x10b, r3, 0x2}], &(0x7f0000000100)=[0x70, 0x78]}}, @acquire={0x40046305, 0x1}, @clear_death={0x400c630f, 0x4, 0x4}, @free_buffer={0x40086303, r4}, @release, @request_death={0x400c630e, 0x0, 0x2}, @clear_death={0x400c630f, 0x0, 0x2}], 0xc6, 0x0, &(0x7f0000000300)="46772498c743dfb6bed3ba997d137711a59a70f67f6ae4781d41c7012b31d20e99cad1f107bb2034f5f638b0f2c23451e8b574711c1f0b861371a598f5176eb4f9167ac762f7b960f8e48d893648b92ba436c4f56fe18a1570f0c0de37e2891efdb9d6bf03d941ce67da2722d2806d210ee7471d38bcefe6330341b648f3a44bdbcddfc6f843dcc25534087ca5f25ff8200d0d63ae5cca395331c8334aa9c72833d87a4f27a877b5c351537255fb6bd74dd378cd24ea704b9db1041033db534905df87398bb5"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b63ed00"], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 406.677832][T19678] binder: 19677:19678 unknown command 16456 10:37:44 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x40, 0x0) connect$tipc(r0, &(0x7f0000000480)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000040)=""/18, 0xffffffd4}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000080)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) [ 406.722053][T19678] binder: 19677:19678 ioctl c0306201 20000180 returned -22 [ 406.761736][T19688] binder: BINDER_SET_CONTEXT_MGR already set [ 406.787282][T19691] binder: 19677:19691 ERROR: BC_REGISTER_LOOPER called without request [ 406.797444][T19689] binder: BINDER_SET_CONTEXT_MGR already set [ 406.803477][T19689] binder: 19685:19689 ioctl 40046207 0 returned -16 [ 406.809101][T19691] binder_alloc: binder_alloc_mmap_handler: 19677 20001000-20004000 already mapped failed -16 [ 406.820897][T19688] binder: 19687:19688 ioctl 40046207 0 returned -16 10:37:44 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) [ 406.833659][T19689] binder: 19685:19689 got reply transaction with no transaction stack [ 406.850936][T19689] binder: 19685:19689 transaction failed 29201/-71, size 88-16 line 2900 [ 406.864929][T19691] binder: BINDER_SET_CONTEXT_MGR already set [ 406.875657][T19689] binder_alloc: 19677: binder_alloc_buf, no vma [ 406.882162][T19691] binder: 19677:19691 ioctl 40046207 0 returned -16 [ 406.890944][T19689] binder: 19685:19689 transaction failed 29189/-3, size 0-0 line 3148 [ 406.902308][T19691] binder: 19677:19691 unknown command 16456 [ 406.912274][T19689] binder: 19685:19689 unknown command 15557387 [ 406.930981][T19691] binder: 19677:19691 ioctl c0306201 20000180 returned -22 [ 406.943336][T19689] binder: 19685:19689 ioctl c0306201 20000140 returned -22 [ 406.986980][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:44 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:44 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:44 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='wchan\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x8000, 0x0) ioctl$IMGETVERSION(r2, 0x80044942, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:44 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x208800, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f00000006c0)={{0xd4012382015b4f86, 0x3, 0x100000000, 0x1, 0x2}, 0x1000, 0x3ff, 'id0\x00', 'timer1\x00', 0x0, 0x100000000, 0x7, 0x1, 0x3}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 407.157178][T19714] binder: BINDER_SET_CONTEXT_MGR already set [ 407.178058][T19714] binder: 19708:19714 ioctl 40046207 0 returned -16 [ 407.187999][T19716] binder: BINDER_SET_CONTEXT_MGR already set [ 407.194400][T19716] binder: 19712:19716 ioctl 40046207 0 returned -16 [ 407.194452][T19715] binder: BINDER_SET_CONTEXT_MGR already set [ 407.202592][T19715] binder: 19711:19715 ioctl 40046207 0 returned -16 [ 407.236346][T19714] binder: 19708:19714 transaction failed 29189/-22, size 0-0 line 2995 [ 407.253258][T19721] binder: 19711:19721 transaction failed 29189/-22, size 0-0 line 2995 [ 407.264295][T19714] binder: 19708:19714 ERROR: BC_REGISTER_LOOPER called without request [ 407.286569][T19715] binder: 19711:19715 ERROR: BC_REGISTER_LOOPER called without request [ 407.304577][T19721] binder_alloc: binder_alloc_mmap_handler: 19711 20001000-20004000 already mapped failed -16 [ 407.333822][T19721] binder: 19711:19721 got transaction to context manager from process owning it [ 407.345383][T19721] binder: 19711:19721 transaction failed 29201/-22, size 0-0 line 2986 10:37:45 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfc, 0x1080}, 0xc) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:45 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:45 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f0000000080)={0x0, 0x20, 0x9, [], &(0x7f0000000040)=0xee2}) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:45 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x4800, &(0x7f0000000040)="f0"}) [ 407.369237][T19715] binder: 19711:19715 ERROR: BC_REGISTER_LOOPER called without request [ 407.377815][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 407.401340][ T5] binder: undelivered TRANSACTION_ERROR: 29201 10:37:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000080)={0x0, @aes128, 0x2, "215a28ed78bda614"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:45 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0xffffffde}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29, 0xfda2}, {&(0x7f0000000380)=""/193, 0x194}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000040)=""/219}], 0x10000000000000f0, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000600)={0x0, 0x9, 0xb8, 0x6}, &(0x7f0000000780)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000005c0)={r1, 0xffffffffffffff80}, &(0x7f0000000580)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000006c0)={r2, @in6={{0xa, 0x4e22, 0x4, @local}}, 0x6, 0x800, 0x6, 0x7, 0x20}, 0x98) 10:37:45 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 407.430874][T19733] binder: 19730:19733 ioctl c0306201 0 returned -14 [ 407.440096][T19734] binder: BINDER_SET_CONTEXT_MGR already set [ 407.451877][T19734] binder: 19728:19734 ioctl 40046207 0 returned -16 10:37:45 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x100, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000840)={'vcan0\x00', 0x0}) connect$packet(r0, &(0x7f0000000880)={0x11, 0xf8, r1, 0x1, 0x4}, 0x14) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') ioctl$FS_IOC_ENABLE_VERITY(r2, 0x6685) preadv(r2, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 407.571426][T19744] binder: 19740:19744 ioctl 800c6613 20000080 returned -22 [ 407.584876][T19747] binder: BINDER_SET_CONTEXT_MGR already set [ 407.593224][T19748] binder_alloc: binder_alloc_mmap_handler: 19740 20001000-20004000 already mapped failed -16 [ 407.593250][T19747] binder: 19743:19747 ioctl 40046207 0 returned -16 [ 407.613381][T19747] binder: 19743:19747 ioctl c0306201 0 returned -14 10:37:45 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 407.640855][T19748] binder: 19740:19748 ioctl 800c6613 20000080 returned -22 [ 407.661248][T19749] binder: BINDER_SET_CONTEXT_MGR already set [ 407.706332][T19744] binder_alloc: 19740: binder_alloc_buf, no vma [ 407.714423][T19749] binder: 19740:19749 ioctl 40046207 0 returned -16 [ 407.729952][T19744] binder: 19740:19744 transaction failed 29189/-3, size 0-0 line 3148 [ 407.739166][T19753] binder: BINDER_SET_CONTEXT_MGR already set 10:37:45 executing program 3: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xb178d08, 0x400040) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000040)={@empty, @local, 0x0}, &(0x7f0000000080)=0xc) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000000c0)={@ipv4={[], [], @multicast1}, 0x0, r1}) recvmmsg(r0, &(0x7f0000001140)=[{{&(0x7f00000006c0)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @local}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000740)=""/76, 0x8}, {&(0x7f00000007c0)=""/195, 0xc3}], 0x2, &(0x7f00000008c0)=""/94, 0x5e}, 0x7}, {{&(0x7f0000000940)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f00000009c0), 0x0, &(0x7f0000000a00)=""/242, 0xf2}, 0x6}, {{0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000b00)=""/60, 0x3c}, {&(0x7f0000000b40)=""/252, 0xfc}, {&(0x7f0000000cc0)=""/135, 0x87}, {&(0x7f0000000d80)=""/123, 0x7b}], 0x4, &(0x7f0000000e00)=""/207, 0xcf}, 0xdef4}, {{&(0x7f0000000f00)=@hci, 0x80, &(0x7f0000001040)=[{&(0x7f0000000f80)=""/143, 0x8f}], 0x1, &(0x7f0000001080)=""/143, 0x8f}, 0x5}], 0x4, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 407.755753][T19753] binder: 19752:19753 ioctl 40046207 0 returned -16 [ 407.756276][ T22] binder: release 19740:19744 transaction 965 out, still active [ 407.780993][T19753] binder: 19752:19753 ioctl c0306201 0 returned -14 [ 407.788959][ T22] binder: undelivered TRANSACTION_COMPLETE [ 407.813322][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 407.836483][ T22] binder: release 19740:19744 transaction 965 in, still active [ 407.860742][ T22] binder: send failed reply for transaction 965, target dead 10:37:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x8000, 0x0) ioctl$IMGETVERSION(r2, 0x80044942, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0xa200, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000240)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000300)=[@reply={0x40406301, {0x0, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=[@flat={0x0, 0x100, r2, 0x3}, @fda={0x66646185, 0x7, 0x1, 0xf}], &(0x7f00000002c0)=[0x40, 0x38, 0x28, 0x0, 0x38]}}], 0x147, 0x0, &(0x7f00000003c0)="f0"}) [ 407.947600][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:45 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:45 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:45 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) preadv(r0, &(0x7f00000006c0)=[{&(0x7f0000000040)=""/252, 0xfc}], 0x1, 0x0) [ 408.034707][ T5] binder: release 19768:19770 transaction 968 out, still active [ 408.056296][T19769] binder: BINDER_SET_CONTEXT_MGR already set [ 408.068930][ T5] binder: undelivered TRANSACTION_COMPLETE [ 408.080588][T19769] binder: 19767:19769 ioctl 40046207 0 returned -16 [ 408.100787][T19776] binder: BINDER_SET_CONTEXT_MGR already set [ 408.148869][T19769] binder: 19767:19769 got reply transaction with no transaction stack [ 408.157105][T19769] binder: 19767:19769 transaction failed 29201/-71, size 0-0 line 2900 [ 408.161431][T19778] binder_alloc: 19768: binder_alloc_buf, no vma [ 408.166176][ T5] binder: release 19768:19770 transaction 968 in, still active [ 408.177548][T19776] binder: 19772:19776 ioctl 40046207 0 returned -16 [ 408.187322][ T5] binder: send failed reply for transaction 968, target dead [ 408.189703][T19778] binder: 19767:19778 transaction failed 29189/-3, size 0-0 line 3148 10:37:45 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x4800, &(0x7f0000000040)="f0"}) 10:37:45 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:37:45 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000c80)}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x204040, 0x0) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000100)=@generic={0x1, 0x3, 0x9}) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000040)=0xb76) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f00000006c0)=r1) lsetxattr$trusted_overlay_origin(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)='trusted.overlay.origin\x00', &(0x7f0000000780)='y\x00', 0x2, 0x3) 10:37:46 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x2000, &(0x7f0000000040)="f0"}) [ 408.328833][T19769] binder_alloc: binder_alloc_mmap_handler: 19767 20001000-20004000 already mapped failed -16 [ 408.354214][T19789] binder: BINDER_SET_CONTEXT_MGR already set 10:37:46 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) fsetxattr(r1, &(0x7f0000000040)=@known='trusted.overlay.origin\x00', &(0x7f0000000080)='-md5sum/\x00', 0x9, 0x3) [ 408.380032][T19778] binder_alloc: 19767: binder_alloc_buf, no vma [ 408.386412][T19794] binder: BINDER_SET_CONTEXT_MGR already set [ 408.405137][T19789] binder: 19784:19789 ioctl 40046207 0 returned -16 [ 408.415836][T19778] binder: 19767:19778 transaction failed 29189/-3, size 0-0 line 3148 [ 408.447641][T19796] binder: 19784:19796 ioctl c0306201 0 returned -14 [ 408.454482][T19794] binder: 19787:19794 ioctl 40046207 0 returned -16 [ 408.454499][T19797] binder: BINDER_SET_CONTEXT_MGR already set [ 408.473971][T19769] binder: 19767:19769 got reply transaction with no transaction stack [ 408.478218][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:46 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 408.494730][T19797] binder: 19793:19797 ioctl 40046207 0 returned -16 10:37:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1000006, 0x100010, r1, 0x23) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000080)=[@acquire_done={0x40106309, r2}], 0x13, 0x0, &(0x7f00000000c0)="247677fcc0909f28b045ed4fa390e3573131e2"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$adsp(&(0x7f00000001c0)='/dev/adsp#\x00', 0x8, 0x101000) connect$vsock_dgram(r3, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @host}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:46 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000025c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x40000060, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x80, 0x400000) ioctl$IMGETDEVINFO(r0, 0x80044944, &(0x7f0000000080)={0x40}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:46 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x4800, 0x0}) 10:37:46 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:46 executing program 0: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x9, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 10:37:46 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000001200)='/dev/null\x00', 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000001240)) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') getsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f00000000c0), &(0x7f00000007c0)=0x3) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000800)={{{@in=@dev, @in=@initdev}}, {{}, 0x0, @in=@loopback}}, &(0x7f0000000080)=0xe8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000040)={0xae89}, 0x1) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 408.692272][T19819] binder: 19810:19819 BC_ACQUIRE_DONE node 974 has no pending acquire request [ 408.705367][T19821] binder: BINDER_SET_CONTEXT_MGR already set [ 408.722332][T19821] binder: 19808:19821 ioctl 40046207 0 returned -16 [ 408.722336][T19814] binder: BINDER_SET_CONTEXT_MGR already set [ 408.722400][T19814] binder: 19813:19814 ioctl 40046207 0 returned -16 10:37:46 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x4800, 0x0}) 10:37:46 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:46 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/98, 0x62}, {&(0x7f00000006c0)=""/239, 0xef}, {&(0x7f00000007c0)=""/206, 0xce}, {&(0x7f00000000c0)=""/44, 0x2c}], 0x4, &(0x7f00000008c0)=""/28, 0x1c}, 0x2000) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') getresuid(&(0x7f0000000a00), &(0x7f0000000a40)=0x0, &(0x7f0000000a80)) lstat(&(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r2, r3) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x18}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000940)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xfffffffffffffd67}], 0x8, 0x0) ioctl$SIOCGETLINKNAME(r1, 0x89e0, &(0x7f00000004c0)={0x0, 0x1}) [ 408.890780][T19835] binder: BINDER_SET_CONTEXT_MGR already set [ 408.896987][T19835] binder: 19832:19835 ioctl 40046207 0 returned -16 10:37:46 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x4800, 0x0}) 10:37:46 executing program 3: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x402680, 0x0) signalfd4(r0, &(0x7f0000000700)={0x4}, 0x8, 0x800) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000080)=""/174) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f00000006c0)={0x0, 0xffffffffffffffff, 0x2000, 0x100000000, 0x1, 0x401, 0x91, 0x7c, 0x80000001, 0x3ff}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 408.970693][T19839] binder: BINDER_SET_CONTEXT_MGR already set [ 408.989667][T19839] binder: 19836:19839 ioctl 40046207 0 returned -16 [ 409.094999][T19848] binder: BINDER_SET_CONTEXT_MGR already set [ 409.117520][T19848] binder: 19845:19848 ioctl 40046207 0 returned -16 10:37:46 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r1, 0x200004) sendfile(r0, r1, 0x0, 0x80003f000000) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$VIDIOC_S_FREQUENCY(r1, 0x402c5639, &(0x7f00000000c0)={0x8001, 0x5, 0x2}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000100)=0x1) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000140)) write$P9_RSETATTR(r2, &(0x7f0000000040)={0x7, 0x1b, 0x2}, 0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) inotify_init1(0x80000) [ 409.427174][T19861] binder_alloc: binder_alloc_mmap_handler: 19810 20001000-20004000 already mapped failed -16 [ 409.438633][T19824] binder: BINDER_SET_CONTEXT_MGR already set [ 409.443720][T19861] binder: 19810:19861 BC_ACQUIRE_DONE u0000000000000000 no match [ 409.444648][T19824] binder: 19810:19824 ioctl 40046207 0 returned -16 [ 409.444803][T19862] binder_alloc: 19810: binder_alloc_buf, no vma [ 409.466012][ T5] binder: release 19810:19824 transaction 975 out, still active 10:37:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) syz_mount_image$btrfs(&(0x7f0000000080)='btrfs\x00', &(0x7f00000000c0)='./file0\x00', 0xfffffffffffffc01, 0x1, &(0x7f0000000100)=[{&(0x7f00000001c0)="d948c45a483d55ebb17cd2ed84bb9fefea7c7f6c8209f4d5dc28b45e4060d4483536d577590e4b1c0fa72aeb1c25fd30cda71e7fce8498901063d6eedc6045b9a14f38c46aafc22a687309aca2e4adc4d19e3b9a", 0x54, 0x1}], 0x2, &(0x7f0000000240)={[{@nossd='nossd'}, {@compress_force_algo={'compress-force', 0x3d, 'zstd'}}, {@fragment_metadata='fragment=metadata'}, {@nossd='nossd'}], [{@obj_user={'obj_user', 0x3d, '/dev/binder#\x00'}}, {@obj_user={'obj_user', 0x3d, '/dev/binder#\x00'}}, {@appraise='appraise'}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:47 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:47 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) accept4$packet(r0, 0x0, &(0x7f0000000080), 0x80800) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:47 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x4800, &(0x7f0000000040)}) 10:37:47 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:47 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x3b) close(r0) fcntl$addseals(r0, 0x409, 0x5) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f00000000c0)={r0}) ioctl$SIOCRSSL2CALL(r1, 0x89e2, &(0x7f0000000100)=@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}) socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 409.474516][ T5] binder: undelivered TRANSACTION_COMPLETE [ 409.516418][ T5] binder_release_work: 1 callbacks suppressed [ 409.516425][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 409.564459][ T5] binder: release 19810:19824 transaction 975 in, still active [ 409.583490][T19875] binder: BINDER_SET_CONTEXT_MGR already set [ 409.588824][ T5] binder: send failed reply for transaction 975, target dead 10:37:47 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x400, 0x0) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f00000000c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000040)=0x7, 0x4) preadv(r1, &(0x7f0000000640), 0x0, 0x0) 10:37:47 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x4800, &(0x7f0000000040)}) [ 409.616039][T19875] binder: 19868:19875 ioctl 40046207 0 returned -16 [ 409.707526][ C0] net_ratelimit: 4 callbacks suppressed [ 409.707535][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 409.717518][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 409.718936][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 409.724785][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:37:47 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) socket$netlink(0x10, 0x3, 0x400000000000a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f00000000c0)={'security\x00', 0xa0, "02d176b67130daf6783845ef213d0cd36057ab8f087bbb95c8f451c4017b809b810e3e52dc72033da96c70e8f3c99e100a0b0b2da73a8cf2a4506973921e5ca03890b0c1fe94be85bba80561e872f8d805891570075d542eb5d733455782aae492e0408c3988b0ac2eca429e07f9f7d9ba8584db687fddd9efe1f0bb289c5899384e86bc5b621af95be510cea6f07e75bf10323f8006372b57a366e82ed5bd63"}, &(0x7f0000000000)=0xc4) ftruncate(r1, 0x200004) fsetxattr$security_ima(r1, &(0x7f0000000040)='security.ima\x00', &(0x7f00000001c0)=@v1={0x2, "ffc10dbf849a8f0d750efaf36cb3b99f"}, 0x11, 0x3) sendfile(r0, r1, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 409.748629][T19889] binder_alloc: binder_alloc_mmap_handler: 19877 20001000-20004000 already mapped failed -16 [ 409.803119][T19892] binder: BINDER_SET_CONTEXT_MGR already set [ 409.831237][T19880] binder_alloc: 19877: binder_alloc_buf, no vma [ 409.831809][T19894] binder: BINDER_SET_CONTEXT_MGR already set [ 409.850084][T19892] binder: 19890:19892 ioctl 40046207 0 returned -16 [ 409.879256][T19894] binder: 19877:19894 ioctl 40046207 0 returned -16 [ 409.889556][ T5] binder: release 19877:19880 transaction 979 out, still active [ 409.897221][ T5] binder: undelivered TRANSACTION_COMPLETE [ 409.939843][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 409.946069][ T5] binder: release 19877:19889 transaction 979 in, still active 10:37:47 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x817c, 0x2000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:47 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x4800, &(0x7f0000000040)}) [ 409.984145][ T5] binder: send failed reply for transaction 979, target dead 10:37:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x101280, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 410.061136][T19909] binder: BINDER_SET_CONTEXT_MGR already set [ 410.104294][T19909] binder: 19907:19909 ioctl 40046207 0 returned -16 [ 410.117935][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 410.124714][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 410.238704][T19915] binder: BINDER_SET_CONTEXT_MGR already set [ 410.277796][T19915] binder: 19914:19915 ioctl 40046207 0 returned -16 [ 410.359957][T19919] binder_alloc: binder_alloc_mmap_handler: 19914 20001000-20004000 already mapped failed -16 [ 410.365734][ T22] binder: send failed reply for transaction 981 to 19914:19915 [ 410.380609][T19919] binder: 19914:19919 got transaction to context manager from process owning it [ 410.402676][T19919] binder_transaction: 3 callbacks suppressed [ 410.402697][T19919] binder: 19914:19919 transaction failed 29201/-22, size 0-0 line 2986 [ 410.424307][ T5] binder: undelivered TRANSACTION_COMPLETE [ 410.447523][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:48 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x2000, &(0x7f0000000040)="f0"}) 10:37:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11a04840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:48 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) prctl$PR_SVE_GET_VL(0x33, 0x1a4e2) [ 410.467961][ T5] binder: undelivered TRANSACTION_ERROR: 29201 10:37:48 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 410.533445][ T5] binder: release 19923:19924 transaction 985 out, still active [ 410.549347][T19928] binder: BINDER_SET_CONTEXT_MGR already set [ 410.568412][ T5] binder: undelivered TRANSACTION_COMPLETE [ 410.584440][T19928] binder: 19926:19928 ioctl 40046207 0 returned -16 [ 410.591473][T19931] binder: BINDER_SET_CONTEXT_MGR already set [ 410.606295][T19931] binder: 19925:19931 ioctl 40046207 0 returned -16 [ 410.619407][ T5] binder: release 19923:19924 transaction 985 in, still active 10:37:48 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$netlink(0x10, 0x3, 0x400000000000a) r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x200004) sendfile(r0, r2, 0x0, 0x80003f000000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$P9_RMKDIR(r1, &(0x7f0000000000)={0x14, 0x49, 0x2, {0x0, 0x4, 0x1}}, 0x14) 10:37:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 410.643402][T19935] binder: 19925:19935 unknown command 1078501393 [ 410.648314][ T5] binder: send failed reply for transaction 985, target dead 10:37:48 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200800, 0x0) ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f0000000080)=0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:48 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x2000, 0x0}) [ 410.703705][T19935] binder: 19925:19935 ioctl c0306201 20000180 returned -22 [ 410.733501][T19942] binder_thread_write: 16 callbacks suppressed [ 410.733550][T19942] binder: 19941:19942 ERROR: BC_REGISTER_LOOPER called without request [ 410.765045][T19947] binder: BINDER_SET_CONTEXT_MGR already set [ 410.806859][T19947] binder: 19945:19947 ioctl 40046207 0 returned -16 [ 410.818507][ T5] binder: undelivered TRANSACTION_COMPLETE [ 410.825960][T19951] binder: 19945:19951 ERROR: BC_REGISTER_LOOPER called without request [ 410.858437][ T5] binder: send failed reply for transaction 987, target dead 10:37:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:48 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x2000, 0x0}) 10:37:48 executing program 1: openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:48 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000000)=[{{0x0, 0x3a8, &(0x7f0000000080)=[{&(0x7f00000015c0)=""/4096, 0xace44b9f7f7ec525}], 0x1, 0x0, 0x45}}], 0x3c, 0x10100, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000006c0)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000100)='mounts\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f00000000c0)={@multicast2, @multicast2, @dev}, &(0x7f0000000780)=0xc) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f0000000700)={[0x100001, 0x17000, 0x11000, 0x6002], 0x800, 0x14, 0x400}) socket$unix(0x1, 0x5, 0x0) [ 411.037999][T19963] binder: BINDER_SET_CONTEXT_MGR already set [ 411.068318][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 411.076300][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 411.095454][T19968] binder: 19959:19968 ERROR: BC_REGISTER_LOOPER called without request [ 411.109519][T19963] binder: 19957:19963 ioctl 40046207 0 returned -16 [ 411.134123][ T5] binder: undelivered TRANSACTION_COMPLETE 10:37:48 executing program 2: openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 411.143775][T19969] binder: 19957:19969 ERROR: BC_REGISTER_LOOPER called without request [ 411.170865][ T5] binder: send failed reply for transaction 989, target dead [ 411.364286][T19935] binder_alloc: binder_alloc_mmap_handler: 19925 20001000-20004000 already mapped failed -16 [ 411.390576][T19975] binder: 19925:19975 unknown command 1078501393 [ 411.420293][T19975] binder: 19925:19975 ioctl c0306201 20000180 returned -22 10:37:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f00000000c0)={0xb, 0x38, 0x4, 0x5, 0x8, 0x8, 0x4, 0x10c, 0xffffffffffffffff}) write$FUSE_INIT(r2, &(0x7f00000001c0)={0x50, 0xfffffffffffffffe, 0x4, {0x7, 0x1d, 0x3, 0x1000, 0x1000, 0x821, 0xffff, 0x875}}, 0x50) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="11020040", @ANYRES64=0x0, @ANYBLOB="000000000000000038fa9e2201e26f5120d5beb5426638ce4e0c0ea70f6db42c626a0560c1235e3fdbfb2e558f29a5bc9c90cf9549f12974e50000000000000049707b1e7c2c18e72984326b87200748ec455f324a4f424046cab51c679f79b377f73f2d1e04122cd05dde755a727eec7c47d08d9fa9d1a15c4911eee4b1d0bb6282f5ccd6d8e1c465e0315d67b7eb5db6f5b0a0f9f9cfda980c3a8f1100d6"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000340)=[@decrefs={0x40046307, 0x2}], 0x8, 0x0, &(0x7f0000000300)="d052cfc9a4a6a1f8"}) 10:37:49 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:49 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x5, 0x113502) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f00000006c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000740)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r2, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x20400002}, 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x68, r3, 0x400, 0x70bd27, 0x25dfdbff, {{}, 0x0, 0x4109, 0x0, {0x4c, 0x18, {0x5, @media='udp\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x4008050}, 0x40005) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x14, 0x2a, 0x82d}, 0x14}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') ioctl$KVM_SET_BOOT_CPU_ID(r4, 0xae78, &(0x7f0000000880)=0x1) preadv(r4, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:49 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x2000, 0x0}) [ 411.511243][T19977] binder: 19976:19977 ERROR: BC_REGISTER_LOOPER called without request [ 411.547849][T19982] binder: BINDER_SET_CONTEXT_MGR already set 10:37:49 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x2000, &(0x7f0000000040)}) 10:37:49 executing program 3: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x802, 0x0) ioctl$RTC_EPOCH_READ(r0, 0x8008700d, &(0x7f0000000380)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0x37c}, {&(0x7f0000000300)=""/60, 0xfffffffffffffcf6}, {&(0x7f00000006c0)=""/29, 0x1d}, {&(0x7f0000000040)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0xa9, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000440), 0x4) ioctl$VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f00000003c0)={0x1ff, 0x1, 0x4, 0x40000000, {0x0, 0x7530}, {0x1, 0x0, 0xff, 0x1, 0x6, 0x7, "5fc0cbc6"}, 0x5, 0x7, @userptr=0xfff, 0x4}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000700)={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x306, @broadcast}, 0x10, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'veth1\x00'}) [ 411.583805][T19982] binder: 19979:19982 ioctl 40046207 0 returned -16 [ 411.591662][T19986] binder: 19979:19986 ERROR: BC_REGISTER_LOOPER called without request [ 411.624014][T19987] binder: 19985:19987 unknown command 1073742353 [ 411.669963][T19991] binder: 19985:19991 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 411.687641][T19987] binder: 19985:19987 ioctl c0306201 20000180 returned -22 10:37:49 executing program 1: openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:49 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 411.722799][T19994] binder: BINDER_SET_CONTEXT_MGR already set [ 411.758146][T19991] binder_alloc: binder_alloc_mmap_handler: 19985 20001000-20004000 already mapped failed -16 10:37:49 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 411.782504][T19994] binder: 19989:19994 ioctl 40046207 0 returned -16 [ 411.782758][T19999] binder: 19989:19999 ERROR: BC_REGISTER_LOOPER called without request [ 411.789403][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 411.789451][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 411.871305][T20004] binder: BINDER_SET_CONTEXT_MGR already set [ 411.906262][T20004] binder: 20002:20004 ioctl 40046207 0 returned -16 [ 411.913675][T19991] binder: BINDER_SET_CONTEXT_MGR already set 10:37:49 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000040)={0xffffffffffffffff, 0x1}) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 411.944929][T19987] binder: 19985:19987 unknown command 1073742353 [ 411.945076][T20009] binder: 20002:20009 ERROR: BC_REGISTER_LOOPER called without request [ 411.971241][T19991] binder: 19985:19991 ioctl 40046207 0 returned -16 [ 412.028871][T19987] binder: 19985:19987 ioctl c0306201 20000180 returned -22 10:37:49 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 412.175371][T20017] binder: 20016:20017 ERROR: BC_REGISTER_LOOPER called without request 10:37:49 executing program 2: openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:49 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x2000, &(0x7f0000000040)}) 10:37:49 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1, 0x0, 0x23e}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, r0, 0x0, 0x6, &(0x7f0000000040)='em0[:\x00', 0xffffffffffffffff}, 0x30) ptrace$getregset(0x4204, r1, 0x203, &(0x7f00000006c0)={&(0x7f00000000c0)=""/79, 0x4f}) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400202) r3 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_int(r3, 0x10d, 0x10, &(0x7f000079bffc), &(0x7f0000000000)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ustat(0x6, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 412.267100][T20021] binder: BINDER_SET_CONTEXT_MGR already set [ 412.307125][T20021] binder: 20020:20021 ioctl 40046207 0 returned -16 [ 412.330535][T20026] binder: 20023:20026 ERROR: BC_REGISTER_LOOPER called without request 10:37:50 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x1d, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:50 executing program 5: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x2000, &(0x7f0000000040)}) [ 412.404610][T20031] binder: BINDER_SET_CONTEXT_MGR already set [ 412.484798][T20031] binder: 20023:20031 ioctl 40046207 0 returned -16 [ 412.516651][T20037] binder: BINDER_SET_CONTEXT_MGR already set [ 412.547142][T20037] binder: 20035:20037 ioctl 40046207 0 returned -16 [ 412.556366][T20026] binder: BINDER_SET_CONTEXT_MGR already set 10:37:50 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2, &(0x7f0000000040)="f0"}) [ 412.591458][T20026] binder: 20023:20026 ioctl 40046207 0 returned -16 [ 412.591488][T20040] binder_alloc: 20023: binder_alloc_buf, no vma [ 412.641945][T20043] binder: BINDER_SET_CONTEXT_MGR already set 10:37:50 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') vmsplice(r0, &(0x7f00000009c0)=[{&(0x7f00000006c0)="4eccbc6214ccf580d29653e75fd14d2831973bd3e961b95e7b6ce6611ffcffff92b2c7420bf91b1de79d0ecefc0ec4f40d882a27fb02afffd416d9de60a92e4b4a5cd303121a9cb6485ee548251edc74c4fff870d8e145375f48", 0x5a}, {&(0x7f00000025c0)="0f9ac9695b25315c085d52722902c3f4d19a6b1b883f212220f24ca2c99a3e819aaa552cbe0799cef10f3e7d723245f8721f127c5f394af0e059e2662c481c3744d0001c27e6486557ca17be9445452944a55ee482cb30bc197adf738de7841170a5e55421629f4524f711f008e60f2d0e4672b5d3171f6dce5c43ccccfb4ea92986ae95e4ac62d0ff86a98eb801a281b5f2e959ee23f2bba3b5f0b57bb66b7aed34de84c6e9fe502a06082bb4ddafa07d8a6491cad86fc3aa2a5cafd7843f5a511b35f3ceca2864699147f94dc1d4e37fbccbc696dee95570f632c65b67f7b114d71a7b63a1efd6efa6f352dd7b23ac9cbf3589e7c0d956a1d3ee1256c9bd74625ef9c6f70d8c9a7ffc0a4cb9fe378796cb3af3eed07f1540991aae825a6851c93b40b1587a264d02b0460c89cc475b8ea169d1b2f74aa45d6a97a0f21b650b41b0f8c25fc705aab8e6263e8590dc1c1911dd16582f7f2c67e3a774d0a29729a634f1883ebb3412e38b6eb5cc881a0bdf778a34f2a313e00ec72e8b78f5eb89b643ad1c0828e96fba91d0cab525ac341c1a5d4eefbc9f5937a18c4a0dc52246a0771180d4a3a6aadddd4573092795eb8be9ec5ec3197c97a48cbbc86ad44ee7581712c868680c7e0efecf27249e46207b0d9b73ba4b7f21a3ed1abafb08394b0cf678fc16c3f61043808ed7463a66a36b3354f02829906eb47a465bd2aeca48e6f70e014649d5a54c21a585663e298fc28a8f9002cbf6ed53de7777321a1d3387965dedba30db79305e81b7bc50567715bd48c9db7f7529fd02855ce6682df08ad9ebc6a5b509654114b2f6853b4083e7b675f7bacf9fe7efef466edd1034ebb7e37a393c8a8c878aba55d176949669c4114f7ac860de54042f2e38500a09b5b635a3493c8c7104ef4d44a1bdbdee5da8c9c00c555219cac89df7fd12d25df0051c3785343722f7244f5f219052ee67ebff5c934c0460c024bc50d35a8e390691713e0ec0625fa18fb57dc4ae79015c2ecacde6e088d5dbdb52ca9c2372486fa72aa3801f1c1c7ea84d7bd3bb9d89ee3df650671f097f9ac63435098eb1b554d74ab81bda267aba74bda5fa38824f47d34a89d9d9b50c80d0a8d07d09a5987baaf77d5e5b2b2f5f7f9bd7c53806fd9cf0535df3cba4854c706324dd1eb4016a4e3038ac6bca5665d0f05463d70914cab0bf63d2877e0caa38302709c042b0a3e1e17d6d0447691fe3fa3bff6d1498cbb7f1d66809bc9fcd21a468d72bdfe65fa505c3a8f4eeade0054a3cb805976597561f0655408731cf6e87ed37bc22c9300ea08b1fd35bfdd1b1eedb7d8defef7601e33390b4b36489dacbc32fc4287c959bdd879a4e8017434b93721d5b7599187d1ca531b1d4426e68be40f5ba9a02b8a0dbe6d50ecaf78f6dac1c80c2cfa7648a0478923dbf76531f34988899dee32a664f76240ac5b35c770ca83f31249d403ec4a87b3556be1e4630860fcf8669a75fe513f141e6341b7ea0d0f51b4fc61488466a38a9da4cd34c9955d2cd71520a93684f73b7c1b5c9ccfe3b6a1885576d9ea32060d6fb390bdf174b2712a251fac2bfc0a91b5c2458ccddb58d47e9d2722d71717f38fb35bdfd5a716d1a8a48206214de9199e535d02ba25c25288156fc1deece9e286a17abe28ba722203388f07142e6ab0b4aec73e4217d7373fda6b0e6839846ef7242ecc1f85db98ec2daa65a7c1c6f1a413aee442f9c39c45a9240a7eb574ffa2dd51b7379ccc227652a504e2166e2be22d832bbac5ffeb3a8f8ab8160e83c272794c02c65aa2f521fbfad81c18aacc95fb69aa27e5628db8845cf29c2e3c2296b85d819c8e003ce6a2a2fb17cd269dd94f74dd3c3f43588d1e398712ccbf37916c1106d493cf36763be6d3e2bc68a54c558f421c86d117057609001e3d06e7c365c7bfe0208c91ccdda2fb756befa8750b5adc8841284a961ea25454b989a5f28dcf4019c5abf32e0647c69abcfcdaa685bb459d41faa7418273873bf08a9351e32a5344f807bd92aeca52c559b39697ecfe79b37ef7f2b34fe39afd4146d2a17f524a30b2a3db623a0889264f09d8d599125e7fcf8cbcd278d919730e5262bba0e5b93ad07c818aaba37456a944c3da80dda66b031d15a8dfc816f5476a669f0f147b9a8e31c207cd9074c0c80bb9725f946ae08e3381e4196c190b4523f5f2de9906666ae1a50571de1adb05c324240afd16c8be53b786883a74c57ae833d20025f0b14b9afcf8b8983735802dabd71a62fbc8ac9fec20fc84972b6be0449cb197729b95106f05481c6df7808db343093d488a64239edb90e18f45fd2f351456efcde4f94e10a1308490b583dd98093435b94d191760ef8f4edc2d4e379a7f73ba84eafa7ed1cc622bba1c232bf6beae8ffa46fba990131978a484db67135a289affee75e01217d2fc0f8707d30c94e70c102599871278896cef904e32999c3178e80586a12561547efa675c17e0b618a39feefd22f496fa7d7251409bcb65553ef660ed25205e37d6ec3560082f05663d568361c561ac72dbf8ae5536f2ed911ba3e0cc171faf9e7f03eac246c809a1c2ec003a07275e398c4cd0400575f185b234b384e0da1a3b8d1c8b23a6ca51652be0c6b126c57c8360be45c942a025231d29466ba1b1d82bc490afc6387640065bcf680e12c8e3623ab88c33a3246ba08ac9c68aa10a317e9bf95c6c9b088499342bfd3841cb2edab7a76d74cb7ef42a3b1a4d1c5f9d9cd653319895e383f00ec5d70bcc017447c57249f7231aff5c766e601ac39d666db614ee107483dc2ea505233106b08630ba2750c900adc58a643715e5d18ca528c04ff79c8d18e91f4777063a002de2a7d4ebaaeae1ff69d3e07bf897f6bac593514d32dc04e723a863cef26558dfe87031c2d42d7c32b9ae57a07e09374d27aba4fbf247b83e0c8c0fef9b736d88f98888b7e2023d250278ef6afdbc7cbb81d301ade2f61513dff6cf3c2d37d0aa99a9d2428263f58a35d975d0b67f08733e831cf831864172b4ffb98e0db779ed95db4444dfe5c3bc2b54d91cc23a49a3284ab17d15ce5f57d72f58b753882a4227827be3517434a06d08ba99e57788254a83c711fd278b10a289671603c6dcf8809a216d8ead78ea80359781616c1c2b06bc643379ca74d65df889cee8d44e5269075f355aeb3fa9a8230e72ea1c8f2761b6b54adcd496a8b709c01d843f0d427c2477ac7d35c427986cd9cc61f0b8d1ea54d38ef7de16e8be1853dab2e43186cdef0c05d21e3328315c4353bd78557ae7cb6c4159dc0088d790aa77d6078059b5a108848c307a51ca3df4f7f5121482ea4e07732f4e1a1deb2b2c7f49faef61428c40840f2381d0793525c59d0a6cf0f8c170ce77e27c149f9c06dc6428347a1fb15f15a686bd3460461b6d7ed9ce999d244a482f922c9bc5dd17c51cfc31610151c70e5d55c3c5595ce18d6ae879045c631f887e751b0f01c2249b50a6ae5da1cde47557b66a2b35c5a6806c7f689ed0bc5eb21d54d5ff2a969156e96f7ee50e68f71ccfad7d9941fe83538573754893e7a35891c776383e31573a60225e5a464c6e6ca851a005acd144da6a909e9aef5287a935132948179732a0d82e022d29bfc71d761ae906352476c3e57681a7f473f3fa2646920f46e6616694c438dbaba1f2bd0a5a89d6133bd7c05db784357275e100111949636101b4fb31f54ff73abf39a26e014d83f1cb97151740a5a4f4a3c97350140ab588ed04282af5da55613a9444ebf41525b2f74c74d5ab655c15c4ad515d6eb4c9b06035a6d0dc52b82215ec3c4a5cc73f04a538157189a7c334030faa046279a3bc18890ec53b8302ae3ea591fc63ff50e877a2eb0a5919ecd0bec615fb99292f1aff53a437d66cfe7a14f12e97e111014403a353812312a72fcfe60cdb1f0544c8aab5d6dbbfc5acdb0fdaf4ccd667e340e8cb4cb1f84798de1d5e5b843362429f03e748a147991f2500c01646bdfdb98daf18940ce45908e98df330e7faf1470ecee36f9823c8eabf43b95ed565f03a3255595b7323eb9a9260fcdf91a0f330efd3595c0f5af9f069ea126e35e540d1c04ade26fbead73a5c0e4e217084e9fb9c45965a0948c7638400b99b81933c3c11cc40b1908070c210dd7bee20fc7cecc66d6f227c65f51afd2e593981c7b07ef7a5683ac8f56f3d0629990b8a647ab25a2124820050fafa4f84870edd8642f2d8e1de2619223c8bd42efd1d7468889efcef4417133ec3399e3fc47caca8cd9965265cc28e066ffa22c45d20c0c47cd6de6bc8c04fb29413f8f6de33629ee45ea1aa3810bf44c4120fea984979e7d569b575842be35045f966c282a601ee5ea808358443c809e669db83b2dd6b2cad18401f05f2038bc96771e0aab2de55943345822278d31d7c6cd2529c4b165bae2e6b899fc97dd17e31d6f0cda52141b6901224bdb3fc9de5d942e19357716f3d587902eba654fe07f0ea132bc44c699b2f2013198bc08af0cbe787fadfe223a283227332e585c96c1c74038a8648bad280289e2dbcda009b6790ee2e7a42db3b2180bca09a2008fc99fc3fdbf71cd7e87c8de1463bc2a605ffae18f7e722d84bcbdfdd0a092bf3779dc67873e901899e4b86496429b2889ae90e3b8111eb51627df9aadd3daed0ce92001f00a78d97f3818c06713a49f775c81708a0d2a5dc32a0673ab8fd5c42576250a57c84ad6938cde158609e850d4d26a83ce88e3f3b0d69a76be9cc2a2508508eccb25abe7c2df12bf37297251622f92767ed75d1d39a5cedfb68fe3898ba576cad5769118e3eef1736d641c1c57a4c5f255c41d893844594097d5efb85bd1ada0307ea057f28cb078196f89aae06f18edd4403bf4da099fe1372a1bf9975a00f90d6d035d25dd4d87bcea6096163fe7d60e32c273bfbb26371fa3d07d400f551b34c545f83ad0b6c5ee39c75073348a83a614c7c06c384b2243b4f849a1999f057a4897a5f145d98209eaa999cc5986b4256a4e58e6664a8e56be09fa7a38807576502e9abc06a2351d596230e1dc4bba92a8b0c084a4db2b088819b44f1c54c9e077e68f8cf1b824550d22f88de3b915dc2e0fd360825ad356f73dd5846eb566cb98536fcc4729ff42e67d29a2f3b14dbfd832f3b42fc5ce4b3b259b92a2be005ab5014b6324c07161c2842fcbaba3204e6c140f6f7e454ab62b9a207bee10ed1db6e30273b9c8b285d4568d1ef98ae9ce06306b29768da1d83aa84540588d2299022595380f62c208c55bf3bf64802abdbfd2be400c96e68354c8777a34aff3b16046deddc0de71135e6cafdad43e6e50acdc39cec260e5805389a7cf82d5bc40ebdb61735e397dba00bca7555f111eb3796bd1ce236c0cb061463f5a939abf5c89f5fb81e8f02c69245e13b1f346625c1b7de14cd5126c3ec059f1fa80a0487904752f474d83ef8ec5b37a1349fde44852a46a4c4aee89c5e8cc5a72694a40536d47a9b718e6f116f21fc68314516d78e94d6a97ace2d6d31cd38912c3f5a15737b1b12ccdef2de2f0db9df81413480e8413c57569976b003686aaa6f0b5fbe99943a79b4d94cb539e7b6ff3e571df7600a994d90d2f864f4776a61326e5560f7aedf24a3b36c4ca4a8b0b74d3ce0cfaf7205f3a06ee1952ec4fe698362e56a04fd8b5ac3280034b9f701f1c3f2605b8cee97e22370075470216c88088756eecf103cec57f3a795409fd6917e870aafd7cdfb66a133f71a7d6fa540256581f8bb7d691af1bab29f710f85d7f426aa8f21ffd", 0x1000}, {&(0x7f0000000740)="200fcf3aa19e23060f7b28a214b8b1039b00a60510cd258503465d41c5e268926fc7a3870e5413b24f782ddff896af25ccf7736f8198b3f91d6faba2c52e1001a73daf1fec99fe0489c8bea6830a713ae1002f354db4665e7d874a08f7365607f8f8b6fca52ab94ddef3bff4149fb62e8eed78232f138d5f06922af96ca32af621eac3917400dda94c3d77c97075dc030d716ccc71199ac474a52f416da222100a8200efe51ead", 0xa7}, {&(0x7f0000000100)="c1fc428383fa774fdbd61c1b923c567dc2b55f4734f27d372ee6c0ec0e2c2d43bb9bd15d37eaea854a", 0x29}, {&(0x7f0000000800)="c10b7144751c5d2d45532013b4fc4f3ec1a40b0aad221118c5cdd5483703c9b9b8838016de5e75179e45022e7ec08872912f361b09", 0x35}, {&(0x7f0000000840)="759519336e3ce97b7361745f2804dbe37a12e91b5430ade04ffb41443239a23840a20f29c7602f63b424d103f198b1c6ba1c327c59baaedc2c4eb97af9a09d4617002e11610e339e8d4567e6e43c88d0df83a720c18927483506a7f78cc0383e83daf686bd6976b874b6312646645f60e9a5b754d6447da27dd7a059ff71a224bc11e737dde357f8142f16c426c4340822bed9e08e405684dc8f66ccdce0f3996f123eec72dc8cdd32c07be1aed4c1b8ed1b6678866281c30c47373f16065cfb95c8bed0d5aa55b4d2800ba344642fab6a677139cdc044a35ca762", 0xdb}, {&(0x7f0000000940)="0fa8687b17ea5d3f08c41190b10501cd824b1eb3e7273487ea61f0e7d92166b71322491f484eceefdfa4b1b834eeeaf2b72012750b603685056a03e9d060512cd3a162b58c3e255199c4c9c0a63fc011ef0d4c8013b700c2b431b90d445dbac82a60", 0x62}], 0x7, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000040)={0x4000000000000000, 0x4, 0x7fffffff, 0x3, 0x0}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0xf59c, 0x20, 0x20c, 0x16a, 0x1, 0x8, 0x4, 0x5, r1}, 0x20) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 412.707345][ T5] binder: undelivered TRANSACTION_COMPLETE [ 412.715628][ T5] binder: send failed reply for transaction 995, target dead [ 412.729987][T20043] binder: 20023:20043 ioctl 40046207 0 returned -16 [ 412.737027][T20047] binder: BINDER_SET_CONTEXT_MGR already set [ 412.763226][T20047] binder: 20046:20047 ioctl 40046207 0 returned -16 [ 412.776941][T20040] binder: 20023:20040 transaction failed 29189/-3, size 0-0 line 3148 10:37:50 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:50 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x48, 0x800) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) [ 412.847494][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.867082][ T5] binder_thread_release: 6 callbacks suppressed [ 412.867095][ T5] binder: release 20016:20017 transaction 997 in, still active 10:37:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000100)={0x9, 0x6, 0x9, 0x3, 0x7, 0x10001, 0x4}) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f00000001c0)=""/216) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0xfffffffffffffe3d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="26ee4637c9fa35c77a70750f0cb8501ad15e7c"], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 412.966981][ T5] binder: send failed reply for transaction 997 to 20046:20053 [ 413.040561][T20061] binder: 20060:20061 ioctl 40207012 20000100 returned -22 [ 413.074670][T20064] binder_alloc: binder_alloc_mmap_handler: 20060 20001000-20004000 already mapped failed -16 [ 413.112919][T20061] binder: BINDER_SET_CONTEXT_MGR already set [ 413.133424][T20064] binder_alloc: 20060: binder_alloc_buf, no vma [ 413.157901][T20061] binder: 20060:20061 ioctl 40046207 0 returned -16 [ 413.182212][T20064] binder: 20060:20064 transaction failed 29189/-3, size 0-0 line 3148 10:37:50 executing program 2: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r0 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:50 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:50 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0xfffffffffffffefd}}], 0x400000000000004, 0x40, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') mincore(&(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f0000000040)=""/188) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 413.223083][T20067] binder: 20060:20067 ioctl 40207012 20000100 returned -22 [ 413.235660][ T22] binder: release 20060:20061 transaction 999 out, still active [ 413.267579][ T22] binder: undelivered TRANSACTION_COMPLETE [ 413.291327][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:51 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:51 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000006c0)={0x0, @in={{0x2, 0x4e22, @local}}}, &(0x7f0000000100)=0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000780)={0x8, 0x4, 0x0, 0xffff, 0x40, 0x7f, 0x6, 0x4, r1}, 0x20) ioctl$RTC_WIE_ON(r0, 0x700f) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000040)={0x5}, 0x4) ioctl$CAPI_GET_ERRCODE(r0, 0x80024321, &(0x7f00000007c0)) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000940)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r0, &(0x7f0000000a40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x70, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x91}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'lapb0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x8000}, 0x850) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f00000008c0)={0x101, 0x0, 0x10001, 0xff}) accept(r0, &(0x7f0000000800)=@sco, &(0x7f0000000880)=0x80) [ 413.315913][ T22] binder: send failed reply for transaction 999, target dead 10:37:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000080)=0x0) getpriority(0x2, r2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="a0822f040f774f596448da31d6cc922272b4", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f00000001c0)=0xffff, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) getpgrp(r2) [ 413.493087][T20087] binder: 20085:20087 unknown command 70222496 [ 413.497891][ T5] binder: undelivered TRANSACTION_COMPLETE [ 413.505300][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.513472][T20087] binder: 20085:20087 ioctl c0306201 20000180 returned -22 10:37:51 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:51 executing program 2: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) 10:37:51 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000700)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000880)={{{@in=@loopback, @in6=@dev}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f00000009c0)=0xfffffffffffffe89) 10:37:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x2, &(0x7f0000000040)="f0"}) 10:37:51 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 413.674105][T20098] binder: BINDER_SET_CONTEXT_MGR already set [ 413.684249][T20101] binder: BINDER_SET_CONTEXT_MGR already set [ 413.696807][T20098] binder: 20096:20098 ioctl 40046207 0 returned -16 [ 413.710013][T20101] binder: 20097:20101 ioctl 40046207 0 returned -16 [ 413.722237][T20087] binder: BINDER_SET_CONTEXT_MGR already set 10:37:51 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') openat$vimc1(0xffffffffffffff9c, &(0x7f0000000240)='/dev/video1\x00', 0x2, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040), 0x4) recvfrom(r0, &(0x7f0000000100)=""/213, 0xd5, 0x40002140, 0x0, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000080)={0x5, 0xf, 0x4, 0x10e000, {0x77359400}, {0x3, 0x0, 0x2, 0x81, 0x400, 0x8, "68a10441"}, 0xc74, 0x0, @offset=0x16bc, 0xfc}) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000280)) [ 413.748713][T20091] binder: 20085:20091 unknown command 70222496 10:37:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 413.791889][ T22] binder: release 20096:20104 transaction 1002 out, still active [ 413.802569][T20087] binder: 20085:20087 ioctl 40046207 0 returned -16 [ 413.817177][ T22] binder: undelivered TRANSACTION_COMPLETE [ 413.864914][T20091] binder: 20085:20091 ioctl c0306201 20000180 returned -22 10:37:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x4, 0x1b, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="116348401d7beb68be234cc726e903806a2ffa38965b56564f56115dc62e2cc09c3cc3e19f9771fe3b3e1480ecccb146f0d3455748763f6bf669e0ec12b8352303ddce9a07a3299ec1ff827244c3ecf91f78fc852da8f8fd8a86dafcd39b76f28d38912fe6fc37f57fe4f766e7b14249530141bf6b31d146cdc0759fc5839de71fd70535bd398c48ac2f3233", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 413.922786][ T22] binder: release 20085:20087 transaction 1002 in, still active [ 413.937906][ T22] binder: send failed reply for transaction 1002, target dead 10:37:51 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000006380)=""/219, 0xdb}, {&(0x7f0000006480)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x3, 0x3) recvmmsg(r0, &(0x7f00000061c0)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000040)=""/89, 0x59}, {&(0x7f00000006c0)=""/142, 0x8e}, {&(0x7f00000000c0)}, {&(0x7f0000000780)=""/144, 0x90}, {&(0x7f0000000100)=""/19, 0x13}, {&(0x7f0000000840)=""/16, 0x10}, {&(0x7f0000000880)=""/114, 0x72}, {&(0x7f0000000900)=""/255, 0xff}, {&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/136, 0x88}], 0xa}, 0x4}, {{&(0x7f0000000b80)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000cc0)=""/138, 0x8a}], 0x1, &(0x7f00000035c0)=""/4096, 0x1000}, 0x53}, {{&(0x7f0000000d80)=@generic, 0x80, &(0x7f00000010c0)=[{&(0x7f0000000e00)=""/160, 0xa0}, {&(0x7f0000000ec0)=""/96, 0x60}, {&(0x7f0000000c40)=""/47, 0x2f}, {&(0x7f0000000f40)=""/51, 0x33}, {&(0x7f0000000f80)=""/60, 0x3c}, {&(0x7f0000000fc0)=""/33, 0x21}, {&(0x7f0000001000)=""/187, 0xbb}], 0x7}, 0x9}, {{&(0x7f0000001140)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001480)=[{&(0x7f00000011c0)=""/136, 0x88}, {&(0x7f0000001280)=""/220, 0xdc}, {&(0x7f0000001380)=""/234, 0xea}, {&(0x7f00000045c0)=""/4096, 0x1000}], 0x4}, 0x9}, {{&(0x7f00000014c0)=@nfc_llcp, 0x80, &(0x7f0000001580)=[{&(0x7f0000001540)=""/61, 0x3d}, {&(0x7f00000055c0)=""/242, 0xf2}, {&(0x7f00000056c0)=""/138, 0x8a}, {&(0x7f0000005780)=""/129, 0x81}], 0x4}, 0x101}, {{&(0x7f0000005840)=@pptp={0x18, 0x2, {0x0, @loopback}}, 0x80, &(0x7f00000059c0)=[{&(0x7f00000058c0)=""/206, 0xce}], 0x1, &(0x7f0000005a00)=""/128, 0x80}, 0x6}, {{&(0x7f0000005a80)=@isdn, 0x80, &(0x7f0000006040)=[{&(0x7f0000005b00)=""/65, 0x41}, {&(0x7f0000005b80)=""/187, 0xbb}, {&(0x7f0000005c40)=""/247, 0xf7}, {&(0x7f0000005d40)=""/84, 0x54}, {&(0x7f0000005dc0)=""/27, 0x1b}, {&(0x7f0000005e00)=""/164, 0xa4}, {&(0x7f0000005ec0)=""/177, 0xb1}, {&(0x7f0000005f80)=""/190, 0xbe}], 0x8, &(0x7f00000060c0)=""/204, 0xcc}, 0x6}], 0x7, 0x42, 0x0) [ 413.992232][ T22] binder: release 20114:20115 transaction 1004 out, still active 10:37:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 414.073277][ T22] binder: undelivered TRANSACTION_COMPLETE [ 414.103455][T20120] binder: BINDER_SET_CONTEXT_MGR already set [ 414.127977][T20120] binder: 20119:20120 ioctl 40046207 0 returned -16 [ 414.128280][ T22] binder: send failed reply for transaction 1004, target dead 10:37:51 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) semget$private(0x0, 0x3, 0x104) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000080)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0x3f}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000140)={r2, 0x8c, "0baec49a9075fb2c770a9ba6b2538c3853bab3b78b1d14b00fa893b22c909d8c967898caa78fa186e5db6ee0230007930219b08b6e6fa34f0dd59f0bb00c0feef6abc76324e69f3b33cc66116c283a886986f0353e2667d79dd588c0fee23f190463a8d3d877eced257781533115062f1498796a5d5f1e2afc63942c044a86402874f912156eb37f2eef2603"}, &(0x7f0000000200)=0x94) [ 414.181159][T20120] binder: 20119:20120 got transaction to invalid handle [ 414.211954][T20120] binder: 20119:20120 transaction failed 29201/-22, size -9217674109927712865-6288665483624434924 line 2995 [ 414.232733][ T22] binder: release 20125:20126 transaction 1007 out, still active [ 414.251879][ T22] binder: undelivered TRANSACTION_COMPLETE [ 414.309232][T20120] binder: BINDER_SET_CONTEXT_MGR already set [ 414.310146][T20127] binder: 20119:20127 got transaction to invalid handle [ 414.347924][T20120] binder: 20119:20120 ioctl 40046207 0 returned -16 10:37:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 414.348268][ T22] binder: send failed reply for transaction 1007, target dead [ 414.406052][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 414.447658][T20127] binder: 20119:20127 transaction failed 29201/-22, size -9217674109927712865-6288665483624434924 line 2995 [ 414.524641][ T5] binder: release 20134:20135 transaction 1010 out, still active [ 414.560859][ T5] binder: undelivered TRANSACTION_COMPLETE [ 414.566750][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 414.618428][ T5] binder: send failed reply for transaction 1010, target dead 10:37:52 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:52 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') r2 = getuid() r3 = getegid() fchown(r1, r2, r3) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getegid() 10:37:52 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000300)={{{@in=@dev, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f0000000400)=0xe8) ioprio_get$uid(0x3, r2) r3 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x6, 0x2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f00000002c0)=0x1) r4 = dup2(r1, r0) setsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0xa, &(0x7f0000000080)=0x20, 0xffffffffffffff61) r5 = mmap$binder(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x9, 0x10810, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x2, 0x1}, @transaction={0x40406300, {0x3, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x18, 0x40, &(0x7f00000000c0)=[@fd={0x66642a85, 0x0, r4, 0x0, 0x3}], &(0x7f0000000100)=[0x18, 0x30, 0x48, 0x78, 0x30, 0x40, 0x0, 0x40]}}, @increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f0000000240)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) lseek(r4, 0x0, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:52 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:52 executing program 2: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) [ 414.714457][T20145] binder: BINDER_SET_CONTEXT_MGR already set [ 414.740889][T20145] binder: 20144:20145 ioctl 40046207 0 returned -16 10:37:52 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') [ 414.763799][T20147] binder: BINDER_SET_CONTEXT_MGR already set 10:37:52 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 414.824790][T20147] binder: 20146:20147 ioctl 40046207 0 returned -16 10:37:52 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0xffffffffffffff5c}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000000c0)={@empty, @empty}, &(0x7f0000000100)=0xc) [ 414.903916][T20147] binder: 20146:20147 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 414.907606][ C0] net_ratelimit: 16 callbacks suppressed [ 414.907614][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 414.923276][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 414.976925][T20165] binder: BINDER_SET_CONTEXT_MGR already set [ 414.992358][T20147] binder: 20146:20147 got transaction to invalid handle [ 415.046766][T20147] binder: 20146:20147 transaction failed 29201/-22, size 24-64 line 2995 [ 415.065950][T20165] binder: 20162:20165 ioctl 40046207 0 returned -16 10:37:52 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 415.102552][ T5] binder: send failed reply for transaction 1013 to 20146:20159 10:37:52 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) socket$rds(0x15, 0x5, 0x0) [ 415.148196][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 415.154446][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 415.180033][T20159] binder_alloc: binder_alloc_mmap_handler: 20146 20001000-20004000 already mapped failed -16 10:37:52 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 415.227783][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 415.233767][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 415.275069][T20169] binder: BINDER_SET_CONTEXT_MGR already set [ 415.315139][T20169] binder: 20146:20169 ioctl 40046207 0 returned -16 [ 415.381601][T20147] binder: 20146:20147 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 415.466458][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.473475][T20147] binder: 20146:20147 got transaction to invalid handle [ 415.482577][ T5] binder: undelivered TRANSACTION_COMPLETE [ 415.510773][T20147] binder: 20146:20147 transaction failed 29201/-22, size 24-64 line 2995 [ 415.517703][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 415.530039][ T5] binder: send failed reply for transaction 1015 to 20146:20159 [ 415.577684][ T5] binder: undelivered TRANSACTION_ERROR: 29201 [ 415.583892][ T5] binder: undelivered TRANSACTION_COMPLETE [ 415.615930][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:37:53 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) 10:37:53 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') write$P9_RREADLINK(r0, &(0x7f0000000080)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) 10:37:53 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:53 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x4000, 0x0) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000100)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r3, 0x8, 0x70bd28, 0x25dfdbfd, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:53 executing program 2: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) 10:37:53 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 415.729928][T20189] binder: BINDER_SET_CONTEXT_MGR already set [ 415.736060][T20189] binder: 20188:20189 ioctl 40046207 0 returned -16 [ 415.778544][T20189] binder_thread_write: 22 callbacks suppressed [ 415.778554][T20189] binder: 20188:20189 ERROR: BC_REGISTER_LOOPER called without request 10:37:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:53 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2000, 0x0) ioctl$KVM_DIRTY_TLB(r0, 0x4010aeaa, &(0x7f0000000080)={0x6, 0x9}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000700)={'bond_slave_0\x00', {0x2, 0x4e23, @local}}) accept$unix(r1, &(0x7f00000000c0), &(0x7f00000006c0)=0x6e) [ 415.832176][ T5] binder: send failed reply for transaction 1018 to 20188:20189 10:37:53 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 415.935173][T20209] binder: 20207:20209 transaction failed 29189/-22, size 0-0 line 2995 [ 415.947546][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 415.953396][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 415.957678][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 415.965348][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 416.011874][T20213] binder: 20207:20213 ERROR: BC_REGISTER_LOOPER called without request 10:37:53 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0xfffffffffffffe67, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1f7, 0x0, 0x374}}], 0x1, 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x80000, 0x0) ioctl$IMSETDEVNAME(r0, 0x80184947, &(0x7f00000006c0)={0x80000000009, 'syz1\x00'}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000880)={0x0, 0x4c, &(0x7f0000000800)=[@in6={0xa, 0x4e21, 0x6, @loopback}, @in={0x2, 0x4e24, @multicast2}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e23, @broadcast}]}, &(0x7f00000008c0)=0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000900)={0x0, 0xd72f}, &(0x7f0000000940)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000a00)={0x0, @in={{0x2, 0x4e23, @local}}, [0x6, 0x9, 0x5, 0x7, 0x7, 0xe8, 0x5, 0x8, 0x3, 0x9, 0x4963, 0x4, 0x9, 0x3, 0xfffffffffffffff8]}, &(0x7f0000000b00)=0x100) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000980)=@assoc_id=r2, &(0x7f0000000b80)=0x4) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000700)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000100)=0x84) 10:37:53 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 416.085157][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:54 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) 10:37:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:54 executing program 0: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:54 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x5, &(0x7f0000000100)='maps\x00', 0xffffffffffffffff}, 0x30) r0 = getpgid(0xffffffffffffffff) r1 = getpgid(r0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x220000, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000040)={0xab, 0x8}) r3 = syz_open_procfs(r1, &(0x7f00000006c0)='net/icmp\x00') preadv(r3, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 416.508538][T20229] binder: 20188:20229 ERROR: BC_REGISTER_LOOPER called without request [ 416.517027][ T22] binder: undelivered TRANSACTION_COMPLETE [ 416.537946][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 416.544169][ T22] binder: release 20188:20228 transaction 1021 out, still active [ 416.552044][ T22] binder: undelivered TRANSACTION_COMPLETE 10:37:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x10, 0x0, &(0x7f0000000100)=[@clear_death={0x400c630f, 0x2}], 0xfffffffffffffe25, 0x0, &(0x7f0000000040)="f0"}) 10:37:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000300)={{{@in=@dev, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f0000000400)=0xe8) ioprio_get$uid(0x3, r2) r3 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x6, 0x2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f00000002c0)=0x1) r4 = dup2(r1, r0) setsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0xa, &(0x7f0000000080)=0x20, 0xffffffffffffff61) r5 = mmap$binder(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x9, 0x10810, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x2, 0x1}, @transaction={0x40406300, {0x3, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x18, 0x40, &(0x7f00000000c0)=[@fd={0x66642a85, 0x0, r4, 0x0, 0x3}], &(0x7f0000000100)=[0x18, 0x30, 0x48, 0x78, 0x30, 0x40, 0x0, 0x40]}}, @increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f0000000240)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) lseek(r4, 0x0, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 416.566206][T20231] binder_alloc: 20188: binder_alloc_buf, no vma [ 416.580292][ T22] binder: release 20188:20229 transaction 1021 in, still active [ 416.588079][T20231] binder: 20230:20231 transaction failed 29189/-3, size 0-0 line 3148 [ 416.631793][T20239] binder: 20238:20239 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 416.641363][T20241] binder: 20230:20241 ERROR: BC_REGISTER_LOOPER called without request [ 416.650102][ T22] binder: send failed reply for transaction 1021, target dead [ 416.660806][T20245] binder: BINDER_SET_CONTEXT_MGR already set [ 416.670145][T20245] binder: 20243:20245 ioctl 40046207 0 returned -16 10:37:54 executing program 0: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:54 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) gettid() r0 = getpid() r1 = syz_open_procfs(r0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 416.677707][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 416.687980][T20246] binder: 20238:20246 transaction failed 29189/-22, size 0-0 line 2995 [ 416.692049][T20239] binder: 20238:20239 got transaction to invalid handle [ 416.719886][T20248] binder: 20243:20248 transaction failed 29189/-22, size 0-0 line 2995 10:37:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 416.729350][T20245] binder: 20243:20245 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 416.739445][T20239] binder: 20238:20239 transaction failed 29201/-22, size 24-64 line 2995 [ 416.757621][T20250] binder: 20238:20250 ERROR: BC_REGISTER_LOOPER called without request 10:37:54 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000040)=""/192, 0xfffffffffffffcd7}, {&(0x7f0000000540)=""/219, 0xdb}], 0x8, 0x0) 10:37:54 executing program 0: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 416.851060][T20259] binder: 20258:20259 transaction failed 29189/-22, size 0-0 line 2995 [ 416.886642][ T22] binder: undelivered TRANSACTION_ERROR: 29201 [ 416.893355][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000440)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000300)={{{@in=@dev, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f0000000400)=0xe8) ioprio_get$uid(0x3, r2) r3 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x6, 0x2) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f00000002c0)=0x1) r4 = dup2(r1, r0) setsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0xa, &(0x7f0000000080)=0x20, 0xffffffffffffff61) r5 = mmap$binder(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x9, 0x10810, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x68, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x2, 0x1}, @transaction={0x40406300, {0x3, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x18, 0x40, &(0x7f00000000c0)=[@fd={0x66642a85, 0x0, r4, 0x0, 0x3}], &(0x7f0000000100)=[0x18, 0x30, 0x48, 0x78, 0x30, 0x40, 0x0, 0x40]}}, @increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f0000000240)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) lseek(r4, 0x0, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 416.900293][T20260] binder: 20258:20260 ERROR: BC_REGISTER_LOOPER called without request [ 416.991454][T20267] binder: 20266:20267 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 417.046315][T20267] binder: 20266:20267 got transaction to invalid handle [ 417.050300][T20272] binder: 20266:20272 transaction failed 29189/-22, size 0-0 line 2995 [ 417.109951][T20267] binder: 20266:20267 transaction failed 29201/-22, size 24-64 line 2995 10:37:55 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) 10:37:55 executing program 0: syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:55 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) timer_create(0x6, &(0x7f00000000c0)={0x0, 0x2d, 0x6, @tid=r0}, &(0x7f0000000100)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 417.361951][T20282] binder_alloc: 20278: binder_alloc_buf, no vma [ 417.387023][T20282] binder: 20278:20282 transaction failed 29189/-3, size 0-0 line 3148 [ 417.451733][T20248] binder_alloc: binder_alloc_mmap_handler: 20243 20001000-20004000 already mapped failed -16 [ 417.481525][T20287] binder: 20278:20287 ERROR: BC_REGISTER_LOOPER called without request [ 417.486684][T20248] binder: BINDER_SET_CONTEXT_MGR already set [ 417.518638][T20248] binder: 20243:20248 ioctl 40046207 0 returned -16 10:37:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="f5ffffffffffffff2d462ed367293b964ab300afbfed2148e751647eae3cbd7d4add4578975c985086edd087b2dcc556739817063a68cb73546c3deba7fbe29b14d2e2ee3b4eaef0344cf24e28352456342ed83d64c5018fcbde9c3a055173edbedf6ea74f9ee2c8d42e872f1eeccaf63bd82a12afd1f9584ee0fee6ce10de1ab853d70fcaf4b7daf8f3f26afa81d52dae2afe643186b26d0b67407c2be4b1b61a3494cdf5c658c4209d9fa134d94a8f96245d75cd9b617573af99ce8da2f2d590cea329e392c5d59d17f7f15e33c364c7e89a5467d02c56e17256341f5958e074ac15ad3fb43cadb69be0d4b24e427c563d488e"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0b6300005033904319c1edb6466f5d2f5fb60a9f3458e2351b5bbaaeedb4e4ea86400442bb51d7b7217015e61f80409b0b9f88940d0a93cd0b8e21d7dbdd1566f44114262a77d9018e4fe8ac713ddf9e1ae76a43cfac92ff9b7786f3b642720737d3a2d480be81992fd3a1a1df254d26171d76fb55e76788136a9ae0989e8a9866ed83d6dced1fccc191efc73b430c665f6be546fdb4c3467f5cf21ff3911b6a81e9f408f9cb8bef044aa567126b55180a25d5aefc0cfa65dc479028b8fff4c9cd2d6fb3330f8fe83fb5c67f27db217756c26e5fbfec3d4ba82a5f88a794bac060e48a57a852517bec557b45ef2b77e630e1b8228b6e72cbfdc8e25f6926610a9606dfb24cf30597b94ec6c0310db9cc49c33085971cb57f8caea7ea0f848e98b04a52a579e80dd6a1e330073480af9d107f768b5a95167fd0c665c735adb73b4421d3675d7c3adf82"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:55 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') r2 = getuid() r3 = getegid() fchown(r1, r2, r3) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getegid() 10:37:55 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:55 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 417.664471][T20295] binder: 20294:20295 ERROR: BC_REGISTER_LOOPER called without request [ 417.696055][T20304] binder: BINDER_SET_CONTEXT_MGR already set 10:37:55 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000040)={0x401}, 0x4) 10:37:55 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') r2 = getuid() r3 = getegid() fchown(r1, r2, r3) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getegid() [ 417.727941][T20304] binder: 20302:20304 ioctl 40046207 0 returned -16 [ 417.740961][T20304] binder_alloc: 20294: binder_alloc_buf, no vma [ 417.761336][T20305] binder: BINDER_SET_CONTEXT_MGR already set [ 417.792211][T20305] binder: 20303:20305 ioctl 40046207 0 returned -16 [ 417.798814][T20304] binder: 20302:20304 ERROR: BC_REGISTER_LOOPER called without request [ 417.839305][T20311] binder_alloc: 20294: binder_alloc_buf, no vma [ 417.859608][T20305] binder: 20303:20305 ERROR: BC_REGISTER_LOOPER called without request 10:37:55 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') r2 = getuid() r3 = getegid() fchown(r1, r2, r3) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) getegid() [ 417.884866][T20305] binder: 20303:20305 ioctl c0306201 20000140 returned -11 [ 417.926583][T20311] binder_alloc: binder_alloc_mmap_handler: 20303 20001000-20004000 already mapped failed -16 [ 417.942948][T20305] binder: BINDER_SET_CONTEXT_MGR already set [ 417.955395][T20305] binder: 20303:20305 ioctl 40046207 0 returned -16 [ 417.955416][T20318] binder_alloc: 20294: binder_alloc_buf, no vma 10:37:55 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:55 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) recvmmsg(r0, &(0x7f0000009e40), 0x3b3, 0x4000000000000000, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') write$P9_RREAD(r1, &(0x7f0000000040)={0xdf, 0x75, 0x2, {0xd4, "7f297beabd568c7656b7e7c6be8ba558c5fe7ad25fd655ac7392530b34ba0eaf915f423355c44f1d77eea26326119b55e4f9f2f1eff2e457fe08c6aa9a9ad4967ca34085f904020fc9bc66cd5212bb4235b2493bb883a93dd1072ee1027e62b75e71652591edfefda4b68396b01ff468c2692be4ceb079bbf22115ae14f2a05918e69062e1412fe6cfc1b978ea0784c9b7d6700c04823397638dada6d9937f21efc7d0fa8227b5d1d81d7050a0a7ac3172d09c25e99a1c523ad794105bd8ec8326620ef3e2bc08ab48c29d8995885d64fe54cc18"}}, 0xdf) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) r2 = request_key(&(0x7f00000006c0)='asymmetric\x00', &(0x7f0000000700)={'syz', 0x3}, &(0x7f0000000740)='maps\x00', 0xfffffffffffffffe) r3 = add_key(&(0x7f0000000780)='dns_resolver\x00', &(0x7f00000007c0)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$negate(0xd, r2, 0x100000000, r3) 10:37:55 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') r2 = getuid() r3 = getegid() fchown(r1, r2, r3) preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000280)={0x1ff, 0x7b43}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x90400, 0x0) ioctl$KDGKBENT(r3, 0x4b46, &(0x7f00000000c0)={0x3, 0x8001, 0x2}) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffff9c, 0x29, 0x2a, &(0x7f00000001c0)={0x10000, {{0xa, 0x4e23, 0x6, @remote, 0x1}}}, 0x88) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:55 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') getuid() getegid() preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:55 executing program 3: accept$inet(0xffffffffffffff9c, 0x0, &(0x7f0000000040)) r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x283, 0xc00) recvmmsg(r0, &(0x7f0000000100), 0x76, 0x20, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 418.116936][T20331] binder: BINDER_SET_CONTEXT_MGR already set [ 418.156677][T20331] binder: 20329:20331 ioctl 40046207 0 returned -16 [ 418.221864][T20340] binder_alloc: 20294: binder_alloc_buf, no vma 10:37:56 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:56 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') getuid() preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:56 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f00000006c0)=""/219, 0xdb}, {&(0x7f0000000380)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000040)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}, {&(0x7f0000000540)=""/219, 0x56}], 0x8, 0x0) 10:37:56 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:56 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f00000000c0)='setgroups\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:56 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0xffff, 0x80800) ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000080)) recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 418.575921][T20356] binder: BINDER_SET_CONTEXT_MGR already set [ 418.594189][T20356] binder: 20355:20356 ioctl 40046207 0 returned -16 10:37:56 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)) preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 418.627997][T20356] binder_alloc: 20345: binder_alloc_buf, no vma 10:37:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x408, &(0x7f0000000000)="0a0800023c390d3188b070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x2}, 0x10) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$int_in(r1, 0x100005452, &(0x7f0000000040)=0x19b) sendto$inet(r1, 0x0, 0x0, 0x900000020000000, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10) [ 418.905824][T20375] binder: BINDER_SET_CONTEXT_MGR already set [ 418.912497][T20375] binder: 20329:20375 ioctl 40046207 0 returned -16 [ 418.919795][T20340] binder_alloc: 20345: binder_alloc_buf, no vma 10:37:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x101000, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000200)=0x7ff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000080)={&(0x7f0000000480), 0x83, &(0x7f0000000440)={&(0x7f0000000380)={0x14, 0x22, 0x0, 0x0, 0x0, {0x5801}}, 0x14}}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') bind$alg(0xffffffffffffffff, &(0x7f0000000780)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x38) ioctl$KVM_ASSIGN_DEV_IRQ(0xffffffffffffffff, 0x4040ae70, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x600}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000180)='security.SMACK64IPOUT\x00', &(0x7f00000002c0)='selinux\x00', 0x8, 0x3) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000100)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0xf000, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:56 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) 10:37:56 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)) preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 419.134732][T20386] binder: BINDER_SET_CONTEXT_MGR already set [ 419.140979][T20386] binder: 20383:20386 ioctl 40046207 0 returned -16 [ 419.158209][T20386] binder_alloc: 20345: binder_alloc_buf, no vma 10:37:56 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:56 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 419.280892][T20384] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 419.305185][T20384] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 10:37:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:57 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000080)) preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:57 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:57 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 419.580307][T20397] binder_alloc: 20390: binder_alloc_buf, no vma [ 419.603550][ T22] binder_release_work: 11 callbacks suppressed [ 419.603558][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:57 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) 10:37:57 executing program 2: r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 419.862920][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.870007][T20384] binder_alloc: binder_alloc_mmap_handler: 20383 20001000-20004000 already mapped failed -16 [ 419.945135][T20414] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 419.980604][T20384] binder: BINDER_SET_CONTEXT_MGR already set [ 420.027924][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.041995][T20384] binder: 20383:20384 ioctl 40046207 0 returned -16 [ 420.055824][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.131181][T20414] net_ratelimit: 7 callbacks suppressed [ 420.131192][T20414] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 10:37:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:57 executing program 2: r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xfffffffffffffffd, 0x190010, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x10000, 0x25) ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f0000001300)={0x1, 0x0, {0xfffffffffffffff9, 0xffff, 0x3004, 0x1, 0x7, 0x6}}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000011c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f00000012c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x68, r2, 0x2, 0x70bd2d, 0x25dfdbff, {{}, 0x0, 0x4109, 0x0, {0x4c, 0x18, {0xa14b, @link='broadcast-link\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0xd0}, 0x1) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x20000, 0x0) setsockopt$inet6_dccp_buf(r3, 0x21, 0xc0, &(0x7f00000001c0)="a0df9910dc7a6fac88db6f81f01ce8297cb38da8cb62219c761a12f8ed51d5d8e58e1c972432ce4dedf809405abdbf25e46087447d0e4cf307b13c61f8ad0d712ff9ad958ec7d583fbbeef810a293d43e67926feea988b954bb28d4854375faacfc513cadbd78d83eb619c12a0baf92429f9eab0050df83d306ab52acff4938a7e7acbb8da7f33dd5d5479668ec1f180e0c171e737eb78c0f692799040975c3d7b55cb9240c3f162c7fd538469a6b076fa948994cda9916f05fc80b93e004d796a960256a2163699a9e07b5b3d2ace8e00aca9b3c34a8ad86db11a8a74af16bbff4268337f5007bba5f8331ac43d2c50765680210bf6e40a3a934f72d1b5215dadf3cc573a5c7f129e6780e0deb99c4e7d95a8673e4c2ea2bc18c3af36b79c10059d2be46b39c1e089b466ba224cd97d6da04e7c7cae8a77a03f74f695d602af505b47b7263631d8617a7d3929da0c7797913d5977995edb63ad0ae387a2e28c09a7aa34b7b6e14ec6d14aaafdd4c40d52bad497587387d8d591db841f775cdd55312e6a60a21e78b4bcc44a404ec459f046af786f15c455b1c4b1f5a16e44f14c893127437b039a092526c338a4f8c421e57a98808f5671c9be4253d0a01bc5762558f54a4f89246d0d5b6061a9fd87a917d1f9f57169f74504e01c75e22d7a9af3a2800458c944506fa3c93a40ed8ce8769bc1e1136b730e8eea52d784f54ed3d35087defa3c60f2c4feae1e6bfa6b38ec786b917e1ef805e53a10ced41bbe5fca6a701b3acdc0ef85fb83fdb572d212d8b296a5292af6cd241cb1c77f3214920dc250588c1d92d60dc583b0e018a1639d70cd883cc89df36611a5adc058ad5631a11ad4e746e7b6d32efb006fcc5e40964f7697d9535868d8c937fbd2ada99b6e51f8ca26c075d0dfd23542df9d403ddc75ab79ad96262af01dbcf84ec0f4539ddc3e404499bf13a046bc1edfb12a6b73871cbfce114e4d976d7afa984fc88934af566f0d1241d265d0e30dcac544bf60d55d03438db98e22372a54f4337c0174cfac79294fc64cbe6b6fdd67630d3c0bdbda6b7c19c0d7caffe361967e68e1b309db85d2763370621254f987fbf0e25d681d316f69425c727e3cae6ce565013b431a82c718c8d98141783b9d621c6b087e2ebba6133a72090f6f33147171157b0b32e6ade4cfef013ee0eef4d0a96a132fcd463d975826267f9739d23dc59530f4ab29074e66057346ef5f4a0ed642fe98e066028902ff7a8265b29c7fd1fc6b7bbbaf59badd0ccf93ec84d44f1a4aeaeacea7549d60b544d5680b458eee9c84939ce1aa85f8a0a72a479704c5578590f754d89e1ffd6d1e83ce5f016cbbd116a83ed2a11dd71f97416b4fbea5a1825ecc08caf6e6e8d3aeeaef5b6aa71a75eeca360022bc4176536d7879194e23c2b1ed3ec23d7f008bfeb30dde2158af966d331f566e1722e5fd8d3888595b9f4d5c4b896adb443ff1b3b5e3f5144d71153b53b36dba93d64fb7d3dfe5acf38f7cd334388cebbf5dccb99db65a6818fd100d88828684ea63a915d34ab020a059e8b03ded455221f35dda531664e442a37cba9a0ec7839d891c25d49d02343d76b10d9c85294700534c3f8415c37a086da0ad6fb41a34c27988fbfe801b256f92a9ae0120e4da50880128805a6bb6e9e2280c3a435ac5e7746e7ac8854823e6f28b0c511cd8aa48795eb14dd807f0b21b8927aacb3b1e85d6d09b19833d2b5fac52218c3f1826f986b0e9cf3d3dfc68410fd456962f8b6cb7c7a5e32ccef8aae4f7eb9943e49648e631940f65c6390da2c19ff02e835cfd92a0d2bbd2ec904cc4231d89f3ee67bd64ba527787d0d721e5d4fdb3ba977c1d17a5c197c3adba580dd1eb9957f6fb7422f887e227d41928f5044b80ad62dbb10b1b38297b1ebe765408ece8f3ffa045c12ea9f934e02e88820df18cc2bfbb859155702f4c9e60d42501e5d8cb7d30c5fafc9b61830ae8993fb1f4281e4d420fd9d58db8c0b2269773761edb2a5a2d6e3583976a31948c97840db5e0e8cec9a93f8940086e4e3b6053f557d98081f21d0d9bed12025886e87b237fb77a2326104deda4a1ad2216c6f51a210711cec52085515200cc20bdfc5c18cddd3c98d204055543d553128d16b22bfaa2feebcdec21fb9c0dee715de747698b877bee6a8fe88e5cdba76a8b919332b8f3c8cda2596ab124a01ad4594b1edacb5c5c950b3eddfcfbbdc7467679a443a0057db17d64f0c58fb0f32d54d5cefb9c229979b33ceb7565ff5b41233ceba6f18a42ebe1db3c09cf45079d776e0cc13c0b3e6216c32abfbbe1818e3cced5df587bf69e04fb76450a532461ebd1ea6054984686110715b2cf7b472ffd771613e62db4090d9fdc9373441228ca23a781fea162af4591184a56e11a5135e67f344aa2263aefbc061add566d5390dfdd0e9065a1041f7b3a33708b143696fd9a89bf05e1c2247a5c8d71ba65282b8467a289d52145913ea88050d21bf28f50a60a1aeec216e85a062ed59d400afb703ebe663efdc3d2415a9cc422551158507253baa7602536e3ed9adc34e2981ca61abadd842fe653792a06cba8de4533069d3f670a74828e92eec6cb39fbc3aeb789789a3734081e342c95a8bc7febd839ccb995e00630c1996e7f85cbc5944ec5fd8a97200d9fe8747c0ec5a23297e93b912a4b30faa5207b7d7d3743b259b021a2d392131373bb1ba037ddcd00deb9f9a3d6f9ab8e41fb33009c94f64f6058f37b6193939090bb18bb15bdee62d09e1f2c936af2a102f407bfc1438bc249dab8f371c00d62e2c0811276492af4cd28b5e0c2e65ce3d2c91977d594f395fdd0d6af8fb1de5324d1fd50ea45326c8cbf9ffa867eb3304fb4c6c240eb8167a889135d5ceb02bd8bbf28e3463644eb7c6a4e659698e7bfefe1e0dd48aec77adcfad373f20b35cb863683d0923c8956f95e11c03cc1ef53f407d8ca7d0797c89b42901e6b1ca3a3478794e8319c1f4b89d960e3831b982301f53f30c8a3962eddd21fa2574111ce71c0aa28ca5a2c355025e2f8b67e5fedb0f85225a1aedf768be307155c87a7c506e4fe78793bfe8928d3546443d810c591d8ace030e8d0fb54b387f53ff89324417ee6a8659cef37739d439a6decd67e726bf7228a5ac48bd93eabe1689fa855b8c51ec67ba3c519ff17b0974cedb7ab66dd36c71cca6d8be09f1216345a2de2f4d9decc4650dc239374e6e995bc66e760c3ae91c32f585a37af6721f927e06276e1cd10182206d39c8e0948a8ff113dac47c642c19da3987c5c475df6fc39ebde6a1b134dd4c3fd10d9955c33f7edf7ef019311424ca1b1817dc6b44a12e335e433b0591b4f228958ebe89a3959deb98ba18dc2becfdd2a46f9181e49c1185cf5434fdcf5eaf8a8862d45725dffa1370454ad4504ff3dc452f7409cd53bad4640292359f0498c25aa9181477d67fc2a5498d3c544b236c138df5ccdfe7b0d19e3c5044288ed68bcd38e80418b1fffc4e5dbed652d30618386389bce318df97567e6e806e72c8d5c7515d0d62c99994e7533429bfdbf561fc920b9832a60002a67817e6ea4eaca4b44da42e810e0e96ede28d97b603da03c7b87f0487d294df6a2797ec34eb19129f957dcfb8bebc9e3577da18e54a3e54fad55817a08b561f3fd2e593d8beb9271c0323c094352e00bb5f8e2f1a8406ac0cee689240e114a11c9ed517d5774b92d7021774c32fe4233eaabf5f0459db7cb136b4945853b166a79b485d3f902bb5994955faeb63180083dd620988abc64d5a35aa1377e93ca286d882540818d55362364b87c5ec58ea14d18f4a060881228673ab0ec64200a43b1e980056163fdc09a98c2dfe9979e0f0e23f6cce51f1b458ef230d8829ded70849003b8c05a66b2a96830514c917ba96eba0c89b5c7a2183f7d2b2d5dd35e9f3373acbbd6fb497ef21e84fc5c3b2591031361af5774e51fffcccf81e1a3042aedc4d13f174f7513dabf215e3453a8bf629a9c091e133d6b68a538459a344081a875441c3219bde4665eedce68c060c8d134f67607f8767310d34971647135d5e493c429418464fd34b4d01ee175f9abd5787f14acafcff1ddd84270741361b914b7bb0d134b7053591cb4f2449779c3b23ff646719d9b38b5dcf255abf01c5f7359ea6d6c4dba75af38b6d42f6c8bb9290099688d223ed7b4ea18028e42fb73d4fd720fef83126a1450d4e94643d996e53eac3ed43e8d43bab2b70ca101f394525effecb7dec8a172d4658ed724d4f2c532d507b7fd1fb8a9e905068df9d7bbd29113fdd242ec4caac1c4a8945afeb2380638f06e0dbc815e4feb8378695509570856ea9cbf30b9ad800e5ba1e068ea06da29ff6f78d3fc4c758d52ec2dc90fa64aa08435ab70b280387b64de3482b6b5eb1141dc883986041fe1172e69ebc74a50a39a61d144bb4d52bb59514ddf13fdbe0f2467e2c1df8525fc4d482e6b9c24533bcdc63ed9c948b9d3cd5c3df7b836b54610b1f89a1ea9db97bca7a58a77f20c7c8132030e5b6af2e636a78bfbd258554a92aed60d885c385dc5e6797d54a77b7ef1dd4750aff82b364b00d175e51ecaeeb7aca74e25d65e955a255cad534a6b12a5418f9822d819616e3d220a306a73f689a81cb46bfb130be321a24d427aeb7356950d34431c616663cc1c9b25d4c7317386e56a54875bad28c89f9daf9cb90b99546bce5719202ed41a1678642c4ed53b09b705bfabdd5991f88f51ec7a0a92ea59d62b7d647dc7d9e467d738cab3d3554bd8c4b02fac66d9383cd3b62961a7e83d25072ba4891c3d5353fbeedbacfffb0f47f044881dd49dfd5677ccd7cefd2674dcf69b9ea68331a1f0edcd36c05d5ae104aa416f80ff6d029dbe9f2e7bd2792a6edc007c96aaff7d086e5cace882837aa9771f2eb4634aa7dc60e0661c7f8c1713d4423c2c573e3adf2552cd26902aa0ac392d873b9cab5f618a8a9cdad701021dfba8428a50d9f29f205f9241b28343dcc74effcb6f0c5e5a817d8954e062d7639263a4b2e83a50ac5c764314530079d3e4e82d3564f4a6c78f702346d621f6994f7fa45b45f36ca23683ed48f7e0d8e1ae8809d12dd0d60daacbc22b3a8c1ad2597794106c31b5cc81171e4f1149e7788ed4676a8354d3bc22aac9ddb0a69738256f71f454fa3336ef0cbc625115f6faa7657a900c94a7a85d52f631969cbb40009dc59678767e65407ea701cd6d9f48d842102bf96f5e6bff9317d644920651b62b7aeae5dda18553738b3fbdae0163f5e1205eaed86868d0b8ac4f83e455bf65c472ea0db59787ef5d9e7541e66ed8f25968397a9f6ca67b49a609f45768797681e75a09f9e9561ac13fe3ea89fa9c3ca484d947f87f7d16136b0fc3e48751383240e5011697592cd9d3d4e78f39e5ebee9c0178ceb4cd0103f2c1053048c983dd14648164c51bacad3a11fe83c845be26dd3ab66b5019f580eeffed3970700487a26b3f6af2e13e153eb9b5e3a9ce3e558b9ff48dd3020ffb0292a6a6561cbcab35cdce50706fe1f671fb51378b028caccb1e1d1c9ad1e58bc5c8fca680c451c185a96527ab200c89a1cc6da054c0ffab7b1e277005d052bb8839eb2743cac63dbfd705ddd735a3ca46eb2c906bca02e6d7e0c41d1a753b7dd53328fad4088f996b3d9c012c6357ac64ac4b922b4604ede146870b0b0f53c72c9c9bb6c2647491ffec6a1c8f5974b10a0363d55b13bbe502e6c80b96a8f6483c125c14f8d79db83a2ed8c400edd9c2fbee933d8efe7166e6a430a8", 0x1000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:57 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:57 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 420.254365][T20424] binder: 20422:20424 got transaction to context manager from process owning it [ 420.278652][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.284936][T20428] binder: BINDER_SET_CONTEXT_MGR already set 10:37:58 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 420.347513][T20428] binder: 20422:20428 ioctl 40046207 0 returned -16 [ 420.355064][T20433] binder: BINDER_SET_CONTEXT_MGR already set [ 420.371096][T20433] binder: 20429:20433 ioctl 40046207 0 returned -16 [ 420.379966][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.386177][ T12] binder: undelivered TRANSACTION_ERROR: 29201 10:37:58 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:58 executing program 2: r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x8000, 0x0) mknodat(r2, &(0x7f00000000c0)='./file0\x00', 0x8000, 0xffff) 10:37:58 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 420.604179][T20448] binder_alloc: binder_alloc_mmap_handler: 20445 20001000-20004000 already mapped failed -16 [ 420.645685][T20450] binder: BINDER_SET_CONTEXT_MGR already set [ 420.671153][T20446] binder: BINDER_SET_CONTEXT_MGR already set [ 420.710959][T20450] binder: 20447:20450 ioctl 40046207 0 returned -16 [ 420.730109][T20446] binder: 20445:20446 ioctl 40046207 0 returned -16 [ 420.731393][T20451] binder_transaction: 14 callbacks suppressed [ 420.731410][T20451] binder: 20445:20451 transaction failed 29189/-3, size 0-0 line 3148 [ 420.751993][ T12] binder: release 20445:20446 transaction 1052 in, still active 10:37:58 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) 10:37:58 executing program 2: syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:37:58 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:58 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 420.769326][ T12] binder: send failed reply for transaction 1052 to 20445:20446 10:37:58 executing program 4: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0b63e7e1412dd1a686127fd3e8fdf3c2e350f459c830e355d8083838ced6956690629693ac592923c7d71ed954205403de6522aaf937e011e52d729c0d9ddc6872daf82693252184e59784850a834e6bffea53280ef8f24e329c50af54723229cde480438f123c336b131587dbe8fd181a4d62fe888fc4ad1b163bcbe68d8f015f6abf7c62a3b45143d3c1f61a458cb7efc6d21e6c1d736b2a886bc00155b002c333b17523df4d82ea03b140daef5c7e"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:37:58 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:58 executing program 2: syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 420.857927][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.885439][ T12] binder: undelivered TRANSACTION_COMPLETE 10:37:58 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 420.938726][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.959317][T20471] binder: 20467:20471 unknown command -504929525 [ 420.971269][T20472] binder: BINDER_SET_CONTEXT_MGR already set [ 421.002439][T20471] binder: 20467:20471 ioctl c0306201 20000140 returned -22 [ 421.009883][T20472] binder: 20468:20472 ioctl 40046207 0 returned -16 [ 421.036651][T20478] binder_thread_write: 11 callbacks suppressed [ 421.036661][T20478] binder: 20468:20478 ERROR: BC_REGISTER_LOOPER called without request 10:37:58 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 421.042170][T20479] binder_alloc: binder_alloc_mmap_handler: 20467 20001000-20004000 already mapped failed -16 [ 421.057020][T20471] binder: BINDER_SET_CONTEXT_MGR already set 10:37:58 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 421.094009][T20479] binder: 20467:20479 transaction failed 29189/-3, size 0-0 line 3148 [ 421.126381][ T22] binder: release 20467:20471 transaction 1055 out, still active [ 421.136437][T20471] binder: 20467:20471 ioctl 40046207 0 returned -16 10:37:58 executing program 2: syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) [ 421.148292][ T22] binder: undelivered TRANSACTION_COMPLETE [ 421.183537][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:37:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$CAPI_SET_FLAGS(r2, 0x80044324, &(0x7f00000000c0)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x460a40, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 421.231342][ T22] binder: send failed reply for transaction 1055, target dead [ 421.359683][T20495] binder: 20490:20495 ioctl 80044324 200000c0 returned -22 [ 421.382912][T20495] binder: 20490:20495 ERROR: BC_REGISTER_LOOPER called without request [ 421.391545][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 421.391599][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 421.467526][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 421.473813][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 421.516108][T20495] binder: 20490:20495 ioctl 80044324 200000c0 returned -22 [ 421.539558][T20499] binder: BINDER_SET_CONTEXT_MGR already set [ 421.574073][T20499] binder: 20490:20499 ioctl 40046207 0 returned -16 [ 421.610136][T20495] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 421.610147][T20495] binder_alloc: 20490: binder_alloc_buf, no vma [ 421.667307][T20498] binder: 20490:20498 ERROR: BC_REGISTER_LOOPER called without request 10:37:59 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:59 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) 10:37:59 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, 0x0, 0x0, 0x0) [ 421.721844][T20495] binder: 20490:20495 transaction failed 29189/-3, size 0-0 line 3148 [ 421.735723][ T12] binder: release 20490:20495 transaction 1058 in, still active 10:37:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x2000, 0x0) r3 = accept4$ax25(0xffffffffffffffff, &(0x7f00000001c0)={{}, [@null, @default, @remote, @remote, @bcast, @null, @remote, @bcast]}, &(0x7f0000000040)=0x48, 0x80000) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000240)={r3}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0xc, 0x0, &(0x7f00000000c0)=[@free_buffer={0x40086303, r4}], 0x1, 0x0, &(0x7f0000000100)="f0"}) [ 421.788386][ T12] binder: send failed reply for transaction 1058 to 20490:20495 [ 421.826965][ T12] binder: undelivered TRANSACTION_COMPLETE 10:37:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, 0x0, 0x0, 0x0) [ 421.868321][T20507] binder: 20506:20507 ERROR: BC_REGISTER_LOOPER called without request [ 421.868927][T20512] binder: 20511:20512 BC_FREE_BUFFER u0000000000000000 no match 10:37:59 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:37:59 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:37:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, 0x0, 0x0, 0x0) 10:37:59 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:37:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 422.143330][T20527] binder: 20525:20527 ERROR: BC_REGISTER_LOOPER called without request 10:37:59 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}, {&(0x7f0000000480)=""/192, 0xc0}], 0x7, 0x0) [ 422.188425][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 422.188600][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 422.194800][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 422.200721][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 422.297856][T20533] binder_alloc: 20531: binder_alloc_buf, no vma [ 422.349479][T20533] binder: 20531:20533 transaction failed 29189/-3, size 0-0 line 3148 [ 422.349593][T20536] binder: 20531:20536 ERROR: BC_REGISTER_LOOPER called without request [ 422.588128][ C1] protocol 88fb is buggy, dev hsr_slave_0 10:38:00 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:38:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}, {&(0x7f0000000380)=""/193, 0xc1}], 0x6, 0x0) 10:38:00 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 422.668975][T20545] binder_alloc: binder_alloc_mmap_handler: 20511 20001000-20004000 already mapped failed -16 [ 422.684991][T20547] binder: 20541:20547 ERROR: BC_REGISTER_LOOPER called without request [ 422.704091][T20546] binder_alloc: 20542: binder_alloc_buf, no vma [ 422.733768][T20546] binder: 20542:20546 transaction failed 29189/-3, size 0-0 line 3148 [ 422.759784][T20543] binder_alloc: 20511: binder_alloc_buf, no vma [ 422.761528][T20551] binder: BINDER_SET_CONTEXT_MGR already set [ 422.770177][T20552] binder: 20542:20552 ERROR: BC_REGISTER_LOOPER called without request [ 422.791426][T20543] binder: 20511:20543 transaction failed 29189/-3, size 0-0 line 3148 [ 422.867248][T20551] binder: 20511:20551 ioctl 40046207 0 returned -16 [ 422.876002][ T7871] binder: release 20511:20512 transaction 1061 out, still active [ 422.917459][ T7871] binder: undelivered TRANSACTION_COMPLETE [ 422.923454][ T7871] binder: send failed reply for transaction 1061, target dead 10:38:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) clock_nanosleep(0x5, 0x0, &(0x7f0000000080), &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}, {&(0x7f0000000340)=""/29, 0x1d}], 0x5, 0x0) 10:38:00 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:38:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:00 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}, {&(0x7f0000000300)=""/60, 0x3c}], 0x4, 0x0) [ 423.062705][T20567] binder: BINDER_SET_CONTEXT_MGR already set [ 423.066134][T20569] binder: 20566:20569 ERROR: BC_REGISTER_LOOPER called without request [ 423.092407][T20570] binder_alloc: binder_alloc_mmap_handler: 20566 20001000-20004000 already mapped failed -16 10:38:00 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 423.130238][T20567] binder: 20563:20567 ioctl 40046207 0 returned -16 [ 423.134817][T20569] binder: BINDER_SET_CONTEXT_MGR already set [ 423.175600][T20570] binder_alloc: 20566: binder_alloc_buf, no vma [ 423.204972][T20573] binder: 20563:20573 transaction failed 29189/-22, size 0-0 line 2995 [ 423.221818][T20569] binder: 20566:20569 ioctl 40046207 0 returned -16 10:38:00 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}, {&(0x7f0000000200)=""/219, 0xdb}], 0x3, 0x0) [ 423.251723][T20579] binder: 20566:20579 ERROR: BC_REGISTER_LOOPER called without request [ 423.288328][ T12] binder: release 20566:20569 transaction 1069 out, still active [ 423.298701][T20570] binder: 20566:20570 transaction failed 29189/-3, size 0-0 line 3148 [ 423.320815][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:01 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 423.350723][ T12] binder: release 20566:20569 transaction 1069 in, still active 10:38:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005fd4), 0xfffffffffffffe7a, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) socket$kcm(0x29, 0x2, 0x0) [ 423.442774][ T12] binder: send failed reply for transaction 1069, target dead 10:38:01 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}, {&(0x7f0000000180)=""/110, 0x6e}], 0x2, 0x0) 10:38:01 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 423.625205][T20591] binder: BINDER_SET_CONTEXT_MGR already set [ 423.641965][T20591] binder: 20589:20591 ioctl 40046207 0 returned -16 [ 423.650816][T20591] binder: 20589:20591 ioctl c0306201 20000080 returned -14 10:38:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x12}], 0x1, 0x0) 10:38:01 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 423.791058][T20600] binder: 20598:20600 ioctl c0306201 0 returned -14 10:38:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:01 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:38:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640), 0x0, 0x0) [ 423.990812][T20612] binder_alloc: 20610: binder_alloc_buf, no vma [ 424.008231][T20612] binder: 20610:20612 transaction failed 29189/-3, size 0-0 line 3148 10:38:01 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640), 0x0, 0x0) 10:38:01 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:38:01 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 424.220452][T20624] binder: BINDER_SET_CONTEXT_MGR already set [ 424.226501][T20624] binder: 20621:20624 ioctl 40046207 0 returned -16 [ 424.298362][T20624] binder: 20621:20624 ioctl c0306201 0 returned -14 10:38:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffffb, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000000080)={0x9, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0b63000069036ab055f931a2cfa62dcbd4d34f86c83473d10d4aff38880949bd3513b0b787c120a4f280aa899c702ddf98012b077aa8926e9dd340f18d59e860c34618fecfe911d410b19bcdf694bc5cd35b057b64e52a12cb65ffe7de71b0667e737b7edfed96dacfe45fd9943aadf259647d61a41c46a611f8ad8ba7f4eaf82785f6ffa613c007cbd70647fde32cff5c0b8e7dbeca26e7c92bbddb55d18c1b8df9e27cc754dcb95fbd6e5376567aa6e91b3ba8ca38da4913ee69aab3128ea85801d4"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640), 0x0, 0x0) 10:38:02 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:38:02 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 424.428966][T20629] binder_alloc: binder_alloc_mmap_handler: 20589 20001000-20004000 already mapped failed -16 [ 424.445472][T20595] binder: BINDER_SET_CONTEXT_MGR already set [ 424.458642][T20629] binder: 20589:20629 ioctl c0306201 20000080 returned -14 [ 424.466243][T20595] binder: 20589:20595 ioctl 40046207 0 returned -16 10:38:02 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{0x0}], 0x1, 0x0) [ 424.595183][T20643] binder: BINDER_SET_CONTEXT_MGR already set [ 424.620148][T20643] binder: 20634:20643 ioctl 40046207 0 returned -16 [ 424.637590][T20645] binder: BINDER_SET_CONTEXT_MGR already set [ 424.677804][T20645] binder: 20640:20645 ioctl 40046207 0 returned -16 [ 424.688305][T20645] binder: 20640:20645 ioctl 800448d2 20000080 returned -22 10:38:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:02 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{0x0}], 0x1, 0x0) 10:38:02 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r0 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:02 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 424.787590][ T5] binder_release_work: 7 callbacks suppressed [ 424.787598][ T5] binder: undelivered TRANSACTION_ERROR: 29189 10:38:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='setgroups\x00') preadv(r0, &(0x7f0000000640)=[{0x0}], 0x1, 0x0) [ 424.904157][T20664] binder: BINDER_SET_CONTEXT_MGR already set [ 424.928005][T20664] binder: 20663:20664 ioctl 40046207 0 returned -16 10:38:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x8000, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f00000000c0)={0x3, r1, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0xa, 0x0, &(0x7f0000000080)="87c4dcd6c771b9b92ef4"}) 10:38:03 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:03 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r0 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:03 executing program 2: syz_open_procfs(0x0, &(0x7f00000001c0)='map_files\x00') syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) ioctl$int_in(r0, 0x4800000c0045009, &(0x7f0000000080)=0x10) pipe(&(0x7f0000000640)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000200)={0x0, r1+30000000}, 0x0) [ 425.420785][T20650] binder: BINDER_SET_CONTEXT_MGR already set [ 425.428173][T20650] binder: 20640:20650 ioctl 40046207 0 returned -16 [ 425.429146][T20671] binder: 20640:20671 ioctl 800448d2 20000080 returned -22 10:38:03 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:03 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r0 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 425.550231][T20682] binder: BINDER_SET_CONTEXT_MGR already set [ 425.556456][T20682] binder: 20681:20682 ioctl 40046207 0 returned -16 [ 425.660252][ T12] binder: send failed reply for transaction 1078 to 20663:20664 [ 425.668562][ T12] binder: send failed reply for transaction 1079 to 20681:20682 10:38:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:03 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x500, &(0x7f0000000040)="f0"}) 10:38:03 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 425.705316][ T12] binder: undelivered TRANSACTION_COMPLETE [ 425.734389][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 425.874580][T20700] binder: BINDER_SET_CONTEXT_MGR already set [ 425.899445][T20700] binder: 20698:20700 ioctl 40046207 0 returned -16 10:38:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000), 0x13f}}, 0x20) shmget$private(0x0, 0x4000, 0x0, &(0x7f0000fec000/0x4000)=nil) seccomp(0x1, 0x2, &(0x7f0000007ff0)={0x1, &(0x7f0000004fe8)=[{0x6, 0x0, 0x0, 0x50000}]}) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) [ 426.347525][ C0] net_ratelimit: 9 callbacks suppressed [ 426.347533][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 426.347598][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 426.353174][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 426.358949][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 426.378098][T20708] binder_alloc: binder_alloc_mmap_handler: 20681 20001000-20004000 already mapped failed -16 10:38:04 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 426.393577][T20706] binder: BINDER_SET_CONTEXT_MGR already set [ 426.400796][ T7871] binder: undelivered TRANSACTION_COMPLETE [ 426.406743][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 426.415380][T20708] binder_thread_write: 9 callbacks suppressed [ 426.415392][T20708] binder: 20681:20708 ERROR: BC_REGISTER_LOOPER called without request 10:38:04 executing program 5: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 426.441401][ T7871] binder: release 20681:20709 transaction 1082 out, still active [ 426.454999][ T7871] binder: undelivered TRANSACTION_COMPLETE [ 426.464811][T20706] binder: 20681:20706 ioctl 40046207 0 returned -16 10:38:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000280)={0x2, 0x0, [0xffffffff, 0x7, 0x1, 0x8, 0xffffffffffffff01, 0x7, 0x2, 0x20]}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) accept4(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f00000001c0)=0x80, 0x80000) setsockopt$CAIFSO_LINK_SELECT(r3, 0x116, 0x7f, &(0x7f0000000200)=0x6, 0x4) 10:38:04 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 426.659782][ T12] binder: send failed reply for transaction 1081 to 20698:20701 [ 426.699165][ T12] binder: send failed reply for transaction 1082, target dead 10:38:04 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 426.747524][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 426.753386][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 426.759770][ T12] binder: undelivered TRANSACTION_COMPLETE [ 426.765834][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 426.815094][ T26] audit: type=1326 audit(1554719884.495:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45b11a code=0x50000 [ 426.875213][T20723] binder: 20720:20723 ERROR: BC_REGISTER_LOOPER called without request [ 426.890471][T20728] binder: 20725:20728 ERROR: BC_REGISTER_LOOPER called without request [ 426.900466][T20724] binder: BINDER_SET_CONTEXT_MGR already set [ 426.910564][T20724] binder: 20721:20724 ioctl 40046207 0 returned -16 10:38:04 executing program 2: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206", 0x12, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0xff, 0x1, 0xffffffff}, 0x10) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'L+', 0x81}, 0x28, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446c17b4b", 0xfe) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) [ 426.924820][ T26] audit: type=1326 audit(1554719884.495:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4582b9 code=0x50000 [ 426.925249][T20730] binder_alloc: binder_alloc_mmap_handler: 20720 20001000-20004000 already mapped failed -16 [ 426.950406][ T5] binder: release 20725:20728 transaction 1085 out, still active 10:38:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 426.991950][ T5] binder: undelivered TRANSACTION_COMPLETE 10:38:04 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 427.041506][ T26] audit: type=1326 audit(1554719884.495:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45b11a code=0x50000 [ 427.127065][T20740] binder_alloc: 20720: binder_alloc_buf, no vma [ 427.134136][T20723] binder: BINDER_SET_CONTEXT_MGR already set [ 427.157744][T20723] binder: 20720:20723 ioctl 40046207 0 returned -16 10:38:04 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 427.176726][T20740] binder: 20736:20740 transaction failed 29189/-3, size 0-0 line 3148 [ 427.176735][T20743] binder: 20736:20743 ERROR: BC_REGISTER_LOOPER called without request [ 427.212658][ T26] audit: type=1326 audit(1554719884.495:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=298 compat=0 ip=0x4582b9 code=0x50000 [ 427.219250][T20745] binder: BINDER_SET_CONTEXT_MGR already set [ 427.259537][T20730] binder_alloc: 20720: binder_alloc_buf, no vma [ 427.297645][T20730] binder: 20720:20730 transaction failed 29189/-3, size 0-0 line 3148 [ 427.337569][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 427.342088][ T26] audit: type=1326 audit(1554719884.495:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45b11a code=0x50000 [ 427.347936][T20745] binder: 20741:20745 ioctl 40046207 0 returned -16 10:38:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:05 executing program 5: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:05 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 427.433722][ T26] audit: type=1326 audit(1554719884.495:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4582b9 code=0x50000 [ 427.525186][T20730] binder: 20720:20730 ERROR: BC_REGISTER_LOOPER called without request [ 427.536178][T20754] binder_alloc: 20720: binder_alloc_buf, no vma [ 427.570986][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 427.580737][ T7871] binder: release 20720:20723 transaction 1084 in, still active [ 427.589784][T20754] binder: 20750:20754 transaction failed 29189/-3, size 0-0 line 3148 [ 427.589822][T20757] binder: 20750:20757 ERROR: BC_REGISTER_LOOPER called without request 10:38:05 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x500, &(0x7f0000000040)="f0"}) [ 427.628149][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 427.634490][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 427.643251][ T26] audit: type=1326 audit(1554719884.525:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4582b9 code=0x50000 [ 427.687002][ T7871] binder: send failed reply for transaction 1084 to 20720:20723 [ 427.707512][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 427.713372][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:05 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r2, &(0x7f00000017c0), 0x199, 0x0) ioctl$SIOCRSGL2CALL(r1, 0x89e5, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/ip6_flowlabel\x00') ioctl$VT_DISALLOCATE(r3, 0x5608) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 427.746180][ T7871] binder: send failed reply for transaction 1085, target dead [ 427.809866][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 427.834306][ T26] audit: type=1326 audit(1554719884.525:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4582b9 code=0x50000 10:38:05 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 427.877892][ T7871] binder: undelivered TRANSACTION_COMPLETE [ 427.925237][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:05 executing program 2: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206", 0x12, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0xff, 0x1, 0xffffffff}, 0x10) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'L+', 0x81}, 0x28, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446c17b4b", 0xfe) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) [ 427.991632][ T26] audit: type=1326 audit(1554719884.525:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4582b9 code=0x50000 10:38:05 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 428.133053][ T26] audit: type=1326 audit(1554719884.535:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=20703 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x4582b9 code=0x50000 [ 428.320878][T20779] binder: BINDER_SET_CONTEXT_MGR already set [ 428.366776][T20780] binder: 20777:20780 ERROR: BC_REGISTER_LOOPER called without request [ 428.403111][T20779] binder: 20777:20779 ioctl 40046207 0 returned -16 10:38:06 executing program 5: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000001c0)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x20000, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f00000000c0)={0x8, 0x80000001, 0x1}, 0xc) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0b6300001c67da938d8cd8d5ff5a7e696a1110a9955a44539a5c7433d37576990594ab"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:06 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:06 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:06 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x500, 0x0}) [ 428.701929][T20793] binder: 20789:20793 ERROR: BC_REGISTER_LOOPER called without request [ 428.719127][T20794] binder: BINDER_SET_CONTEXT_MGR already set [ 428.777074][T20794] binder: 20792:20794 ioctl 40046207 0 returned -16 [ 428.777272][T20800] binder: 20792:20800 ERROR: BC_REGISTER_LOOPER called without request [ 428.792203][T20798] binder: BINDER_SET_CONTEXT_MGR already set [ 428.818096][T20799] binder: 20789:20799 ERROR: BC_REGISTER_LOOPER called without request [ 428.932849][T20798] binder: 20789:20798 ioctl 40046207 0 returned -16 [ 428.932956][T20793] binder_alloc: 20789: binder_alloc_buf, no vma [ 428.946391][T20801] binder: BINDER_SET_CONTEXT_MGR already set [ 429.001900][ T7871] binder: release 20789:20793 transaction 1091 out, still active [ 429.010374][T20801] binder: 20797:20801 ioctl 40046207 0 returned -16 [ 429.030526][ T7871] binder: undelivered TRANSACTION_COMPLETE 10:38:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 429.063524][ T7871] binder: release 20789:20793 transaction 1091 in, still active [ 429.075764][T20793] binder: 20789:20793 transaction failed 29189/-3, size 0-0 line 3148 10:38:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 429.127269][ T7871] binder: send failed reply for transaction 1091, target dead 10:38:06 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x500, 0x0}) [ 429.192480][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0xc400, 0x0) syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x2, 0x406502) ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f0000000000)={0x0, 0x1, [{r2, 0x0, 0x1fffff000, 0xfffffffffffff000}]}) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="f487a9075104b62ff50be7153382af414f"], &(0x7f0000000100)=0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b6300005158fba93b6eb0c2f65eeccf96ada86c63fde7ace0e9c3d34d8fad779fe8abefd33bc2e4d11e8121c86ff30c0f1faad198e96178ad642a1e96fffffffff2726acb2d6baf5eec89a5f0ebb543a73975ff0e52d89406f547e213fb192d4d4fd84ed4c7643124602316ba5dc157099869a8000034b9f6d0558d4d62c9fe540b3300"/143], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 429.253696][T20807] binder: 20804:20807 ioctl c0306201 0 returned -14 10:38:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 429.373005][T20812] gfs2: invalid mount option: hash [ 429.383503][T20815] binder: BINDER_SET_CONTEXT_MGR already set 10:38:07 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 429.432640][T20812] gfs2: can't parse mount arguments [ 429.473690][T20815] binder: 20810:20815 ioctl 40046207 0 returned -16 [ 429.480684][T20823] binder_alloc: binder_alloc_mmap_handler: 20816 20001000-20004000 already mapped failed -16 [ 429.485151][T20824] binder: BINDER_SET_CONTEXT_MGR already set 10:38:07 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 429.526214][T20820] binder: BINDER_SET_CONTEXT_MGR already set [ 429.534313][T20824] binder: 20821:20824 ioctl 40046207 0 returned -16 [ 429.534805][T20827] binder: 20821:20827 ioctl c0306201 0 returned -14 [ 429.556376][T20820] binder: 20816:20820 ioctl 40046207 0 returned -16 10:38:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xffffffffffffffff, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="df424849"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:07 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x500, 0x0}) 10:38:07 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:07 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x500, &(0x7f0000000040)}) [ 429.833599][T20844] binder: BINDER_SET_CONTEXT_MGR already set 10:38:07 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 429.879539][T20851] binder: 20842:20851 ioctl c0306201 0 returned -14 [ 429.883603][T20845] gfs2: invalid mount option: hash [ 429.938994][T20855] binder: 20843:20855 unknown command 1229472479 [ 429.949086][T20844] binder: 20842:20844 ioctl 40046207 0 returned -16 [ 429.965542][T20845] gfs2: can't parse mount arguments [ 429.977205][T20846] binder: BINDER_SET_CONTEXT_MGR already set [ 430.001536][T20855] binder: 20843:20855 ioctl c0306201 20000140 returned -22 [ 430.044212][T20853] binder: 20843:20853 transaction failed 29189/-22, size 0-0 line 2995 [ 430.074035][T20846] binder: 20843:20846 ioctl 40046207 0 returned -16 10:38:07 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x500, &(0x7f0000000040)}) 10:38:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:07 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 430.166297][T20855] binder_alloc: 20843: binder_alloc_buf, no vma 10:38:07 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 430.244303][T20855] binder: 20843:20855 transaction failed 29189/-3, size 0-0 line 3148 [ 430.252820][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 430.295530][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 430.323487][T20870] binder: BINDER_SET_CONTEXT_MGR already set [ 430.343110][T20870] binder: 20865:20870 ioctl 40046207 0 returned -16 10:38:08 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:08 executing program 0: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x500, &(0x7f0000000040)}) 10:38:08 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f00000001c0)='/dev/snd/pcmC#D#p\x00', 0xd47, 0x40040) mknodat(r0, &(0x7f0000000200)='./file0\x00', 0x8000, 0x4) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0xc0001, 0x0) ioctl$UI_GET_VERSION(r2, 0x8004552d, &(0x7f0000000100)) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) openat(r2, &(0x7f0000000080)='./file0\x00', 0x0, 0x60) write$selinux_attr(r2, &(0x7f0000000240)='system_u:object_r:ldconfig_exec_t:s0\x00', 0x25) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0bff1300"], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 430.405459][T20873] gfs2: invalid mount option: hash 10:38:08 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 430.469883][T20873] gfs2: can't parse mount arguments [ 430.485111][T20882] binder: 20881:20882 unknown command 1310475 [ 430.532183][T20882] binder: 20881:20882 ioctl c0306201 20000140 returned -22 [ 430.563133][T20889] binder: BINDER_SET_CONTEXT_MGR already set 10:38:08 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 430.584064][T20889] binder: 20885:20889 ioctl 40046207 0 returned -16 [ 430.590781][T20891] binder_alloc: binder_alloc_mmap_handler: 20881 20001000-20004000 already mapped failed -16 10:38:08 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = gettid() rt_sigqueueinfo(r1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x1}) [ 430.675772][T20891] binder_alloc: 20881: binder_alloc_buf, no vma 10:38:08 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 430.719878][T20891] binder: 20881:20891 transaction failed 29189/-3, size 0-0 line 3148 [ 430.783057][ T12] binder: release 20881:20882 transaction 1102 out, still active [ 430.801292][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0b630000589a1795fae0c7a5bec43758e7c388100ad88fc214884e0d18cc9c3000ff76a5a98272904714db1e452db007079bc9c318"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:08 executing program 0: [ 430.839386][T20902] gfs2: invalid mount option: hash [ 430.844681][T20902] gfs2: can't parse mount arguments [ 430.869534][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 430.931674][ T12] binder: send failed reply for transaction 1102, target dead [ 431.038640][T20914] binder_alloc: binder_alloc_mmap_handler: 20909 20001000-20004000 already mapped failed -16 10:38:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:08 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) [ 431.101784][T20910] binder: BINDER_SET_CONTEXT_MGR already set [ 431.157180][T20910] binder: 20909:20910 ioctl 40046207 0 returned -16 10:38:08 executing program 0: [ 431.197904][T20919] binder_alloc: 20909: binder_alloc_buf, no vma [ 431.206358][T20923] binder: BINDER_SET_CONTEXT_MGR already set [ 431.218405][T20920] gfs2: invalid mount option: hash [ 431.268457][T20919] binder: 20909:20919 transaction failed 29189/-3, size 0-0 line 3148 [ 431.286390][T20920] gfs2: can't parse mount arguments [ 431.302590][T20923] binder: 20917:20923 ioctl 40046207 0 returned -16 [ 431.309715][ T7871] binder: release 20909:20910 transaction 1105 in, still active [ 431.317372][ T7871] binder: send failed reply for transaction 1105 to 20909:20910 [ 431.364298][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:09 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:09 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) [ 431.419828][ T7871] binder: undelivered TRANSACTION_COMPLETE 10:38:09 executing program 0: 10:38:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 431.473671][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:09 executing program 0: [ 431.634280][T20942] binder_thread_write: 15 callbacks suppressed [ 431.634290][T20942] binder: 20937:20942 ERROR: BC_REGISTER_LOOPER called without request [ 431.665091][T20939] gfs2: invalid mount option: hash 10:38:09 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 431.683409][T20939] gfs2: can't parse mount arguments [ 431.694544][T20945] binder: BINDER_SET_CONTEXT_MGR already set [ 431.747320][T20945] binder: 20941:20945 ioctl 40046207 0 returned -16 [ 431.763140][T20949] binder_alloc: binder_alloc_mmap_handler: 20937 20001000-20004000 already mapped failed -16 [ 431.787518][ C1] net_ratelimit: 8 callbacks suppressed [ 431.787527][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 431.798950][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 431.836719][T20945] binder: 20941:20945 ERROR: BC_REGISTER_LOOPER called without request 10:38:09 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) 10:38:09 executing program 0: [ 431.867998][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 431.875728][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 431.898462][T20942] binder: BINDER_SET_CONTEXT_MGR already set [ 431.906820][T20942] binder: 20937:20942 ioctl 40046207 0 returned -16 [ 431.944485][ T12] binder: release 20937:20942 transaction 1108 in, still active [ 431.974921][ T12] binder: send failed reply for transaction 1108 to 20937:20942 10:38:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x80100, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000300)={0x9, 0x0, 0x10000, 0x3ff}) ioctl$DRM_IOCTL_AGP_BIND(r2, 0x40106436, &(0x7f0000000380)={r3, 0x7fffffff}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f00000003c0)={0xd004, 0x101000}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x4000, 0x0) ioctl$NBD_CLEAR_QUE(r4, 0xab05) ioctl$BLKTRACESTART(r4, 0x1274, 0x0) setsockopt$ax25_int(r4, 0x101, 0x8, &(0x7f00000002c0)=0x8da8, 0x4) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) stat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r4, 0x800c6613, &(0x7f0000000400)={0x0, @aes128, 0x2, "d09cd2e594dfb7b5"}) fstat(r0, &(0x7f0000000240)) [ 432.016068][ T12] binder: undelivered TRANSACTION_COMPLETE [ 432.043898][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:09 executing program 0: [ 432.130697][T20957] gfs2: invalid mount option: hash [ 432.191264][T20957] gfs2: can't parse mount arguments [ 432.237164][T20963] binder: 20962:20963 ERROR: BC_REGISTER_LOOPER called without request [ 432.255854][T20965] binder_alloc: binder_alloc_mmap_handler: 20962 20001000-20004000 already mapped failed -16 10:38:10 executing program 0: [ 432.304304][T20963] binder: BINDER_SET_CONTEXT_MGR already set [ 432.326068][T20963] binder: 20962:20963 ioctl 40046207 0 returned -16 [ 432.393061][T20967] binder_alloc: 20962: binder_alloc_buf, no vma 10:38:10 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000), 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:10 executing program 2: syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 432.437709][T20967] binder: 20962:20967 transaction failed 29189/-3, size 0-0 line 3148 [ 432.513410][T20965] binder: 20962:20965 ERROR: BC_REGISTER_LOOPER called without request [ 432.551959][T20974] gfs2: invalid mount option: hash [ 432.557125][T20974] gfs2: can't parse mount arguments 10:38:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:10 executing program 0: [ 432.563648][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 432.570862][ T7871] binder: release 20962:20963 transaction 1110 in, still active 10:38:10 executing program 4: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x100, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r0, 0x4018aee1, &(0x7f0000000100)={0x0, 0x7313, 0x8a, &(0x7f00000000c0)=0x8}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 432.623633][ T7871] binder: send failed reply for transaction 1110 to 20962:20963 10:38:10 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:10 executing program 2: syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 432.686038][ T7871] binder: undelivered TRANSACTION_COMPLETE [ 432.718982][T20984] binder: 20981:20984 ERROR: BC_REGISTER_LOOPER called without request [ 432.728883][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:10 executing program 0: [ 432.809104][T20992] binder: BINDER_SET_CONTEXT_MGR already set [ 432.841849][T20992] binder: 20989:20992 ioctl 40046207 0 returned -16 [ 432.884893][T20992] binder: 20989:20992 ERROR: BC_REGISTER_LOOPER called without request [ 432.906785][T20997] gfs2: invalid mount option: hash 10:38:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:10 executing program 0: [ 432.949047][T20997] gfs2: can't parse mount arguments [ 432.950257][ T12] binder: send failed reply for transaction 1113 to 20989:20996 [ 432.987508][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 432.993378][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 433.113430][T21006] binder: 21002:21006 ERROR: BC_REGISTER_LOOPER called without request 10:38:10 executing program 2: syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:10 executing program 0: 10:38:11 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000), 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:11 executing program 0: [ 433.351665][T21011] gfs2: invalid mount option: hash [ 433.365483][T21011] gfs2: can't parse mount arguments 10:38:11 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:11 executing program 0: [ 433.584070][T20996] binder_alloc: binder_alloc_mmap_handler: 20989 20001000-20004000 already mapped failed -16 [ 433.627555][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 433.633362][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:38:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@initdev}}, &(0x7f0000000100)=0xe8) quotactl(0x2, &(0x7f00000000c0)='./file0\x00', r2, &(0x7f00000002c0)="304bcb25b1b476337c0fd5473f32216cad8606599f7f50ed2d93f7f462c19f5e73d7ffc9d036960761ce608e8f59fbfe8a7f05cd73698ef263fd8746fa77fa3b43") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:11 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:11 executing program 0: 10:38:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 433.730779][ T22] binder: send failed reply for transaction 1115 to 20989:21024 [ 433.739155][ T22] binder: undelivered TRANSACTION_COMPLETE [ 433.744988][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 433.751720][ T22] binder: undelivered TRANSACTION_COMPLETE [ 433.758010][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:11 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 433.867484][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 433.873342][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 433.890706][T21041] binder: 21037:21041 ERROR: BC_REGISTER_LOOPER called without request [ 433.902871][T21043] binder: BINDER_SET_CONTEXT_MGR already set [ 433.937660][T21043] binder: 21036:21043 ioctl 40046207 0 returned -16 [ 433.945189][T21043] binder: 21036:21043 ERROR: BC_REGISTER_LOOPER called without request 10:38:11 executing program 0: [ 433.987315][T21045] binder_alloc: binder_alloc_mmap_handler: 21037 20001000-20004000 already mapped failed -16 [ 434.033102][T21041] binder: BINDER_SET_CONTEXT_MGR already set [ 434.093737][T21041] binder: 21037:21041 ioctl 40046207 0 returned -16 10:38:11 executing program 0: 10:38:11 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 434.238377][T21041] binder_alloc: 21037: binder_alloc_buf, no vma [ 434.272820][T21054] binder: 21037:21054 ERROR: BC_REGISTER_LOOPER called without request [ 434.288670][T21041] binder: 21037:21041 transaction failed 29189/-3, size 0-0 line 3148 [ 434.345085][ T12] binder: release 21037:21041 transaction 1117 out, still active [ 434.371887][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:12 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000), 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:12 executing program 0: 10:38:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x5, 0x20000) r3 = gettid() ioctl$KVM_PPC_GET_SMMU_INFO(r2, 0x8250aea6, &(0x7f0000000000)=""/52) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f00000001c0)) ioctl$sock_SIOCSPGRP(r2, 0x8902, &(0x7f00000000c0)=r3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="46e9f34a52def028c2bc8ebbceabe8b40c49ffdd5221a956313a43b57631566f6a0b59b2121098d87217195633d619760b48f80fdece044dc689856e00b8021c6138d0b05f5eab4529d76467"], 0x1, 0x0, &(0x7f0000000040)="f0"}) setsockopt$inet6_int(r2, 0x29, 0x33, &(0x7f0000000200)=0x20, 0x4) [ 434.414219][ T12] binder: release 21037:21041 transaction 1117 in, still active [ 434.457393][ T12] binder: send failed reply for transaction 1117, target dead 10:38:12 executing program 0: 10:38:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:12 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) [ 434.703721][T21079] binder: 21073:21079 unknown command 0 [ 434.736272][T21079] binder: 21073:21079 ioctl c0306201 20000180 returned -22 10:38:12 executing program 0: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206", 0x12, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0xff, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'L+', 0x81}, 0x28, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446c17b4b", 0xfe) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) [ 434.790155][T21088] binder: 21073:21088 unknown command 1257498950 10:38:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 434.843315][T21088] binder: 21073:21088 ioctl c0306201 20000140 returned -22 [ 434.879805][T21088] binder: BINDER_SET_CONTEXT_MGR already set [ 434.928292][T21088] binder: 21073:21088 ioctl 40046207 0 returned -16 [ 434.945833][T21095] binder: BINDER_SET_CONTEXT_MGR already set [ 434.997560][T21095] binder: 21090:21095 ioctl 40046207 0 returned -16 [ 435.004412][T21088] binder: 21073:21088 unknown command 1257498950 [ 435.010546][T21079] binder: 21073:21079 unknown command 0 [ 435.021887][T21088] binder: 21073:21088 ioctl c0306201 20000140 returned -22 [ 435.022167][T21079] binder: 21073:21079 ioctl c0306201 20000180 returned -22 [ 435.079395][T21095] binder: 21090:21095 transaction failed 29189/-22, size 0-0 line 2995 10:38:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:12 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, r0, 0x0) [ 435.329295][ T22] binder: release 21105:21109 transaction 1122 out, still active [ 435.355391][ T22] binder: undelivered TRANSACTION_COMPLETE [ 435.434190][ T22] binder: send failed reply for transaction 1122, target dead 10:38:13 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x4, 0x0, &(0x7f0000000040)="f0"}) 10:38:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, r0, 0x0) 10:38:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 435.645654][ T22] binder: release 21119:21120 transaction 1124 out, still active 10:38:13 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 435.687453][ T22] binder: undelivered TRANSACTION_COMPLETE 10:38:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 10:38:13 executing program 0: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206", 0x12, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0xff, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'L+', 0x81}, 0x28, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446c17b4b", 0xfe) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) [ 435.771875][ T22] binder: send failed reply for transaction 1124, target dead 10:38:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, r0, 0x0) [ 435.812682][T21131] gfs2: not a GFS2 filesystem 10:38:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 435.889862][T21142] binder: 21138:21142 ioctl c0306201 0 returned -14 [ 435.902540][ T22] binder: release 21138:21142 transaction 1126 out, still active [ 435.926617][ T22] binder: undelivered TRANSACTION_COMPLETE 10:38:13 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, r0, 0x0) 10:38:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 436.047895][ T22] binder: send failed reply for transaction 1126, target dead [ 436.099467][T21150] gfs2: not a GFS2 filesystem 10:38:13 executing program 0: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206", 0x12, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0xff, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'L+', 0x81}, 0x28, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446c17b4b", 0xfe) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) [ 436.164254][T21159] binder: 21153:21159 ioctl c0306201 0 returned -14 [ 436.178362][ T12] binder: release 21153:21159 transaction 1128 out, still active [ 436.196006][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:13 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 10:38:14 executing program 4: mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, 0xffffffffffffffff, 0x0) [ 436.287204][ T12] binder: send failed reply for transaction 1128, target dead [ 436.448572][T21171] binder: 21169:21171 ioctl c0306201 0 returned -14 [ 436.531416][T21174] gfs2: not a GFS2 filesystem [ 436.537028][ T22] binder: release 21169:21171 transaction 1130 out, still active [ 436.551132][ T22] binder: undelivered TRANSACTION_COMPLETE 10:38:14 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:14 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:14 executing program 4: mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, 0xffffffffffffffff, 0x0) 10:38:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 436.611247][ T22] binder: send failed reply for transaction 1130, target dead 10:38:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 436.811231][T21190] gfs2: invalid mount option: hash [ 436.816383][T21190] gfs2: can't parse mount arguments 10:38:14 executing program 4: mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, 0xffffffffffffffff, 0x0) 10:38:14 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:14 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, r0, 0x0) 10:38:14 executing program 0: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206", 0x12, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0xff, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'L+', 0x81}, 0x28, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446c17b4b", 0xfe) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) 10:38:14 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:14 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, r0, 0x0) [ 437.360293][T21214] gfs2: invalid mount option: hash [ 437.396104][T21214] gfs2: can't parse mount arguments 10:38:15 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, r0, 0x0) 10:38:15 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:15 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 437.587727][ T12] binder: release 21191:21195 transaction 1132 out, still active [ 437.595489][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 437.657509][ T12] binder: send failed reply for transaction 1132, target dead 10:38:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x2012, r0, 0x0) [ 437.773381][T21236] binder: 21235:21236 transaction failed 29189/-22, size 0-0 line 2995 [ 437.788404][ C0] net_ratelimit: 8 callbacks suppressed [ 437.788452][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 437.800836][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 437.833533][T21244] gfs2: invalid mount option: hash [ 437.868354][ T22] binder_release_work: 2 callbacks suppressed [ 437.868362][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:15 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 437.945735][T21244] gfs2: can't parse mount arguments 10:38:15 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) connect$netlink(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a1, 0x0) connect(0xffffffffffffffff, 0x0, 0x0) mmap$binder(&(0x7f00009dd000/0x1000)=nil, 0x1000, 0x1, 0x2013, 0xffffffffffffffff, 0x80000) write$binfmt_aout(r0, &(0x7f0000000040)=ANY=[], 0xffffffffffffff5e) prctl$PR_GET_TIMERSLACK(0x1e) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) write(r1, 0x0, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, 0x0, 0x0) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) prctl$PR_CAP_AMBIENT(0x2f, 0x0, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) 10:38:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x2012, r0, 0x0) 10:38:15 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:15 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:16 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 438.349304][T21269] gfs2: invalid mount option: hash [ 438.359147][T21269] gfs2: can't parse mount arguments 10:38:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x2012, r0, 0x0) 10:38:16 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x0, 0x300) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) 10:38:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, 0x0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:16 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 438.636648][T21296] gfs2: invalid mount option: hash [ 438.654613][T21296] gfs2: can't parse mount arguments 10:38:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x10, r0, 0x0) 10:38:16 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x0, 0x300) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) 10:38:16 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@nosuiddir='nosuiddir'}], [{@hash='hash'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, 0x0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:16 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 438.935996][ T12] binder: send failed reply for transaction 1135 to 21255:21261 10:38:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x10, r0, 0x0) [ 438.982993][ T12] binder: undelivered TRANSACTION_COMPLETE [ 439.016852][ T12] binder: undelivered TRANSACTION_ERROR: 29189 [ 439.061218][T21325] gfs2: invalid mount option: hash 10:38:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, 0x0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:16 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x0, 0x300) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video35\x00', 0x2, 0x0) 10:38:16 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 439.120656][T21325] gfs2: can't parse mount arguments 10:38:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x10, r0, 0x0) 10:38:16 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigqueueinfo(r0, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x1}) 10:38:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:17 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:17 executing program 3: r0 = add_key$user(0x0, &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:17 executing program 4: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, 0xffffffffffffffff, 0x0) 10:38:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, 0x0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:17 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 439.824384][ T22] binder: send failed reply for transaction 1137 to 21322:21324 [ 439.878013][ T22] binder: undelivered TRANSACTION_COMPLETE [ 439.904455][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:17 executing program 4: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, 0xffffffffffffffff, 0x0) 10:38:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, 0x0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r0 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 439.942585][T21369] gfs2: not a GFS2 filesystem 10:38:17 executing program 3: r0 = add_key$user(0x0, &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:17 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:17 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 440.231494][T21391] gfs2: not a GFS2 filesystem [ 440.384498][T21400] gfs2: not a GFS2 filesystem 10:38:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:18 executing program 4: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xfffffffffffffffd, 0x2012, 0xffffffffffffffff, 0x0) 10:38:18 executing program 3: r0 = add_key$user(0x0, &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:18 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:18 executing program 0: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:18 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 440.753671][ T22] binder: release 21364:21373 transaction 1139 out, still active [ 440.761574][ T22] binder: undelivered TRANSACTION_COMPLETE [ 440.792369][ T22] binder: send failed reply for transaction 1139, target dead [ 440.828554][T21413] gfs2: not a GFS2 filesystem 10:38:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xffffffffffffffff, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="df424849"], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:18 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', 0x0, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:18 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 440.943880][T21431] binder: BINDER_SET_CONTEXT_MGR already set [ 440.964966][T21431] binder: 21429:21431 ioctl 40046207 0 returned -16 [ 441.030499][T21431] binder: 21429:21431 unknown command 1229472479 [ 441.078330][T21431] binder: 21429:21431 ioctl c0306201 20000140 returned -22 10:38:18 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 441.132632][T21437] gfs2: not a GFS2 filesystem [ 441.148381][ T5] binder: release 21429:21431 transaction 1142 out, still active 10:38:18 executing program 4: r0 = add_key$user(0x0, &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:18 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', 0x0, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 441.193956][ T5] binder: undelivered TRANSACTION_COMPLETE 10:38:19 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', 0x0, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:19 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:19 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000001c0)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x20000, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f00000000c0)={0x8, 0x80000001, 0x1}, 0xc) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0b6300001c67da938d8cd8d5ff5a7e696a1110a9955a44539a5c7433d37576990594ab"], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 441.697671][ T5] binder: release 21421:21426 transaction 1141 out, still active [ 441.705429][ T5] binder: undelivered TRANSACTION_COMPLETE [ 441.728643][ T5] binder: send failed reply for transaction 1141, target dead [ 441.736350][ T5] binder: send failed reply for transaction 1142, target dead 10:38:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) [ 441.795297][T21465] binder: 21462:21465 ERROR: BC_REGISTER_LOOPER called without request [ 441.805196][T21467] gfs2: not a GFS2 filesystem [ 441.835132][T21472] binder: BINDER_SET_CONTEXT_MGR already set 10:38:19 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 441.882239][ T5] binder: release 21462:21465 transaction 1144 out, still active [ 441.895393][T21472] binder: 21471:21472 ioctl 40046207 0 returned -16 [ 441.895400][T21475] binder: 21471:21475 ERROR: BC_REGISTER_LOOPER called without request [ 441.914982][ T5] binder: undelivered TRANSACTION_COMPLETE 10:38:19 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 441.957805][ T5] binder: release 21462:21465 transaction 1144 in, still active 10:38:19 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 442.015513][ T5] binder: send failed reply for transaction 1144, target dead 10:38:19 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 442.061366][ T5] binder: send failed reply for transaction 1145 to 21471:21475 [ 442.117799][ T5] binder: undelivered TRANSACTION_COMPLETE 10:38:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) 10:38:19 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 442.160550][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 442.187507][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 442.193381][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:20 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 442.267498][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 442.273383][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 442.304830][T21491] gfs2: not a GFS2 filesystem [ 442.321679][T21494] binder: 21493:21494 ERROR: BC_REGISTER_LOOPER called without request [ 442.397784][ T22] binder: release 21493:21494 transaction 1147 out, still active 10:38:20 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 442.463699][ T22] binder: undelivered TRANSACTION_COMPLETE 10:38:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) [ 442.505322][ T7871] binder: send failed reply for transaction 1147, target dead [ 442.623009][T21509] binder: 21508:21509 ERROR: BC_REGISTER_LOOPER called without request 10:38:20 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x0, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:20 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 442.680206][ T7871] binder: release 21508:21509 transaction 1149 out, still active [ 442.699647][ T7871] binder: undelivered TRANSACTION_COMPLETE 10:38:20 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 442.774366][T21515] gfs2: not a GFS2 filesystem [ 442.795755][ T7871] binder: send failed reply for transaction 1149, target dead 10:38:20 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000040)}) 10:38:20 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380), 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:20 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, 0x0) [ 443.047323][T21538] gfs2: not a GFS2 filesystem [ 443.064231][T21539] binder: 21534:21539 ERROR: BC_REGISTER_LOOPER called without request 10:38:20 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:20 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380), 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 443.143170][ T7871] binder: release 21534:21539 transaction 1151 out, still active [ 443.164480][ T7871] binder: undelivered TRANSACTION_COMPLETE 10:38:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000040)}) [ 443.243756][ T7871] binder: send failed reply for transaction 1151, target dead [ 443.371452][T21556] binder: 21555:21556 ERROR: BC_REGISTER_LOOPER called without request [ 443.398025][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 443.404398][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 443.449213][ T7871] binder: release 21555:21556 transaction 1153 out, still active [ 443.475971][ T7871] binder: undelivered TRANSACTION_COMPLETE [ 443.521925][ T22] binder: send failed reply for transaction 1153, target dead 10:38:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f0000000280)={0x2, 0x0, [0xffffffff, 0x7, 0x1, 0x8, 0xffffffffffffff01, 0x7, 0x2, 0x20]}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) accept4(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f00000001c0)=0x80, 0x80000) setsockopt$CAIFSO_LINK_SELECT(r3, 0x116, 0x7f, &(0x7f0000000200)=0x6, 0x4) 10:38:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, 0x0) 10:38:21 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:21 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380), 0x0, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 443.748107][T21567] gfs2: not a GFS2 filesystem [ 443.789244][T21573] binder: 21563:21573 ERROR: BC_REGISTER_LOOPER called without request [ 443.803130][ T22] binder: release 21563:21573 transaction 1155 out, still active [ 443.817186][ T22] binder: undelivered TRANSACTION_COMPLETE [ 443.866712][ T22] binder: release 21563:21573 transaction 1155 in, still active 10:38:21 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000040)}) 10:38:21 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:21 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1", 0x9, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:21 executing program 4: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, 0x0) [ 443.913726][ T22] binder: send failed reply for transaction 1155, target dead 10:38:21 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 443.999498][T21586] binder: 21579:21586 ERROR: BC_REGISTER_LOOPER called without request [ 444.035883][T21590] gfs2: not a GFS2 filesystem [ 444.082614][ T22] binder: release 21579:21586 transaction 1157 out, still active [ 444.107559][ T22] binder: undelivered TRANSACTION_COMPLETE 10:38:21 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)) 10:38:21 executing program 1: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 444.200098][ T22] binder: send failed reply for transaction 1157, target dead 10:38:22 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 444.268449][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 444.274819][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 444.338810][T21603] gfs2: not a GFS2 filesystem [ 444.357492][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 444.363348][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)) 10:38:22 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 444.835213][T21616] gfs2: not a GFS2 filesystem 10:38:22 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) 10:38:22 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1", 0x9, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:22 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:22 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)) 10:38:22 executing program 4: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 445.185263][T21633] gfs2: not a GFS2 filesystem 10:38:22 executing program 1: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:22 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") 10:38:23 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 445.467509][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 445.473332][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 445.505392][T21654] gfs2: not a GFS2 filesystem 10:38:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") 10:38:23 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) [ 445.803351][T21663] gfs2: not a GFS2 filesystem 10:38:23 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:23 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12") 10:38:23 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1", 0x9, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 446.107485][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 446.113333][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:38:23 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 446.200616][T21680] gfs2: not a GFS2 filesystem 10:38:23 executing program 4: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={0x0, 0x0, 0x18}, 0x10) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:24 executing program 1: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") 10:38:24 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) [ 446.550980][T21700] gfs2: not a GFS2 filesystem 10:38:24 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") [ 446.958878][T21715] gfs2: not a GFS2 filesystem 10:38:24 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914", 0xd, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188") [ 447.315302][T21726] gfs2: not a GFS2 filesystem 10:38:25 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") 10:38:25 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:25 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 447.569277][T21735] gfs2: not a GFS2 filesystem 10:38:25 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:25 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) 10:38:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") 10:38:25 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r0}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:25 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 447.896379][T21756] gfs2: not a GFS2 filesystem 10:38:25 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:25 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914", 0xd, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b0") 10:38:25 executing program 1: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 448.257272][T21780] gfs2: not a GFS2 filesystem 10:38:26 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 448.428217][ C1] net_ratelimit: 8 callbacks suppressed [ 448.428262][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 448.440343][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 448.507531][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 448.513330][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:26 executing program 2: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:26 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:26 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:26 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914", 0xd, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:26 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:26 executing program 1: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914", 0xd, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:26 executing program 2: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:26 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:27 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:27 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 449.638061][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 449.644370][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:27 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:27 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55", 0xf, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:27 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) 10:38:27 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:27 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='security.SMACK64MMAP\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', 0x16, 0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0x1, 0xffffffff}, 0x10) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) keyctl$read(0xb, r0, &(0x7f0000000600)=""/229, 0xe5) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:27 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x8000, 0x0) mknodat(r2, &(0x7f00000000c0)='./file0\x00', 0x8000, 0xffff) [ 450.474574][T21850] binder: 21849:21850 ERROR: BC_REGISTER_LOOPER called without request [ 450.518052][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 450.524548][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 450.588484][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 450.594970][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:28 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) [ 450.643230][ T12] binder: release 21849:21850 transaction 1159 out, still active [ 450.714273][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x8000, 0x0) mknodat(r2, &(0x7f00000000c0)='./file0\x00', 0x8000, 0xffff) [ 450.793489][ T22] binder: release 21849:21850 transaction 1159 in, still active [ 450.838899][ T22] binder: send failed reply for transaction 1159, target dead 10:38:28 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 450.942945][T21860] binder: 21858:21860 ERROR: BC_REGISTER_LOOPER called without request 10:38:28 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) [ 451.055541][ T12] binder: release 21858:21860 transaction 1161 out, still active [ 451.077158][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:28 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55", 0xf, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x8000, 0x0) mknodat(r2, &(0x7f00000000c0)='./file0\x00', 0x8000, 0xffff) [ 451.169166][ T12] binder: release 21858:21860 transaction 1161 in, still active [ 451.189347][ T12] binder: send failed reply for transaction 1161, target dead [ 451.301594][T21874] binder: 21873:21874 ERROR: BC_REGISTER_LOOPER called without request 10:38:29 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55", 0xf, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:29 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 451.423215][ T12] binder: release 21873:21874 transaction 1163 out, still active [ 451.444591][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:29 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) 10:38:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x8000, 0x0) [ 451.539443][ T12] binder: release 21873:21874 transaction 1163 in, still active [ 451.556876][ T12] binder: send failed reply for transaction 1163, target dead 10:38:29 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 451.698629][T21890] binder: 21883:21890 ERROR: BC_REGISTER_LOOPER called without request [ 451.760647][ T22] binder: release 21883:21890 transaction 1165 out, still active [ 451.778911][ T22] binder: undelivered TRANSACTION_COMPLETE 10:38:29 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:29 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) [ 451.877588][ T22] binder: release 21883:21890 transaction 1165 in, still active [ 451.900304][ T22] binder: send failed reply for transaction 1165, target dead [ 452.007146][T21900] binder: 21899:21900 ERROR: BC_REGISTER_LOOPER called without request 10:38:29 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55", 0xf, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 452.082821][ T22] binder: release 21899:21900 transaction 1167 out, still active [ 452.108476][ T22] binder: undelivered TRANSACTION_COMPLETE 10:38:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 452.181970][ T22] binder: release 21899:21900 transaction 1167 in, still active [ 452.218092][ T22] binder: send failed reply for transaction 1167, target dead [ 452.306582][ T7871] binder: undelivered TRANSACTION_COMPLETE 10:38:30 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r0 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 452.399127][ T22] binder: send failed reply for transaction 1169, target dead 10:38:30 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55", 0xf, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:30 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r0 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 452.561959][T21919] binder: 21917:21919 transaction failed 29189/-22, size 0-0 line 2995 [ 452.617050][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:30 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) 10:38:30 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) write$vhci(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:30 executing program 0: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r0 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 452.893478][T21934] binder: 21931:21934 transaction failed 29189/-22, size 0-0 line 2995 [ 452.910372][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:30 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:30 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e7", 0x10, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 453.155058][T21943] binder: 21942:21943 transaction failed 29189/-22, size 0-0 line 2995 [ 453.268790][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 453.568517][T21952] binder_alloc: 21951: binder_alloc_buf, no vma 10:38:31 executing program 4: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) [ 453.610156][T21952] binder: 21951:21952 transaction failed 29189/-3, size 0-0 line 3148 10:38:31 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) [ 453.740505][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 453.787697][ C1] net_ratelimit: 16 callbacks suppressed [ 453.787730][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 453.800011][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 453.947753][T21964] binder_alloc: 21962: binder_alloc_buf, no vma 10:38:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) [ 453.995678][T21964] binder: 21962:21964 transaction failed 29189/-3, size 0-0 line 3148 10:38:31 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 454.094669][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:31 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e7", 0x10, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:32 executing program 1: clock_gettime(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) [ 454.329092][T21978] binder_alloc: 21976: binder_alloc_buf, no vma [ 454.388054][T21978] binder: 21976:21978 transaction failed 29189/-3, size 0-0 line 3148 [ 454.427858][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 454.434584][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 454.454855][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:32 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:32 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 454.689972][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 454.693614][T21990] binder: 21988:21990 transaction failed 29189/-22, size 0-0 line 2995 [ 454.695799][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 454.750963][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:32 executing program 4: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) 10:38:32 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:32 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:32 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:32 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e7", 0x10, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 455.262835][T22013] binder: 22010:22013 transaction failed 29189/-22, size 0-0 line 2995 10:38:33 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 455.417287][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:33 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 455.467526][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 455.467555][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 455.473531][ C0] protocol 88fb is buggy, dev hsr_slave_1 10:38:33 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x2) r0 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:33 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:33 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:33 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:33 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:33 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:33 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:33 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:33 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:33 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:34 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:34 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x2) r0 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:34 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:34 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:34 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:34 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:34 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) [ 456.827584][ C1] protocol 88fb is buggy, dev hsr_slave_0 10:38:34 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:34 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 456.987622][T22100] binder: 22096:22100 transaction failed 29189/-22, size 0-0 line 2995 10:38:34 executing program 5: clock_gettime(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) [ 457.162419][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:35 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 457.506490][T22118] binder_alloc: 22115: binder_alloc_buf, no vma [ 457.530479][T22118] binder: 22115:22118 transaction failed 29189/-3, size 0-0 line 3148 [ 457.540180][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:35 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:35 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 457.714931][T22132] binder_alloc: 22131: binder_alloc_buf, no vma [ 457.823337][T22132] binder: 22131:22132 transaction failed 29189/-3, size 0-0 line 3148 [ 457.850560][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:35 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:35 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 458.119101][T22139] binder_alloc: 22138: binder_alloc_buf, no vma [ 458.125434][T22139] binder: 22138:22139 transaction failed 29189/-3, size 0-0 line 3148 10:38:35 executing program 5: clock_gettime(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:35 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) [ 458.209462][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:36 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:36 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 458.360402][T22153] binder_alloc: 22151: binder_alloc_buf, no vma [ 458.471530][T22153] binder: 22151:22153 transaction failed 29189/-3, size 0-0 line 3148 [ 458.507215][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:36 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 458.723019][T22166] binder_alloc: 22164: binder_alloc_buf, no vma 10:38:36 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 458.823687][T22166] binder: 22164:22166 transaction failed 29189/-3, size 0-0 line 3148 10:38:36 executing program 5: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) [ 458.924956][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:36 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:36 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x2) r0 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:36 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 459.145505][T22182] binder: 22181:22182 transaction failed 29189/-22, size 0-0 line 2995 10:38:36 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 459.211447][ T22] binder: undelivered TRANSACTION_ERROR: 29189 10:38:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:37 executing program 5: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:37 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:37 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:37 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 459.577915][T22195] binder: 22194:22195 transaction failed 29189/-22, size 0-0 line 2995 10:38:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 459.663979][ T12] binder: undelivered TRANSACTION_ERROR: 29189 10:38:37 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:37 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:37 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:37 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:38 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:38 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:38 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:38 executing program 5: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:38 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:38 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:38 executing program 2: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:38 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:38:38 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:38 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) [ 461.098126][T22257] binder: 22256:22257 ioctl c0306201 0 returned -14 10:38:38 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:38 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:38 executing program 5: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) 10:38:39 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:38:39 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 461.487593][T22278] binder: 22277:22278 ioctl c0306201 0 returned -14 10:38:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 10:38:39 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:39 executing program 5: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:39 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(0xffffffffffffffff, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 461.828264][T22286] binder: 22285:22286 ioctl c0306201 0 returned -14 10:38:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10:38:39 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:39 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10:38:40 executing program 4: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 10:38:40 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:40 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:40 executing program 5: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:40 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:38:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:38:40 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) 10:38:40 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:40 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000040)=""/144) 10:38:41 executing program 4: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000040)=""/144) 10:38:41 executing program 5: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000040)=""/144) 10:38:41 executing program 2: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000040)=""/144) 10:38:41 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:41 executing program 1: clock_gettime(0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r1 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000040)=""/144) 10:38:41 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x1, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:41 executing program 5: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) 10:38:42 executing program 2: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) 10:38:42 executing program 4: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) 10:38:42 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:42 executing program 5: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000040)=""/144) 10:38:42 executing program 1: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000040)=""/144) 10:38:42 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x40001) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:42 executing program 4: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) 10:38:43 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:43 executing program 2: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) 10:38:43 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000013, &(0x7f0000000180), 0x4) ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0xffffffffffff71d6) sendto$unix(r0, &(0x7f0000000040), 0x10000005e, 0x0, 0x0, 0x0) 10:38:43 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:43 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000180)=0x0) ioctl$TCGETS(r0, 0x5401, &(0x7f0000000040)) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$perf(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x9050, r2, 0x0) read$rfkill(r0, 0x0, 0x2ca) getsockname$netrom(r0, &(0x7f0000000080)={{0x3, @bcast}, [@default, @netrom, @bcast, @rose, @bcast, @remote, @rose]}, &(0x7f00000001c0)=0x48) [ 465.867505][ C1] net_ratelimit: 3 callbacks suppressed [ 465.867515][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 465.867545][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 465.873239][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:43 executing program 5: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000040)=""/144) 10:38:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:43 executing program 2: clock_gettime(0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000a80)='/dev/zero\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000b00)='TIPC\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0x2) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80041272, 0x0) r2 = socket$inet6_sctp(0xa, 0x4080000000000005, 0x84) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0x0, 0x0, &(0x7f0000000980)="29c1943e6f4429102e3bbee829dd2db7729592e4bac98129166f93a8776a1916538cff3ea903f97e81169f1623eeaf06e107576e840577f6abc95b7d9d7db562cc4035a0ff9bde2eaf8eef46a11f5a2a544bd4ef3a8d35ee90da8245ccc3d39eed2ea725bb8cd31658faf4cfe58649b0a8520c5f6e00ae50ef2501") prctl$PR_SET_UNALIGN(0x6, 0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x20, &(0x7f0000000140)=[@in={0x2, 0x4e23, @loopback=0xac14140b}, @in={0x2, 0x4e23, @local={0xac, 0xc0}}]}, &(0x7f00000001c0)=0x10) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000100)=0x8, 0x4) [ 466.176356][ T12] binder_thread_release: 1 callbacks suppressed [ 466.176368][ T12] binder: release 22432:22433 transaction 1207 out, still active 10:38:43 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='veth1\x00', 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000013, &(0x7f0000000180), 0x4) ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0xffffffffffff71d6) sendto$unix(r0, &(0x7f0000000040), 0x10000005e, 0x0, 0x0, 0x0) 10:38:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 466.306420][ T12] binder: undelivered TRANSACTION_COMPLETE [ 466.334517][ T12] binder: send failed reply for transaction 1207, target dead 10:38:44 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 466.594071][T22444] binder: BINDER_SET_CONTEXT_MGR already set 10:38:44 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(0x0, &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 466.640459][T22444] binder: 22442:22444 ioctl 40046207 20000140 returned -16 [ 466.695287][ T7871] binder: release 22442:22444 transaction 1209 out, still active [ 466.712985][ T7871] binder: undelivered TRANSACTION_COMPLETE 10:38:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:44 executing program 5: recvmmsg(0xffffffffffffffff, &(0x7f0000009e40)=[{{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='maps\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000140)=""/18, 0x7fffec57}, {&(0x7f0000000180)=""/110}, {&(0x7f0000000200)=""/219, 0x3a9}, {&(0x7f0000000300)=""/60}, {&(0x7f0000000340)=""/29}, {&(0x7f0000000380)=""/193}, {&(0x7f0000000480)=""/192}, {&(0x7f0000000540)=""/219}], 0x10000000000000f0, 0x0) 10:38:44 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(0x0, &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 466.783274][ T7871] binder: send failed reply for transaction 1209, target dead 10:38:44 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(0x0, &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 466.888259][T22458] binder: BINDER_SET_CONTEXT_MGR already set [ 466.908276][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 466.914436][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 466.925937][T22458] binder: 22456:22458 ioctl 40046207 20000140 returned -16 [ 466.951502][ T12] binder: release 22456:22458 transaction 1211 out, still active [ 466.966456][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:44 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x200, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={r1, 0x7, 0xfffffffffffffeff, 0x0, 0x59168f5e, 0xffffffffffffff88}, &(0x7f0000000200)=0x224) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000280)={{0x37, @multicast1, 0x4e24, 0x2, 'rr\x00', 0x2, 0x100000001, 0x51}, {@empty, 0x4e24, 0x2000, 0x3, 0x6, 0x16}}, 0x44) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000240), 0x4) read$rfkill(r0, 0x0, 0x0) 10:38:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:44 executing program 2: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x3, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000240)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@empty, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) getresgid(&(0x7f0000000440), &(0x7f0000000480)=0x0, &(0x7f00000004c0)) fstat(0xffffffffffffff9c, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000640)=0x0, &(0x7f0000000680), &(0x7f00000006c0)) getgroups(0xa, &(0x7f0000000700)=[0xee01, 0xee01, 0xee01, 0xee00, 0x0, 0xffffffffffffffff, 0xee01, 0xee00, 0xffffffffffffffff, 0x0]) fstat(0xffffffffffffff9c, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000007c0)={0x0, 0x0, 0x0}, &(0x7f0000000800)=0xc) lstat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x2, &(0x7f0000000900)=[0xee01, 0x0]) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000940)={{{@in6=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000a40)=0xe8) r14 = getegid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a80)={{{@in, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000b80)=0xe8) getgroups(0x9, &(0x7f0000000bc0)=[0xffffffffffffffff, 0xee01, 0xffffffffffffffff, 0xee01, 0xee01, 0x0, 0xffffffffffffffff, 0xee01, 0xffffffffffffffff]) r17 = geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000c80)={0x0, 0x0}, &(0x7f0000000cc0)=0xc) getresgid(&(0x7f0000000d00)=0x0, &(0x7f0000000d40), &(0x7f0000000d80)) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000dc0)={0x6b8, 0x0, 0x5, [{{0x6, 0x3, 0x3, 0x5, 0x2, 0x0, {0x6, 0x95e, 0x5, 0x8, 0x3f, 0xffffffff, 0x20, 0x7d6, 0x7, 0xfffffffe0000000, 0xdb, r1, r2, 0x5, 0x5}}, {0x5, 0x9, 0x1, 0x4, '.'}}, {{0x4, 0x3, 0xffffffff, 0x5, 0x401, 0x7, {0x1, 0x7ff, 0x4, 0x5, 0x8, 0x3, 0x5, 0xffffffffffffff93, 0x7ff, 0x5847, 0x1, r3, r4, 0x9, 0x7}}, {0x5, 0x1, 0x16, 0x800, 'trusted.overlay.nlink\x00'}}, {{0x3, 0x0, 0x7d8b, 0x800, 0x0, 0x5, {0x1, 0x0, 0x100000001, 0x8, 0x800, 0x6, 0x0, 0x3, 0x2, 0x200, 0x6, r5, r6, 0x2, 0x80000001}}, {0x3, 0x6, 0x12, 0x3, '/proc/capi/capi20\x00'}}, {{0x5, 0x3, 0x80, 0x1000, 0x55c, 0x65, {0x5, 0x6, 0x10a, 0x2, 0x6, 0x800, 0xb50, 0x9, 0x2, 0x0, 0x77, r7, r8, 0x298953bd, 0x3}}, {0x0, 0x7fffffff, 0xb, 0x6, 'ppp1^md5sum'}}, {{0x6, 0x1, 0xfffffffffffffffa, 0x9b9, 0x3f, 0x4, {0x1, 0xfffffffffffffffb, 0x5, 0x6, 0x1, 0x40, 0x9, 0x80, 0x558, 0x4, 0x1, r9, r10, 0x0, 0x39e6000000000000}}, {0x0, 0x6f1e, 0x16, 0x61da, 'trusted.overlay.nlink\x00'}}, {{0x5, 0x1, 0x7ff, 0x2, 0x2064182d, 0x3f, {0x1, 0x2, 0x100, 0x1ff, 0x1, 0x81, 0x7e91, 0x101, 0x6, 0x800, 0xfff, r11, r12, 0x1, 0xb1ff}}, {0x4, 0x7, 0x12, 0x7, '/proc/capi/capi20\x00'}}, {{0x5, 0x0, 0x5, 0x0, 0x7f, 0x9, {0x0, 0x3853d137, 0x7, 0x7, 0x0, 0x1, 0x80000001, 0xd95, 0x3, 0x7ff, 0x66c5, r13, r14, 0xfff, 0x6cfa8354}}, {0x5, 0x0, 0x2, 0x9, 'L+'}}, {{0x3, 0x0, 0x401, 0x0, 0xfffffffffffffffe, 0x8001, {0x1, 0x80, 0x7fffffff, 0x81, 0x2, 0x7, 0x1, 0x200, 0x7, 0x4, 0xffffffffffffffff, r15, r16, 0xffffffffffffffa9}}, {0x3, 0x67, 0x12, 0x0, '/proc/capi/capi20\x00'}}, {{0x5, 0x1, 0x101, 0x1, 0x7, 0x7, {0x2, 0x7ff, 0x7ff, 0x5f13, 0x7, 0x6, 0x3, 0x0, 0x3, 0x310, 0x3, r17, r18, 0xfff, 0xfffffffffffffff8}}, {0x3, 0x3ff, 0x16, 0xf8000, 'trusted.overlay.nlink\x00'}}, {{0x2, 0x2, 0x3, 0x8, 0xfffffffffffffffb, 0x0, {0x6, 0x5, 0x7, 0x5, 0x21f5, 0xfffffffffffffffb, 0xf0, 0x8, 0x4, 0x8001, 0xc, r19, r20, 0x1, 0x1}}, {0x5, 0x5, 0x6, 0x8, '/user\''}}]}, 0x6b8) r21 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read$rfkill(r21, 0x0, 0x0) fsetxattr$trusted_overlay_nlink(r21, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'L+', 0xfffffffffffffffe}, 0x28, 0x2) connect$nfc_llcp(r21, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x1, 0x100000001, 0x8, "6650ee7ff35b77d6f3c2e4001219fc73b826171557966a852f8f37c5d0a137bd16d4998e588bccdb3a206f21bf58b4463b3fc7cfe4d1f91ce181e5f41b397e", 0x1a}, 0x60) [ 467.017806][ T12] binder: send failed reply for transaction 1211, target dead 10:38:44 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 467.101424][T22470] binder: BINDER_SET_CONTEXT_MGR already set [ 467.126726][T22470] binder: 22468:22470 ioctl 40046207 20000140 returned -16 10:38:44 executing program 1 (fault-call:4 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 467.157491][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 467.160993][ T12] binder: release 22468:22470 transaction 1213 out, still active [ 467.163449][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 467.188246][ T12] binder: undelivered TRANSACTION_COMPLETE 10:38:44 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 467.227500][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 467.233374][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 467.244140][ T12] binder: send failed reply for transaction 1213, target dead [ 467.361219][T22482] FAULT_INJECTION: forcing a failure. [ 467.361219][T22482] name failslab, interval 1, probability 0, space 0, times 0 [ 467.380593][T22481] binder: BINDER_SET_CONTEXT_MGR already set 10:38:45 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:45 executing program 5 (fault-call:5 fault-nth:0): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 467.415664][T22481] binder: 22480:22481 ioctl 40046207 0 returned -16 [ 467.436366][T22482] CPU: 1 PID: 22482 Comm: syz-executor.1 Not tainted 5.1.0-rc3-next-20190408 #20 [ 467.445522][T22482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 467.455779][T22482] Call Trace: [ 467.459099][T22482] dump_stack+0x172/0x1f0 [ 467.463484][T22482] should_fail.cold+0xa/0x15 [ 467.468116][T22482] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 467.474054][T22482] ? ___might_sleep+0x163/0x280 [ 467.479028][T22482] __should_failslab+0x121/0x190 [ 467.484001][T22482] should_failslab+0x9/0x14 [ 467.488535][T22482] kmem_cache_alloc_trace+0x2d1/0x760 [ 467.494200][T22482] ? kasan_check_read+0x11/0x20 [ 467.499085][T22482] ? do_raw_spin_unlock+0x57/0x270 [ 467.504410][T22482] ? _raw_spin_unlock+0x2d/0x50 [ 467.509284][T22482] binder_get_thread+0x1db/0x7c0 [ 467.514341][T22482] ? __might_sleep+0x95/0x190 [ 467.519038][T22482] binder_ioctl+0x1e5/0x183b [ 467.523821][T22482] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 467.530201][T22482] ? binder_thread_write+0x2820/0x2820 [ 467.536104][T22482] ? tomoyo_path_number_perm+0x263/0x520 [ 467.541933][T22482] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 467.547775][T22482] ? __fget+0x35a/0x550 [ 467.548512][T22481] binder: BINDER_SET_CONTEXT_MGR already set [ 467.551967][T22482] ? binder_thread_write+0x2820/0x2820 [ 467.563511][T22482] do_vfs_ioctl+0xd6e/0x1390 [ 467.568133][T22482] ? ioctl_preallocate+0x210/0x210 [ 467.573287][T22482] ? __fget+0x381/0x550 [ 467.573482][T22481] binder: 22480:22481 ioctl 40046207 20000140 returned -16 [ 467.577471][T22482] ? ksys_dup3+0x3e0/0x3e0 [ 467.577495][T22482] ? tomoyo_file_ioctl+0x23/0x30 [ 467.577512][T22482] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 467.577523][T22482] ? security_file_ioctl+0x93/0xc0 [ 467.577541][T22482] ksys_ioctl+0xab/0xd0 [ 467.577559][T22482] __x64_sys_ioctl+0x73/0xb0 [ 467.577577][T22482] do_syscall_64+0x103/0x610 [ 467.577607][T22482] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 467.625569][T22482] RIP: 0033:0x4582b9 [ 467.629472][T22482] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 467.649957][T22482] RSP: 002b:00007fa5d607ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 467.658385][T22482] RAX: ffffffffffffffda RBX: 00007fa5d607ac90 RCX: 00000000004582b9 10:38:45 executing program 2: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x3, 0x2) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000240)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@empty, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@local}}, &(0x7f0000000400)=0xe8) getresgid(&(0x7f0000000440), &(0x7f0000000480)=0x0, &(0x7f00000004c0)) fstat(0xffffffffffffff9c, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000640)=0x0, &(0x7f0000000680), &(0x7f00000006c0)) getgroups(0xa, &(0x7f0000000700)=[0xee01, 0xee01, 0xee01, 0xee00, 0x0, 0xffffffffffffffff, 0xee01, 0xee00, 0xffffffffffffffff, 0x0]) fstat(0xffffffffffffff9c, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000007c0)={0x0, 0x0, 0x0}, &(0x7f0000000800)=0xc) lstat(&(0x7f0000000840)='./file0\x00', &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x2, &(0x7f0000000900)=[0xee01, 0x0]) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000940)={{{@in6=@empty, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000a40)=0xe8) r14 = getegid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a80)={{{@in, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000b80)=0xe8) getgroups(0x9, &(0x7f0000000bc0)=[0xffffffffffffffff, 0xee01, 0xffffffffffffffff, 0xee01, 0xee01, 0x0, 0xffffffffffffffff, 0xee01, 0xffffffffffffffff]) r17 = geteuid() fstat(0xffffffffffffff9c, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000c80)={0x0, 0x0}, &(0x7f0000000cc0)=0xc) getresgid(&(0x7f0000000d00)=0x0, &(0x7f0000000d40), &(0x7f0000000d80)) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000dc0)={0x6b8, 0x0, 0x5, [{{0x6, 0x3, 0x3, 0x5, 0x2, 0x0, {0x6, 0x95e, 0x5, 0x8, 0x3f, 0xffffffff, 0x20, 0x7d6, 0x7, 0xfffffffe0000000, 0xdb, r1, r2, 0x5, 0x5}}, {0x5, 0x9, 0x1, 0x4, '.'}}, {{0x4, 0x3, 0xffffffff, 0x5, 0x401, 0x7, {0x1, 0x7ff, 0x4, 0x5, 0x8, 0x3, 0x5, 0xffffffffffffff93, 0x7ff, 0x5847, 0x1, r3, r4, 0x9, 0x7}}, {0x5, 0x1, 0x16, 0x800, 'trusted.overlay.nlink\x00'}}, {{0x3, 0x0, 0x7d8b, 0x800, 0x0, 0x5, {0x1, 0x0, 0x100000001, 0x8, 0x800, 0x6, 0x0, 0x3, 0x2, 0x200, 0x6, r5, r6, 0x2, 0x80000001}}, {0x3, 0x6, 0x12, 0x3, '/proc/capi/capi20\x00'}}, {{0x5, 0x3, 0x80, 0x1000, 0x55c, 0x65, {0x5, 0x6, 0x10a, 0x2, 0x6, 0x800, 0xb50, 0x9, 0x2, 0x0, 0x77, r7, r8, 0x298953bd, 0x3}}, {0x0, 0x7fffffff, 0xb, 0x6, 'ppp1^md5sum'}}, {{0x6, 0x1, 0xfffffffffffffffa, 0x9b9, 0x3f, 0x4, {0x1, 0xfffffffffffffffb, 0x5, 0x6, 0x1, 0x40, 0x9, 0x80, 0x558, 0x4, 0x1, r9, r10, 0x0, 0x39e6000000000000}}, {0x0, 0x6f1e, 0x16, 0x61da, 'trusted.overlay.nlink\x00'}}, {{0x5, 0x1, 0x7ff, 0x2, 0x2064182d, 0x3f, {0x1, 0x2, 0x100, 0x1ff, 0x1, 0x81, 0x7e91, 0x101, 0x6, 0x800, 0xfff, r11, r12, 0x1, 0xb1ff}}, {0x4, 0x7, 0x12, 0x7, '/proc/capi/capi20\x00'}}, {{0x5, 0x0, 0x5, 0x0, 0x7f, 0x9, {0x0, 0x3853d137, 0x7, 0x7, 0x0, 0x1, 0x80000001, 0xd95, 0x3, 0x7ff, 0x66c5, r13, r14, 0xfff, 0x6cfa8354}}, {0x5, 0x0, 0x2, 0x9, 'L+'}}, {{0x3, 0x0, 0x401, 0x0, 0xfffffffffffffffe, 0x8001, {0x1, 0x80, 0x7fffffff, 0x81, 0x2, 0x7, 0x1, 0x200, 0x7, 0x4, 0xffffffffffffffff, r15, r16, 0xffffffffffffffa9}}, {0x3, 0x67, 0x12, 0x0, '/proc/capi/capi20\x00'}}, {{0x5, 0x1, 0x101, 0x1, 0x7, 0x7, {0x2, 0x7ff, 0x7ff, 0x5f13, 0x7, 0x6, 0x3, 0x0, 0x3, 0x310, 0x3, r17, r18, 0xfff, 0xfffffffffffffff8}}, {0x3, 0x3ff, 0x16, 0xf8000, 'trusted.overlay.nlink\x00'}}, {{0x2, 0x2, 0x3, 0x8, 0xfffffffffffffffb, 0x0, {0x6, 0x5, 0x7, 0x5, 0x21f5, 0xfffffffffffffffb, 0xf0, 0x8, 0x4, 0x8001, 0xc, r19, r20, 0x1, 0x1}}, {0x5, 0x5, 0x6, 0x8, '/user\''}}]}, 0x6b8) r21 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read$rfkill(r21, 0x0, 0x0) fsetxattr$trusted_overlay_nlink(r21, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'L+', 0xfffffffffffffffe}, 0x28, 0x2) connect$nfc_llcp(r21, &(0x7f00000000c0)={0x27, 0x0, 0x1, 0x1, 0x100000001, 0x8, "6650ee7ff35b77d6f3c2e4001219fc73b826171557966a852f8f37c5d0a137bd16d4998e588bccdb3a206f21bf58b4463b3fc7cfe4d1f91ce181e5f41b397e", 0x1a}, 0x60) 10:38:45 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 467.666376][T22482] RDX: 0000000020000180 RSI: 00000000c0306201 RDI: 0000000000000003 [ 467.674404][T22482] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 467.682400][T22482] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa5d607b6d4 [ 467.691028][T22482] R13: 00000000004bf54b R14: 00000000004d12f8 R15: 0000000000000005 [ 467.733606][T22485] FAULT_INJECTION: forcing a failure. [ 467.733606][T22485] name failslab, interval 1, probability 0, space 0, times 0 [ 467.798532][T22493] binder: BINDER_SET_CONTEXT_MGR already set [ 467.826729][T22485] CPU: 1 PID: 22485 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190408 #20 [ 467.836433][T22485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 467.846530][T22485] Call Trace: [ 467.849851][T22485] dump_stack+0x172/0x1f0 [ 467.854207][T22485] should_fail.cold+0xa/0x15 [ 467.858915][T22485] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 467.864779][T22485] ? ___might_sleep+0x163/0x280 [ 467.869652][T22485] __should_failslab+0x121/0x190 [ 467.874613][T22485] should_failslab+0x9/0x14 [ 467.879151][T22485] kmem_cache_alloc_node+0x264/0x710 [ 467.884458][T22485] ? mark_held_locks+0xf0/0xf0 [ 467.889244][T22485] ? lock_sock_nested+0xac/0x120 [ 467.894209][T22485] __alloc_skb+0xd5/0x5e0 [ 467.898559][T22485] ? skb_trim+0x190/0x190 [ 467.902924][T22485] ? lock_sock_nested+0x9a/0x120 [ 467.907921][T22485] ? trace_hardirqs_on+0x67/0x230 [ 467.913051][T22485] ? lock_sock_nested+0x9a/0x120 [ 467.918023][T22485] sock_wmalloc+0xd9/0x120 [ 467.922642][T22485] pppoe_sendmsg+0x2c4/0x7e0 [ 467.927260][T22485] ? pppoe_getname+0x120/0x120 [ 467.932046][T22485] ? apparmor_socket_sendmsg+0x2a/0x30 [ 467.937906][T22485] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 467.944169][T22485] ? security_socket_sendmsg+0x93/0xc0 [ 467.947841][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 467.949652][T22485] ? pppoe_getname+0x120/0x120 [ 467.960202][T22485] sock_sendmsg+0xdd/0x130 [ 467.964735][T22485] ___sys_sendmsg+0x3e2/0x930 [ 467.969459][T22485] ? copy_msghdr_from_user+0x430/0x430 [ 467.974976][T22485] ? lock_downgrade+0x880/0x880 [ 467.979843][T22485] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 467.986143][T22485] ? kasan_check_read+0x11/0x20 [ 467.991028][T22485] ? __fget+0x381/0x550 [ 467.995210][T22485] ? ksys_dup3+0x3e0/0x3e0 [ 467.999655][T22485] ? get_pid_task+0xc9/0x190 [ 468.004299][T22485] ? find_held_lock+0x35/0x130 [ 468.009084][T22485] ? __fget_light+0x1a9/0x230 [ 468.013783][T22485] ? __fdget+0x1b/0x20 [ 468.017864][T22485] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 468.024132][T22485] ? sockfd_lookup_light+0xcb/0x180 [ 468.029354][T22485] __sys_sendmmsg+0x1bf/0x4d0 [ 468.034072][T22485] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 468.039125][T22485] ? kasan_check_write+0x14/0x20 10:38:45 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 468.044091][T22485] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 468.044938][T22482] binder: 22479:22482 ioctl c0306201 20000180 returned -12 [ 468.050346][T22485] ? fput_many+0x12c/0x1a0 [ 468.050359][T22485] ? fput+0x1b/0x20 [ 468.050376][T22485] ? ksys_write+0x1f1/0x2d0 [ 468.050396][T22485] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 468.050409][T22485] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 468.050422][T22485] ? do_syscall_64+0x26/0x610 [ 468.050438][T22485] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.050458][T22485] ? do_syscall_64+0x26/0x610 [ 468.050478][T22485] __x64_sys_sendmmsg+0x9d/0x100 [ 468.050496][T22485] do_syscall_64+0x103/0x610 [ 468.050512][T22485] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.050524][T22485] RIP: 0033:0x4582b9 [ 468.050539][T22485] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 468.050547][T22485] RSP: 002b:00007f5ac62c7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 468.050561][T22485] RAX: ffffffffffffffda RBX: 00007f5ac62c7c90 RCX: 00000000004582b9 [ 468.050578][T22485] RDX: 040000000000014d RSI: 0000000020005b40 RDI: 0000000000000003 [ 468.057974][T22493] binder: 22489:22493 ioctl 40046207 0 returned -16 [ 468.062198][T22485] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 468.062207][T22485] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5ac62c86d4 [ 468.062215][T22485] R13: 00000000004c5230 R14: 00000000004d9380 R15: 0000000000000005 [ 468.127600][T22493] binder: BINDER_SET_CONTEXT_MGR already set 10:38:45 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:45 executing program 2: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:46 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) 10:38:46 executing program 5 (fault-call:5 fault-nth:1): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 468.482484][T22511] FAULT_INJECTION: forcing a failure. [ 468.482484][T22511] name failslab, interval 1, probability 0, space 0, times 0 [ 468.484154][T22493] binder: 22489:22493 ioctl 40046207 20000140 returned -16 10:38:46 executing program 2: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 468.577862][T22511] CPU: 0 PID: 22511 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190408 #20 [ 468.587029][T22511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 468.593487][ T7871] binder: release 22512:22513 transaction 1216 out, still active [ 468.597112][T22511] Call Trace: [ 468.597150][T22511] dump_stack+0x172/0x1f0 [ 468.597175][T22511] should_fail.cold+0xa/0x15 [ 468.597203][T22511] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 468.623012][T22511] ? ___might_sleep+0x163/0x280 [ 468.627876][T22511] __should_failslab+0x121/0x190 [ 468.632816][T22511] should_failslab+0x9/0x14 [ 468.637413][T22511] kmem_cache_alloc_node_trace+0x270/0x720 [ 468.643243][T22511] __kmalloc_node_track_caller+0x3d/0x70 [ 468.648892][T22511] __kmalloc_reserve.isra.0+0x40/0xf0 [ 468.654290][T22511] __alloc_skb+0x10b/0x5e0 [ 468.658713][T22511] ? skb_trim+0x190/0x190 [ 468.663042][T22511] ? lock_sock_nested+0x9a/0x120 [ 468.667986][T22511] ? trace_hardirqs_on+0x67/0x230 [ 468.673017][T22511] ? lock_sock_nested+0x9a/0x120 [ 468.677983][T22511] sock_wmalloc+0xd9/0x120 [ 468.682409][T22511] pppoe_sendmsg+0x2c4/0x7e0 [ 468.687001][T22511] ? pppoe_getname+0x120/0x120 [ 468.691773][T22511] ? apparmor_socket_sendmsg+0x2a/0x30 [ 468.697234][T22511] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 468.703478][T22511] ? security_socket_sendmsg+0x93/0xc0 [ 468.708941][T22511] ? pppoe_getname+0x120/0x120 [ 468.713717][T22511] sock_sendmsg+0xdd/0x130 [ 468.718153][T22511] ___sys_sendmsg+0x3e2/0x930 [ 468.722837][T22511] ? copy_msghdr_from_user+0x430/0x430 [ 468.728342][T22511] ? lock_downgrade+0x880/0x880 [ 468.733203][T22511] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 468.739571][T22511] ? kasan_check_read+0x11/0x20 [ 468.744427][T22511] ? __fget+0x381/0x550 [ 468.748625][T22511] ? ksys_dup3+0x3e0/0x3e0 [ 468.753041][T22511] ? get_pid_task+0xc9/0x190 [ 468.757639][T22511] ? find_held_lock+0x35/0x130 [ 468.762417][T22511] ? __fget_light+0x1a9/0x230 [ 468.767096][T22511] ? __fdget+0x1b/0x20 [ 468.771176][T22511] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 468.777417][T22511] ? sockfd_lookup_light+0xcb/0x180 [ 468.782637][T22511] __sys_sendmmsg+0x1bf/0x4d0 [ 468.787426][T22511] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 468.792500][T22511] ? kasan_check_write+0x14/0x20 [ 468.797718][T22511] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 468.803993][T22511] ? fput_many+0x12c/0x1a0 [ 468.808431][T22511] ? fput+0x1b/0x20 [ 468.812260][T22511] ? ksys_write+0x1f1/0x2d0 [ 468.816779][T22511] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 468.822240][T22511] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 468.827701][T22511] ? do_syscall_64+0x26/0x610 [ 468.832374][T22511] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.838461][T22511] ? do_syscall_64+0x26/0x610 [ 468.843154][T22511] __x64_sys_sendmmsg+0x9d/0x100 [ 468.848106][T22511] do_syscall_64+0x103/0x610 [ 468.852724][T22511] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.858617][T22511] RIP: 0033:0x4582b9 [ 468.862520][T22511] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 468.882137][T22511] RSP: 002b:00007f5ac62c7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 468.890567][T22511] RAX: ffffffffffffffda RBX: 00007f5ac62c7c90 RCX: 00000000004582b9 [ 468.898538][T22511] RDX: 040000000000014d RSI: 0000000020005b40 RDI: 0000000000000003 [ 468.906510][T22511] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 468.914667][T22511] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5ac62c86d4 [ 468.922662][T22511] R13: 00000000004c5230 R14: 00000000004d9380 R15: 0000000000000005 10:38:46 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 468.966578][ T7871] binder: undelivered TRANSACTION_COMPLETE 10:38:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 469.018445][ T7871] binder: send failed reply for transaction 1216, target dead 10:38:46 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) 10:38:46 executing program 5 (fault-call:5 fault-nth:2): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:46 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) [ 469.168650][T22530] binder_alloc: binder_alloc_mmap_handler: 22527 20001000-20004000 already mapped failed -16 [ 469.227273][T22528] binder: BINDER_SET_CONTEXT_MGR already set [ 469.255032][T22538] binder_alloc: 22527: binder_alloc_buf, no vma [ 469.264467][T22528] binder: 22527:22528 ioctl 40046207 0 returned -16 [ 469.265343][T22542] FAULT_INJECTION: forcing a failure. [ 469.265343][T22542] name failslab, interval 1, probability 0, space 0, times 0 [ 469.281034][T22538] binder: 22536:22538 transaction failed 29189/-3, size 0-0 line 3148 [ 469.284044][T22542] CPU: 1 PID: 22542 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190408 #20 [ 469.301313][T22542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 469.311381][T22542] Call Trace: [ 469.314684][T22542] dump_stack+0x172/0x1f0 [ 469.319036][T22542] should_fail.cold+0xa/0x15 [ 469.323642][T22542] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 469.329458][T22542] ? mark_held_locks+0xf0/0xf0 [ 469.334238][T22542] __should_failslab+0x121/0x190 [ 469.339190][T22542] should_failslab+0x9/0x14 [ 469.343703][T22542] kmem_cache_alloc+0x47/0x6f0 [ 469.348412][ T5] binder: undelivered TRANSACTION_ERROR: 29189 [ 469.348485][T22542] ? lock_acquire+0x16f/0x3f0 [ 469.359344][T22542] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 469.365598][T22542] skb_clone+0x154/0x3b0 [ 469.369855][T22542] dev_queue_xmit_nit+0x2f0/0x980 [ 469.369873][T22542] ? validate_xmit_xfrm+0x42d/0xff0 [ 469.369892][T22542] dev_hard_start_xmit+0xbb/0x960 [ 469.369914][T22542] __dev_queue_xmit+0x2a9d/0x36c0 [ 469.369934][T22542] ? __might_fault+0x12b/0x1e0 [ 469.394944][T22542] ? find_held_lock+0x35/0x130 [ 469.399738][T22542] ? netdev_core_pick_tx+0x300/0x300 [ 469.405044][T22542] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 469.411329][T22542] ? iov_iter_advance+0x295/0xf70 [ 469.416381][T22542] dev_queue_xmit+0x18/0x20 [ 469.420890][T22542] ? dev_queue_xmit+0x18/0x20 [ 469.425573][T22542] pppoe_sendmsg+0x657/0x7e0 [ 469.430178][T22542] ? ether_setup+0x2d0/0x2d0 [ 469.434775][T22542] ? pppoe_getname+0x120/0x120 [ 469.439544][T22542] ? apparmor_socket_sendmsg+0x2a/0x30 [ 469.445025][T22542] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 469.451370][T22542] ? security_socket_sendmsg+0x93/0xc0 [ 469.456889][T22542] ? pppoe_getname+0x120/0x120 [ 469.461676][T22542] sock_sendmsg+0xdd/0x130 [ 469.466112][T22542] ___sys_sendmsg+0x3e2/0x930 [ 469.470806][T22542] ? copy_msghdr_from_user+0x430/0x430 [ 469.476287][T22542] ? lock_downgrade+0x880/0x880 [ 469.481198][T22542] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 469.487470][T22542] ? kasan_check_read+0x11/0x20 [ 469.492337][T22542] ? __fget+0x381/0x550 [ 469.496511][T22542] ? ksys_dup3+0x3e0/0x3e0 [ 469.500944][T22542] ? get_pid_task+0xc9/0x190 [ 469.505554][T22542] ? find_held_lock+0x35/0x130 [ 469.510718][T22542] ? __fget_light+0x1a9/0x230 [ 469.515423][T22542] ? __fdget+0x1b/0x20 [ 469.519501][T22542] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 469.525769][T22542] ? sockfd_lookup_light+0xcb/0x180 [ 469.531191][T22542] __sys_sendmmsg+0x1bf/0x4d0 [ 469.535887][T22542] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 469.540937][T22542] ? kasan_check_write+0x14/0x20 [ 469.545899][T22542] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 469.552254][T22542] ? fput_many+0x12c/0x1a0 [ 469.556711][T22542] ? fput+0x1b/0x20 [ 469.560539][T22542] ? ksys_write+0x1f1/0x2d0 [ 469.565055][T22542] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 469.570524][T22542] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 469.575999][T22542] ? do_syscall_64+0x26/0x610 [ 469.580699][T22542] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 469.586783][T22542] ? do_syscall_64+0x26/0x610 [ 469.591477][T22542] __x64_sys_sendmmsg+0x9d/0x100 [ 469.596433][T22542] do_syscall_64+0x103/0x610 [ 469.601037][T22542] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 469.606953][T22542] RIP: 0033:0x4582b9 10:38:47 executing program 2 (fault-call:1 fault-nth:0): r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 469.610851][T22542] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 469.630472][T22542] RSP: 002b:00007f5ac62a6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 469.638894][T22542] RAX: ffffffffffffffda RBX: 00007f5ac62a6c90 RCX: 00000000004582b9 [ 469.646879][T22542] RDX: 040000000000014d RSI: 0000000020005b40 RDI: 0000000000000003 [ 469.654859][T22542] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 469.662840][T22542] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5ac62a76d4 [ 469.670850][T22542] R13: 00000000004c5230 R14: 00000000004d9380 R15: 0000000000000005 [ 469.683152][T22551] binder_alloc: binder_alloc_mmap_handler: 22548 20001000-20004000 already mapped failed -16 [ 469.720446][T22553] binder_alloc: 22548: binder_alloc_buf, no vma [ 469.726802][T22553] binder: 22549:22553 transaction failed 29189/-3, size 0-0 line 3148 [ 469.742534][T22552] FAULT_INJECTION: forcing a failure. [ 469.742534][T22552] name failslab, interval 1, probability 0, space 0, times 0 [ 469.763795][T22550] binder: BINDER_SET_CONTEXT_MGR already set [ 469.770859][T22550] binder: 22548:22550 ioctl 40046207 0 returned -16 [ 469.781876][T22552] CPU: 1 PID: 22552 Comm: syz-executor.2 Not tainted 5.1.0-rc3-next-20190408 #20 [ 469.782027][T22555] binder: BINDER_SET_CONTEXT_MGR already set [ 469.791090][T22552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 469.791098][T22552] Call Trace: [ 469.791131][T22552] dump_stack+0x172/0x1f0 [ 469.791154][T22552] should_fail.cold+0xa/0x15 [ 469.791175][T22552] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 469.791197][T22552] ? ___might_sleep+0x163/0x280 [ 469.791221][T22552] __should_failslab+0x121/0x190 [ 469.791241][T22552] should_failslab+0x9/0x14 [ 469.791257][T22552] __kmalloc+0x2dc/0x740 [ 469.791272][T22552] ? fput_many+0x12c/0x1a0 [ 469.791291][T22552] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 469.791308][T22552] ? strnlen_user+0x1f0/0x280 [ 469.791324][T22552] ? __x64_sys_memfd_create+0x13c/0x470 [ 469.791343][T22552] __x64_sys_memfd_create+0x13c/0x470 [ 469.791360][T22552] ? memfd_fcntl+0x1820/0x1820 [ 469.791374][T22552] ? do_syscall_64+0x26/0x610 [ 469.791391][T22552] ? lockdep_hardirqs_on+0x418/0x5d0 [ 469.791417][T22552] ? trace_hardirqs_on+0x67/0x230 [ 469.890746][T22552] do_syscall_64+0x103/0x610 [ 469.895341][T22552] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 469.901253][T22552] RIP: 0033:0x4582b9 [ 469.905145][T22552] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 469.924756][T22552] RSP: 002b:00007f1bb7670a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 469.933181][T22552] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004582b9 [ 469.941163][T22552] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 00000000004bd207 [ 469.949138][T22552] RBP: 000000000073bf00 R08: fe03f80fe03f80ff R09: 00000000fbad8001 [ 469.957323][T22552] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1bb76716d4 [ 469.965300][T22552] R13: 00000000004c6b57 R14: 00000000004dc518 R15: 0000000000000004 [ 469.974631][T22555] binder: 22549:22555 ioctl 40046207 20000140 returned -16 10:38:47 executing program 2 (fault-call:1 fault-nth:1): r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") 10:38:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:47 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) [ 470.022399][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:47 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(0x0, 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 470.066058][T22560] binder_alloc: binder_alloc_mmap_handler: 22558 20001000-20004000 already mapped failed -16 [ 470.080617][T22559] binder: BINDER_SET_CONTEXT_MGR already set [ 470.087529][T22559] binder: 22558:22559 ioctl 40046207 0 returned -16 10:38:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 470.212533][T22568] FAULT_INJECTION: forcing a failure. [ 470.212533][T22568] name failslab, interval 1, probability 0, space 0, times 0 [ 470.213928][T22574] binder_alloc: binder_alloc_mmap_handler: 22572 20001000-20004000 already mapped failed -16 [ 470.254741][T22575] binder_alloc: 22572: binder_alloc_buf, no vma [ 470.259597][T22568] CPU: 0 PID: 22568 Comm: syz-executor.2 Not tainted 5.1.0-rc3-next-20190408 #20 [ 470.270237][T22568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 470.274672][T22575] binder: 22569:22575 transaction failed 29189/-3, size 0-0 line 3148 [ 470.280400][T22568] Call Trace: [ 470.280427][T22568] dump_stack+0x172/0x1f0 [ 470.280447][T22568] should_fail.cold+0xa/0x15 [ 470.280464][T22568] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 470.280484][T22568] ? ___might_sleep+0x163/0x280 [ 470.280506][T22568] __should_failslab+0x121/0x190 [ 470.292227][T22573] binder: BINDER_SET_CONTEXT_MGR already set [ 470.296446][T22568] ? shmem_destroy_callback+0xc0/0xc0 [ 470.296462][T22568] should_failslab+0x9/0x14 [ 470.296477][T22568] kmem_cache_alloc+0x2b2/0x6f0 [ 470.296502][T22568] ? __alloc_fd+0x430/0x530 [ 470.307932][T22573] binder: 22572:22573 ioctl 40046207 0 returned -16 [ 470.311765][T22568] ? shmem_destroy_callback+0xc0/0xc0 [ 470.311780][T22568] shmem_alloc_inode+0x1c/0x50 [ 470.311797][T22568] alloc_inode+0x66/0x190 [ 470.311817][T22568] new_inode_pseudo+0x19/0xf0 [ 470.335152][T22575] binder: BINDER_SET_CONTEXT_MGR already set [ 470.337805][T22568] new_inode+0x1f/0x40 [ 470.337822][T22568] shmem_get_inode+0x84/0x780 [ 470.337842][T22568] __shmem_file_setup.part.0+0x7e/0x2b0 [ 470.337873][T22568] shmem_file_setup+0x66/0x90 [ 470.337902][T22568] __x64_sys_memfd_create+0x2a2/0x470 [ 470.343171][T22575] binder: 22569:22575 ioctl 40046207 20000140 returned -16 [ 470.349242][T22568] ? memfd_fcntl+0x1820/0x1820 [ 470.349265][T22568] ? do_syscall_64+0x26/0x610 [ 470.349280][T22568] ? lockdep_hardirqs_on+0x418/0x5d0 [ 470.349298][T22568] ? trace_hardirqs_on+0x67/0x230 [ 470.349314][T22568] do_syscall_64+0x103/0x610 [ 470.349339][T22568] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 470.349350][T22568] RIP: 0033:0x4582b9 [ 470.349374][T22568] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 470.357165][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 470.359528][T22568] RSP: 002b:00007f1bb7670a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 470.359542][T22568] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004582b9 [ 470.359550][T22568] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 00000000004bd207 [ 470.359558][T22568] RBP: 000000000073bf00 R08: fe03f80fe03f80ff R09: 00000000fbad8001 10:38:48 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:48 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(0x0, 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:48 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) [ 470.359566][T22568] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1bb76716d4 [ 470.359574][T22568] R13: 00000000004c6b57 R14: 00000000004dc518 R15: 0000000000000004 [ 470.509873][T22581] binder: 22580:22581 transaction failed 29189/-22, size 0-0 line 2995 [ 470.538613][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:48 executing program 2 (fault-call:1 fault-nth:2): r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)={[{@barrier='barrier'}, {@nosuiddir='nosuiddir'}]}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") [ 470.627708][T22590] binder: 22588:22590 transaction failed 29189/-22, size 0-0 line 2995 [ 470.661454][T22595] binder_alloc: binder_alloc_mmap_handler: 22586 20001000-20004000 already mapped failed -16 [ 470.707876][T22602] binder: BINDER_SET_CONTEXT_MGR already set [ 470.728463][T22602] binder: 22588:22602 ioctl 40046207 20000140 returned -16 [ 470.765311][T22604] FAULT_INJECTION: forcing a failure. [ 470.765311][T22604] name failslab, interval 1, probability 0, space 0, times 0 [ 470.779327][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 470.802709][T22593] binder: BINDER_SET_CONTEXT_MGR already set 10:38:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 470.831828][T22593] binder: 22586:22593 ioctl 40046207 0 returned -16 [ 470.885539][T22604] CPU: 1 PID: 22604 Comm: syz-executor.2 Not tainted 5.1.0-rc3-next-20190408 #20 [ 470.894950][T22604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 470.905347][T22604] Call Trace: [ 470.908767][T22604] dump_stack+0x172/0x1f0 [ 470.913125][T22604] should_fail.cold+0xa/0x15 [ 470.917731][T22604] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 470.923552][T22604] ? ___might_sleep+0x163/0x280 [ 470.928408][T22604] __should_failslab+0x121/0x190 [ 470.933348][T22604] should_failslab+0x9/0x14 [ 470.938036][T22604] kmem_cache_alloc+0x2b2/0x6f0 [ 470.942973][T22604] ? ktime_get_coarse_real_ts64+0xf0/0x2b0 [ 470.948790][T22604] ? current_time+0x6b/0x140 [ 470.953475][T22604] ? ktime_get_coarse_real_ts64+0xf0/0x2b0 [ 470.959292][T22604] ? lockdep_hardirqs_on+0x418/0x5d0 [ 470.964597][T22604] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.970847][T22604] __d_alloc+0x2e/0x8c0 [ 470.975013][T22604] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 470.980770][T22604] d_alloc_pseudo+0x22/0x70 [ 470.985307][T22604] alloc_file_pseudo+0xe2/0x280 [ 470.990170][T22604] ? alloc_file+0x4d0/0x4d0 [ 470.996968][T22604] ? lockdep_annotate_inode_mutex_key+0x5b/0x70 [ 471.003222][T22604] __shmem_file_setup.part.0+0x108/0x2b0 [ 471.008888][T22604] shmem_file_setup+0x66/0x90 [ 471.013591][T22604] __x64_sys_memfd_create+0x2a2/0x470 [ 471.018986][T22604] ? memfd_fcntl+0x1820/0x1820 [ 471.023759][T22604] ? do_syscall_64+0x26/0x610 [ 471.028442][T22604] ? lockdep_hardirqs_on+0x418/0x5d0 [ 471.033822][T22604] ? trace_hardirqs_on+0x67/0x230 [ 471.038852][T22604] do_syscall_64+0x103/0x610 [ 471.043463][T22604] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 471.049446][T22604] RIP: 0033:0x4582b9 [ 471.053368][T22604] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 471.067559][ C0] net_ratelimit: 13 callbacks suppressed [ 471.067568][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 471.072990][T22604] RSP: 002b:00007f1bb7670a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 471.079157][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 471.084813][T22604] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004582b9 [ 471.084830][T22604] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 00000000004bd207 [ 471.114903][T22604] RBP: 000000000073bf00 R08: fe03f80fe03f80ff R09: 00000000fbad8001 [ 471.122971][T22604] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1bb76716d4 10:38:48 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) [ 471.130950][T22604] R13: 00000000004c6b57 R14: 00000000004dc518 R15: 0000000000000004 10:38:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 471.178488][T22610] binder: 22608:22610 transaction failed 29189/-22, size 0-0 line 2995 [ 471.202586][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 [ 471.279065][T22615] binder: 22614:22615 transaction failed 29189/-22, size 0-0 line 2995 [ 471.307503][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 471.313328][ C1] protocol 88fb is buggy, dev hsr_slave_1 10:38:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) [ 471.330178][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) 10:38:49 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x400000000000002, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) 10:38:49 executing program 3: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e722", 0x11, 0xfffffffffffffffe) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_nlink(0x0, 0x0, 0x0, 0x0, 0x2) keyctl$update(0x2, r0, &(0x7f0000000440)="c0ca1cdbaa1aedbbed80dddaa28e15b9449e2e82cca4244c40ffd0fd4e6631c7d3d86e1339de17344340b02dd527f2d8b3ae6c1db3594e657da33c3ec668f143974a65753472df5319a6b83e1e86b8f2666c61a2e700d1c1e0ae1fc52494bd4885a5c64e9007d39fa11313805290dd6342f9775f01a02ec88f6bee22f25a377a9b143abba1264586d2779088006d5f9be82b00f10287031623f73470264cc5897f18f357aad6deb3883da88ae2266664933785a3ce72bb224a441437ea93c21782d4501b9dfbf48a9f3ea14cb792a7876f17297a8c870d7a2d46a36a2cd3e33e21894d91caa64b131dbf5c53066c1ac83ceba29ceab25127e8a446", 0xfb) r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r1}, &(0x7f00000009c0)=""/240, 0x4a3, 0x0) 10:38:49 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x40000000000014d, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100), 0x4) [ 471.456099][T22623] binder_alloc: binder_alloc_mmap_handler: 22621 20001000-20004000 already mapped failed -16 [ 471.525350][T22622] binder: BINDER_SET_CONTEXT_MGR already set [ 471.560907][T22622] binder: 22621:22622 ioctl 40046207 0 returned -16 [ 471.560966][T22626] binder_alloc: 22621: binder_alloc_buf, no vma 10:38:49 executing program 5: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x9}, 0x4) r0 = socket$pppoe(0x18, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x2, @empty, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x400000000000003, 0x0) r1 = socket$packet(0x11, 0x100000000003, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x3}, 0x4) [ 471.586507][T22626] binder: 22624:22626 transaction failed 29189/-3, size 0-0 line 3148 [ 471.623526][ T7871] binder: undelivered TRANSACTION_ERROR: 29189 10:38:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) 10:38:49 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000040)="f0"}) [ 471.717550][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 471.723384][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 471.744441][T22644] binder_alloc: binder_alloc_mmap_handler: 22641 20001000-20004000 already mapped failed -16 [ 471.828867][T22642] binder: BINDER_SET_CONTEXT_MGR already set [ 471.851185][T22642] binder: 22641:22642 ioctl 40046207 0 returned -16 [ 471.974533][T22604] kasan: CONFIG_KASAN_INLINE enabled [ 471.981196][T22604] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 471.994035][T22604] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 472.001002][T22604] CPU: 1 PID: 22604 Comm: syz-executor.2 Not tainted 5.1.0-rc3-next-20190408 #20 [ 472.010112][T22604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 472.020218][T22604] RIP: 0010:d_alloc_pseudo+0x33/0x70 [ 472.025576][T22604] Code: 41 54 49 89 fc 48 83 ec 08 e8 39 d9 b7 ff 4c 89 ee 4c 89 e7 e8 1e f1 ff ff 48 ba 00 00 00 00 00 fc ff df 48 89 c1 48 c1 e9 03 <0f> b6 14 11 84 d2 74 05 80 fa 03 7e 10 81 08 00 00 00 40 48 83 c4 [ 472.045281][T22604] RSP: 0018:ffff88809b8efd00 EFLAGS: 00010246 [ 472.051352][T22604] RAX: 0000000000000000 RBX: 1ffff1101371dfa8 RCX: 0000000000000000 [ 472.059526][T22604] RDX: dffffc0000000000 RSI: ffffffff81b8a01f RDI: 0000000000000282 [ 472.067501][T22604] RBP: ffff88809b8efd18 R08: ffff888053cca280 R09: ffffed1015d25bc8 [ 472.075475][T22604] R10: ffffed1015d25bc7 R11: ffff8880ae92de3b R12: ffff8880aa38c740 [ 472.083448][T22604] R13: ffff88809b8efd60 R14: ffff8880aa1d7a28 R15: ffff888093d6fb80 [ 472.085994][ T3879] kobject: 'loop3' (0000000086277215): kobject_uevent_env [ 472.091425][T22604] FS: 00007f1bb7671700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 472.091433][T22604] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.091441][T22604] CR2: 00007f6a1487d028 CR3: 0000000095eec000 CR4: 00000000001406e0 [ 472.091449][T22604] Call Trace: [ 472.091469][T22604] alloc_file_pseudo+0xe2/0x280 [ 472.091482][T22604] ? alloc_file+0x4d0/0x4d0 [ 472.091497][T22604] ? lockdep_annotate_inode_mutex_key+0x5b/0x70 [ 472.091520][T22604] __shmem_file_setup.part.0+0x108/0x2b0 [ 472.102494][ T3879] kobject: 'loop3' (0000000086277215): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 472.109148][T22604] shmem_file_setup+0x66/0x90 [ 472.109164][T22604] __x64_sys_memfd_create+0x2a2/0x470 [ 472.109175][T22604] ? memfd_fcntl+0x1820/0x1820 [ 472.109188][T22604] ? do_syscall_64+0x26/0x610 [ 472.109202][T22604] ? lockdep_hardirqs_on+0x418/0x5d0 [ 472.109216][T22604] ? trace_hardirqs_on+0x67/0x230 [ 472.109229][T22604] do_syscall_64+0x103/0x610 [ 472.109248][T22604] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 472.109258][T22604] RIP: 0033:0x4582b9 [ 472.109272][T22604] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 472.109279][T22604] RSP: 002b:00007f1bb7670a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 472.109291][T22604] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004582b9 [ 472.109298][T22604] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 00000000004bd207 [ 472.109306][T22604] RBP: 000000000073bf00 R08: fe03f80fe03f80ff R09: 00000000fbad8001 [ 472.109314][T22604] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1bb76716d4 [ 472.109321][T22604] R13: 00000000004c6b57 R14: 00000000004dc518 R15: 0000000000000004 [ 472.109334][T22604] Modules linked in: [ 472.281302][T22604] ---[ end trace 28bb12f321f806df ]--- [ 472.286806][T22604] RIP: 0010:d_alloc_pseudo+0x33/0x70 [ 472.292325][T22604] Code: 41 54 49 89 fc 48 83 ec 08 e8 39 d9 b7 ff 4c 89 ee 4c 89 e7 e8 1e f1 ff ff 48 ba 00 00 00 00 00 fc ff df 48 89 c1 48 c1 e9 03 <0f> b6 14 11 84 d2 74 05 80 fa 03 7e 10 81 08 00 00 00 40 48 83 c4 [ 472.312158][T22604] RSP: 0018:ffff88809b8efd00 EFLAGS: 00010246 [ 472.318318][T22604] RAX: 0000000000000000 RBX: 1ffff1101371dfa8 RCX: 0000000000000000 [ 472.326306][T22604] RDX: dffffc0000000000 RSI: ffffffff81b8a01f RDI: 0000000000000282 [ 472.334730][T22604] RBP: ffff88809b8efd18 R08: ffff888053cca280 R09: ffffed1015d25bc8 [ 472.343137][T22604] R10: ffffed1015d25bc7 R11: ffff8880ae92de3b R12: ffff8880aa38c740 [ 472.351201][T22604] R13: ffff88809b8efd60 R14: ffff8880aa1d7a28 R15: ffff888093d6fb80 [ 472.359258][T22604] FS: 00007f1bb7671700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 472.368263][T22604] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.374862][T22604] CR2: 00007f6a1487d028 CR3: 0000000095eec000 CR4: 00000000001406e0 [ 472.383181][T22604] Kernel panic - not syncing: Fatal exception [ 472.390127][T22604] Kernel Offset: disabled [ 472.394771][T22604] Rebooting in 86400 seconds..